Releases.rar
- SHA256 d265faafefbeb07267cba0fe855ab5f6b2360666b2a8649d39041d2e5a0daefb
General
- Target Releases.rar
- Size 66.7MB
- Sample261003-vebdcstw2m
- SHA256 d265faafefbeb07267cba0fe855ab5f6b2360666b2a8649d39041d2e5a0daefb
- MD5 5fe1f58dd28ec99305cb3128b9e97b4f
- SHA1 d97177904d5fd2acce794d1456c7b3804685a486
- SHA512 6f5bb6a195722e4b54e7534c9d42ce98530b98a81978b2ccc9103c657126eb46dbbb3c0b93014c17a92ef2d6eef5586648390ae57eed8b5298ec0ea2e592a117
- SSDEEP 1572864:r35chM0zclTh+pWCg8x6fqbAm48jAw5eL35cxKCmbKDjl9mE79:rJchM0S+pWC/6ibAmnd5gJcx9mbKDjic
- TLSH T177E733A53A80035F6BC2CCDD0A9FE7FC0CA07A32DB179419AEF115466631E7712AB467
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/Releases/Plugins/BlockerAntiVirus.dll disable_win_def static1/unpack001/Releases/Plugins/DisableWD.dll disable_win_def - Detects DonutLoader 1 IoCs
resource yara_rule static1/unpack001/Releases/Plugins/donut.exe family_donutloader - Detects NeptuneRAT stealer 1 IoCs
resource yara_rule static1/unpack001/Releases/MasonRAT.exe family_neptunerat - Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Releases/Plugins/ProduKey.dll Nirsoft -
resource yara_rule static1/unpack001/Releases/Plugins/MpDefenderCoreService.exe upx - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Releases/Plugins/bomber.dll pyinstaller - Unsigned PE 112 IoCs
Checks for missing Authenticode signature.
resource unpack001/Releases/FastColoredTextBox.dll unpack001/Releases/GMap.NET.Core.dll unpack001/Releases/GMap.NET.WindowsForms.dll unpack001/Releases/IconExtractor.dll unpack001/Releases/MasonRAT.exe unpack001/Releases/NAudio.Asio.dll unpack001/Releases/NAudio.Core.dll unpack001/Releases/NAudio.Midi.dll unpack001/Releases/NAudio.Wasapi.dll unpack001/Releases/NAudio.WinForms.dll unpack001/Releases/NAudio.WinMM.dll unpack001/Releases/NAudio.dll unpack001/Releases/Plugins/7zip.dll unpack001/Releases/Plugins/ACTWindows.dll unpack001/Releases/Plugins/All-In-One.dll unpack001/Releases/Plugins/AntiFormat.dll unpack001/Releases/Plugins/BSOD.dll unpack001/Releases/Plugins/BlockerAntiVirus.dll unpack001/Releases/Plugins/BlockingView.dll unpack001/Releases/Plugins/Bookmarks.dll unpack001/Releases/Plugins/Bot.dll unpack001/Releases/Plugins/BypassUAC.dll unpack001/Releases/Plugins/Chat.dll unpack001/Releases/Plugins/Chromium.dll unpack001/Releases/Plugins/Clipboard.dll unpack001/Releases/Plugins/Clipper.dll unpack001/Releases/Plugins/Cmstp-Bypass.dll unpack001/Releases/Plugins/Computerdefaults.dll unpack001/Releases/Plugins/Cookies.dll unpack001/Releases/Plugins/DeletePoints.dll unpack001/Releases/Plugins/DeleteSystem.dll unpack001/Releases/Plugins/Destry.dll unpack001/Releases/Plugins/DisableWD.dll unpack001/Releases/Plugins/DiscordTokens.dll unpack001/Releases/Plugins/Email.dll unpack001/Releases/Plugins/Encoder.dll unpack001/Releases/Plugins/FastColoredTextBox.dll unpack001/Releases/Plugins/FileSeacher.dll unpack001/Releases/Plugins/FileZilla.dll unpack001/Releases/Plugins/Fun.dll unpack001/Releases/Plugins/GMap.NET.Core.dll unpack001/Releases/Plugins/GMap.NET.WindowsForms.dll unpack001/Releases/Plugins/HRDP.dll unpack001/Releases/Plugins/HVNC.dll unpack001/Releases/Plugins/HideMBR.dll unpack001/Releases/Plugins/IconExtractor.dll unpack001/Releases/Plugins/Info.dll unpack001/Releases/Plugins/Install.dll unpack001/Releases/Plugins/InternetExplorer.dll unpack001/Releases/Plugins/JumpScare.dll unpack001/Releases/Plugins/Keylogger.dll unpack001/Releases/Plugins/KillCPU.dll unpack001/Releases/Plugins/KillProcess.dll unpack001/Releases/Plugins/LockApplications.dll unpack001/Releases/Plugins/Maps.dll unpack001/Releases/Plugins/MasonAndex.dll unpack001/Releases/Plugins/Memory.dll unpack001/Releases/Plugins/Microphone.dll unpack001/Releases/Plugins/Microsoft.Data.dll unpack001/Releases/Plugins/MpDefenderCoreService.exe unpack001/Releases/Plugins/NetInstall.dll unpack001/Releases/Plugins/Ngrok-Disk.dll unpack001/Releases/Plugins/PreventSleep.dll unpack001/Releases/Plugins/ProduKey.dll unpack001/Releases/Plugins/Programs.dll unpack001/Releases/Plugins/Ransomware.dll unpack001/Releases/Plugins/RatHunter.dll unpack001/Releases/Plugins/RequestUAC.dll unpack001/Releases/Plugins/Rootkit.dll unpack001/Releases/Plugins/RunPE.dll unpack001/Releases/Plugins/SQLitePCLRaw.batteries_v2.dll unpack001/Releases/Plugins/SQLitePCLRaw.core.dll unpack001/Releases/Plugins/SQLitePCLRaw.provider.dynamic_cdecl.dll unpack001/Releases/Plugins/ScreenRotation.dll unpack001/Releases/Plugins/Script.dll unpack001/Releases/Plugins/ShowMBR.dll unpack001/Releases/Plugins/Smil.dll unpack001/Releases/Plugins/System.Management.Automation.dll unpack001/Releases/Plugins/TCPGET.dll unpack001/Releases/Plugins/UACBypass.dll unpack001/Releases/Plugins/USB.dll unpack001/Releases/Plugins/Update.dll unpack001/Releases/Plugins/VB.dll unpack001/Releases/Plugins/WDExclusion.dll unpack001/Releases/Plugins/WSound.dll unpack001/Releases/Plugins/Wallpaper.dll unpack001/Releases/Plugins/WebCam.dll unpack001/Releases/Plugins/Weed.dll unpack001/Releases/Plugins/WifiKeys.dll unpack001/Releases/Plugins/bomber.dll unpack001/Releases/Plugins/dnlib.dll unpack001/Releases/Plugins/donut.exe unpack001/Releases/Plugins/uninstall.dll unpack001/Releases/SimpleObfuscator.dll unpack001/Releases/Tools/Injector.pif unpack001/Releases/Tools/JLX86.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/NSBin.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll unpack001/Releases/dnlib.dll - Untrusted Codesign Signers 6 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Releases/Guna.UI2.dll unpack001/Releases/Plugins/Guna.UI2.dll unpack001/Releases/Plugins/System.Net.Http.dll unpack001/Releases/Tools/Guna.UI2.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll unpack001/Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll
File Explorer
-
Releases.rar.rar 66.7MB
-
Releases/CoreAudioApi.dll.dll 30KB
-
Releases/FastColoredTextBox.dll.dll 333KB
-
Releases/GMap.NET.Core.dll.dll 2.9MB
-
Releases/GMap.NET.WindowsForms.dll.dll 147KB
-
Releases/GeoIP.dat1.2MB
-
Releases/Guna.UI2.dll.dll 2.1MB
-
Releases/IconExtractor.dll.dll 10KB
-
Releases/MasonRAT.exe.exe 17.3MB
-
Releases/Microsoft.Win32.Registry.dll.dll 25KB
-
Releases/NAudio.Asio.dll.dll 33KB
-
Releases/NAudio.Core.dll.dll 183KB
-
Releases/NAudio.Midi.dll.dll 45KB
-
Releases/NAudio.Wasapi.dll.dll 175KB
-
Releases/NAudio.WinForms.dll.dll 40KB
-
Releases/NAudio.WinMM.dll.dll 56KB
-
Releases/NAudio.dll.dll 7KB
-
Releases/Picture.jpg156KB
-
Releases/Plugins/7zip.dll.dll 1.3MB
-
Releases/Plugins/ACTWindows.dll.dll 10KB
-
Releases/Plugins/All-In-One.dll.dll 4.8MB
-
Releases/Plugins/AntiFormat.dll.dll 9KB
-
Releases/Plugins/BSOD.dll.dll 8KB
-
Releases/Plugins/BlockerAntiVirus.dll.dll 20KB
-
Releases/Plugins/BlockingView.dll.dll 9KB
-
Releases/Plugins/Bookmarks.dll.dll 28KB
-
Releases/Plugins/Bot.dll.dll 10KB
-
Releases/Plugins/BypassUAC.dll.dll 11KB
-
Releases/Plugins/Chat.dll.dll 823KB
-
Releases/Plugins/Chromium.dll.dll 25KB
-
Releases/Plugins/Clipboard.dll.dll 9KB
-
Releases/Plugins/Clipper.dll.dll 10KB
-
Releases/Plugins/Cmstp-Bypass.dll.dll 11KB
-
Releases/Plugins/Computerdefaults.dll.dll 10KB
-
Releases/Plugins/Cookies.dll.dll 6KB
-
Releases/Plugins/DeletePoints.dll.dll 9KB
-
Releases/Plugins/DeleteSystem.dll.dll 9KB
-
Releases/Plugins/Destry.dll.exe 921KB
-
Releases/Plugins/DisableWD.dll.dll 13KB
-
Releases/Plugins/DiscordTokens.dll.dll 7KB
-
Releases/Plugins/DiscordTokens.dll.config1KB
-
Releases/Plugins/Email.dll.dll 4.6MB
-
Releases/Plugins/Encoder.dll.dll 11KB
-
Releases/Plugins/FastColoredTextBox.dll.dll 333KB
-
Releases/Plugins/FileSeacher.dll.dll 474KB
-
Releases/Plugins/FileZilla.dll.dll 6KB
-
Releases/Plugins/Fun.dll.dll 29KB
-
Releases/Plugins/GMap.NET.Core.dll.dll 2.9MB
-
Releases/Plugins/GMap.NET.WindowsForms.dll.dll 147KB
-
Releases/Plugins/Guna.UI2.dll.dll 2.1MB
-
Releases/Plugins/HRDP.dll.dll 622KB
-
Releases/Plugins/HVNC.dll.dll 53KB
-
Releases/Plugins/HideMBR.dll.exe 57KB
-
Releases/Plugins/IconExtractor.dll.dll 10KB
-
Releases/Plugins/Info.dll.dll 18KB
-
Releases/Plugins/Install.dll.dll 10KB
-
Releases/Plugins/InternetExplorer.dll.dll 11KB
-
Releases/Plugins/JumpScare.dll.dll 8KB
-
Releases/Plugins/Keylogger.dll.dll 12KB
-
Releases/Plugins/KillCPU.dll.dll 11KB
-
Releases/Plugins/KillProcess.dll.dll 14KB
-
Releases/Plugins/LockApplications.dll.dll 10KB
-
Releases/Plugins/Maps.dll.dll 15KB
-
Releases/Plugins/MasonAndex.dll.exe 14KB
-
Releases/Plugins/Memory.dll.dll 8KB
-
Releases/Plugins/Microphone.dll.dll 539KB
-
Releases/Plugins/Microsoft.Data.Sqlite.dll.dll 172KB
-
Releases/Plugins/Microsoft.Data.dll.exe 14KB
-
Releases/Plugins/MpDefenderCoreService.exe.exe 1.5MB
-
Releases/Plugins/NAudio.dll.dll 502KB
-
Releases/Plugins/NetInstall.dll.dll 9KB
-
Releases/Plugins/Ngrok-Disk.dll.dll 7.0MB
-
Releases/Plugins/PreventSleep.dll.dll 8KB
-
Releases/Plugins/ProduKey.dll.dll 98KB
-
Releases/Plugins/Programs.dll.dll 9KB
-
Releases/Plugins/Ransomware.dll.dll 19KB
-
Releases/Plugins/RatHunter.dll.dll 10KB
-
Releases/Plugins/RequestUAC.dll.dll 9KB
-
Releases/Plugins/Rootkit.dll.exe 598KB
-
Releases/Plugins/RunPE.dll.dll 11KB
-
Releases/Plugins/SQLitePCLRaw.batteries_v2.dll.dll 11KB
-
Releases/Plugins/SQLitePCLRaw.core.dll.dll 50KB
-
Releases/Plugins/SQLitePCLRaw.provider.dynamic_cdecl.dll.dll 64KB
-
Releases/Plugins/ScreenRotation.dll.dll 10KB
-
Releases/Plugins/Script.dll.dll 9KB
-
Releases/Plugins/ShowMBR.dll.exe 17KB
-
Releases/Plugins/Smil.dll.exe 161KB
-
Releases/Plugins/System.Buffers.dll.dll 23KB
-
Releases/Plugins/System.Management.Automation.dll.dll 2.9MB
-
Releases/Plugins/System.Memory.dll.dll 141KB
-
Releases/Plugins/System.Net.Http.dll.dll 176KB
-
Releases/Plugins/System.Numerics.Vectors.dll.dll 107KB
-
Releases/Plugins/System.Runtime.CompilerServices.Unsafe.dll.dll 18KB
-
Releases/Plugins/TCPGET.dll.dll 11KB
-
Releases/Plugins/UACBypass.dll.dll 17KB
-
Releases/Plugins/USB.dll.dll 13KB
-
Releases/Plugins/Update.dll.dll 11KB
-
Releases/Plugins/VB.dll.dll 10KB
-
Releases/Plugins/WDExclusion.dll.dll 10KB
-
Releases/Plugins/WSound.dll.dll 539KB
-
Releases/Plugins/Wallpaper.dll.dll 8KB
-
Releases/Plugins/WebCam.dll.dll 209KB
-
Releases/Plugins/Weed.dll.exe 11KB
-
Releases/Plugins/WifiKeys.dll.dll 10KB
-
Releases/Plugins/bomber.dll.exe 7.8MB
-
bomber.pyc.ps1 2KB
-
Releases/Plugins/dnlib.dll.dll 1.1MB
-
Releases/Plugins/donut.exe.exe 247KB
-
Releases/Plugins/freemasonry.txt24KB
-
Releases/Plugins/uninstall.dll.dll 11KB
-
Releases/SimpleObfuscator.dll.dll 1.3MB
-
Releases/System.Security.AccessControl.dll.dll 36KB
-
Releases/System.Security.Principal.Windows.dll.dll 17KB
-
Releases/Tools/Guna.UI2.dll.dll 2.1MB
-
Releases/Tools/Injector.pif.exe 122KB
-
Releases/Tools/JLX86.dll.dll 84KB
-
Releases/Tools/Stub/.vs/CPLApplet/v14/.suo45KB
-
Releases/Tools/Stub/.vs/CPLApplet/v16/.suo62KB
-
Releases/Tools/Stub/CPLApplet.v11.suo17KB
-
Releases/Tools/Stub/CPLApplet/Analysis.vb.backup.vbs 2KB
-
Releases/Tools/Stub/CPLApplet/Application.Designer.vb428B
-
Releases/Tools/Stub/CPLApplet/Application.myapp471B
-
Releases/Tools/Stub/CPLApplet/AssemblyInfo.vb.backup196B
-
Releases/Tools/Stub/CPLApplet/CPLApplet.vbproj.backup5KB
-
Releases/Tools/Stub/CPLApplet/Exclusion.vb.backup702B
-
Releases/Tools/Stub/CPLApplet/Resources.Designer.vb3KB
-
Releases/Tools/Stub/CPLApplet/Resources.resx.vbs 5KB
-
Releases/Tools/Stub/CPLApplet/Settings.Designer.vb2KB
-
Releases/Tools/Stub/CPLApplet/Settings.settings272B
-
Releases/Tools/Stub/CPLApplet/Test.vb.backup.vbs 6KB
-
Releases/Tools/Stub/CPLApplet/packages.config133B
-
Releases/Tools/Stub/SDKs/1033/IlDasmrc.dll.dll 59KB
-
Releases/Tools/Stub/SDKs/1033/TrackerUI.dll.dll 22KB
-
Releases/Tools/Stub/SDKs/1033/flogvwrc.dll.dll 21KB
-
Releases/Tools/Stub/SDKs/1033/gacutlrc.dll.dll 34KB
-
Releases/Tools/Stub/SDKs/1033/pevrfyrc.dll.dll 23KB
-
Releases/Tools/Stub/SDKs/1033/snrc.dll.dll 35KB
-
Releases/Tools/Stub/SDKs/AxImp.exe.exe 60KB
-
Releases/Tools/Stub/SDKs/CorFlags.exe.exe 169KB
-
Releases/Tools/Stub/SDKs/FUSLOGVW.exe.exe 186KB
-
Releases/Tools/Stub/SDKs/IlDasm.chm.chm 17KB
-
Releases/Tools/Stub/SDKs/MSBuildTaskHost.exe.exe 168KB
-
Releases/Tools/Stub/SDKs/MSBuildTaskHost.exe.config.xml 1KB
-
Releases/Tools/Stub/SDKs/PEVerify.exe.exe 206KB
-
Releases/Tools/Stub/SDKs/PEVerify.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/ResGen.exe.exe 90KB
-
Releases/Tools/Stub/SDKs/SecAnnotate.exe.exe 1.2MB
-
Releases/Tools/Stub/SDKs/SqlMetal.exe.exe 292KB
-
Releases/Tools/Stub/SDKs/SqlMetal.exe.config150B
-
Releases/Tools/Stub/SDKs/StoreAdm.exe.exe 41KB
-
Releases/Tools/Stub/SDKs/SvcConfigEditor.exe.exe 2.3MB
-
Releases/Tools/Stub/SDKs/SvcConfigEditor_4.0.chm.chm 58KB
-
Releases/Tools/Stub/SDKs/SvcTraceViewer.chm.chm 59KB
-
Releases/Tools/Stub/SDKs/SvcTraceViewer.exe.exe 675KB
-
Releases/Tools/Stub/SDKs/SvcUtil.exe.exe 197KB
-
Releases/Tools/Stub/SDKs/TlbExp.exe.exe 62KB
-
Releases/Tools/Stub/SDKs/TlbImp.exe.exe 188KB
-
Releases/Tools/Stub/SDKs/Tracker.exe.exe 121KB
-
Releases/Tools/Stub/SDKs/WCA.exe.exe 52KB
-
Releases/Tools/Stub/SDKs/WFC.exe.exe 57KB
-
Releases/Tools/Stub/SDKs/WFC.exe.config.xml 3KB
-
Releases/Tools/Stub/SDKs/WSatUI.dll.dll 235KB
-
Releases/Tools/Stub/SDKs/WinMDExp.exe.exe 1.3MB
-
Releases/Tools/Stub/SDKs/WinRes.exe.exe 151KB
-
Releases/Tools/Stub/SDKs/al.exe.exe 190KB
-
Releases/Tools/Stub/SDKs/al.exe.config.xml 176B
-
Releases/Tools/Stub/SDKs/aspnet_intern.exe.exe 73KB
-
Releases/Tools/Stub/SDKs/aspnet_merge.exe.exe 917KB
-
Releases/Tools/Stub/SDKs/aspnet_merge.exe.config.xml 270B
-
Releases/Tools/Stub/SDKs/clrver.exe.exe 82KB
-
Releases/Tools/Stub/SDKs/disco.exe.exe 67KB
-
Releases/Tools/Stub/SDKs/gacutil.exe.exe 115KB
-
Releases/Tools/Stub/SDKs/gacutil.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/ildasm.exe.exe 497KB
-
Releases/Tools/Stub/SDKs/ildasm.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/lc.exe.exe 47KB
-
Releases/Tools/Stub/SDKs/lc.exe.config.xml 176B
-
Releases/Tools/Stub/SDKs/mage.exe.exe 89KB
-
Releases/Tools/Stub/SDKs/mageui.exe.exe 705KB
-
Releases/Tools/Stub/SDKs/mgmtclassgen.exe.exe 46KB
-
Releases/Tools/Stub/SDKs/sgen.exe.exe 65KB
-
Releases/Tools/Stub/SDKs/sn.exe.exe 223KB
-
Releases/Tools/Stub/SDKs/sn.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/wsdl.exe.exe 100KB
-
Releases/Tools/Stub/SDKs/wsdl.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/1033/IlDasmrc.dll.dll 59KB
-
Releases/Tools/Stub/SDKs/x64/1033/TrackerUI.dll.dll 22KB
-
Releases/Tools/Stub/SDKs/x64/1033/flogvwrc.dll.dll 21KB
-
Releases/Tools/Stub/SDKs/x64/1033/gacutlrc.dll.dll 34KB
-
Releases/Tools/Stub/SDKs/x64/1033/pevrfyrc.dll.dll 23KB
-
Releases/Tools/Stub/SDKs/x64/1033/snrc.dll.dll 35KB
-
Releases/Tools/Stub/SDKs/x64/AxImp.exe.exe 59KB
-
Releases/Tools/Stub/SDKs/x64/CorFlags.exe.exe 187KB
-
Releases/Tools/Stub/SDKs/x64/FUSLOGVW.exe.exe 213KB
-
Releases/Tools/Stub/SDKs/x64/IlDasm.chm.chm 17KB
-
Releases/Tools/Stub/SDKs/x64/MSBuildTaskHost.exe.exe 168KB
-
Releases/Tools/Stub/SDKs/x64/MSBuildTaskHost.exe.config.xml 1KB
-
Releases/Tools/Stub/SDKs/x64/PEVerify.exe.exe 233KB
-
Releases/Tools/Stub/SDKs/x64/PEVerify.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/SvcUtil.exe.exe 196KB
-
Releases/Tools/Stub/SDKs/x64/TlbExp.exe.exe 62KB
-
Releases/Tools/Stub/SDKs/x64/TlbImp.exe.exe 188KB
-
Releases/Tools/Stub/SDKs/x64/Tracker.exe.exe 129KB
-
Releases/Tools/Stub/SDKs/x64/al.exe.exe 215KB
-
Releases/Tools/Stub/SDKs/x64/al.exe.config.xml 176B
-
Releases/Tools/Stub/SDKs/x64/clrver.exe.exe 82KB
-
Releases/Tools/Stub/SDKs/x64/disco.exe.exe 67KB
-
Releases/Tools/Stub/SDKs/x64/gacutil.exe.exe 127KB
-
Releases/Tools/Stub/SDKs/x64/gacutil.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/ildasm.exe.exe 557KB
-
Releases/Tools/Stub/SDKs/x64/ildasm.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/lc.exe.exe 46KB
-
Releases/Tools/Stub/SDKs/x64/lc.exe.config.xml 176B
-
Releases/Tools/Stub/SDKs/x64/sgen.exe.exe 65KB
-
Releases/Tools/Stub/SDKs/x64/sn.exe.exe 245KB
-
Releases/Tools/Stub/SDKs/x64/sn.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/wsdl.exe.exe 100KB
-
Releases/Tools/Stub/SDKs/x64/wsdl.exe.config.xml 217B
-
Releases/Tools/Stub/SDKs/x64/xsd.exe.exe 88KB
-
Releases/Tools/Stub/SDKs/xsd.exe.exe 88KB
-
Releases/Tools/Stub/SDKs/xsltc.exe.exe 58KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/3rd-party.txt505B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg.nupkg 3.5MB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/License.txt1KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/Readme.md7KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/changelog.txt3KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.dll 4KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi216B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw.dll 5KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1.ps1 4KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll.dll 42KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll.dll 88KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll.dll 36KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll.dll 263KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/NSBin.dll.dll 15KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/NSBin.pdb39KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll.dll 55KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb117KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll.dll 90KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb241KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll.dll 352KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT1KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT2KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/README.md670B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/_Version.txt622B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/changelog.txt1KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll.dll 3.6MB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe.exe 343KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe.exe 344KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll.dll 29KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll.dll 1.2MB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll.dll 989KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/gnt.bat.bat 10KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/init.ps1304B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/install.ps1.ps1 2KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/msbuild.bat.bat 1KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll.dll 31KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb49KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets5KB
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/nsbin.bat223B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/powershell.bat.bat 451B
-
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/uninstall.ps1941B
-
Releases/Tools/System.CodeDom.dll.dll 29KB
-
Releases/dnlib.dll.dll 1.1MB
Releases/CoreAudioApi.dll
- SHA256 774a23dc38b9a7edcb15b4fce2ee24a786af82507b5dfc6aaa23e058fabb7a9c
- MD5 b9ffcd8b7f491d4aa65edbbbcc797ad1
- SHA1 fa476dcf62f96b3f0e3c9428678c2884054deffb
- SHA512 bc79a5840288c5d3898b61d3a51785faf0b815024cc47f7b037ee534fe51ba83b2a77521f946f8debc4d8029405a312b167c28c709ff12ccabc23123a64a06cc
- SSDEEP 384:J14ZUQwsT/RzKuk2J5RfTG86k16WEYJS/o7bGg4r4hTWPhTgIYi4Gjghv:0eQwg5zK2/BG8bErolDhSPhTpYi4Wghv
- TLSH T1A3E24B96C6609926CF9E83F878EB0B218770D2467363D3DD235C9078BF5235207A92B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:53:1c:b9:1d:51:f8:33:1f:0a:f8:ed:49:8a:99:c7:85:1f:33:42:72:19:ad:df:4e:33:00:45:b3:5d:f1:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Lenovo,OU=G08,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
Chains
Feb 28, 2022
CN=Lenovo,OU=G08,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Lenovo,OU=G08,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
Serial Number
04:1e:10:cc:0f:20:75:cf:84:46:11:4a:3d:dc:2c:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 13, 2021 - Sep 13, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\SP-LAS20-CB\src\HarmonyPlugin\CoreAudioApi\obj\x64\Release\CoreAudioApi.pdb
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
- MD5 c97f23b52087cfa97985f784ea83498f
- SHA1 d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
- SHA512 ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
- SSDEEP 49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr
- TLSH T16EA50A197DD4EE27D16ACE33D6D25021E3F1E4932AB2EB0E72D357681842349788637E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
51:85:2a:c3:53:87:5a:c8:6e:df:5c:75:c9:c6:c7:dc:b9:6d:bd:99
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2151934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/MasonRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 584bd9132b7dfa8e0026d75b4ab8b6ab0e3791badcb812fe7ba3dd6d68da5454
- MD5 5eda68272cfef69500b9b8ebb63e1396
- SHA1 5eb1c38c6466ed86f35b264edc9234854eb28740
- SHA512 ba73551ceffddbfa6ac6c4e4f3458539f41dc889aeea3c207f3bb10c2979de2e28242ba5684f2c2e3adde812070349c277b25913b4d149864d314ad799ce7b11
- SSDEEP 393216:nOd/HoVIfERMYIZL1mvgRgyLJ2m6njcJ:Od/HojRMYIqghoXnj
- TLSH T1BF0712073392DB24E4BA87F20462168183F1945EC7388EFD7AAC16BA7BD05C675897D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects NeptuneRAT stealer
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18104702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\ALL\MasonRAT-SRC-main\MasonRAT\obj\Debug\MasonRAT.pdb
mscoree
_CorExeMain
Name
.text
Size
17.3MB
Virtual Size
17.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Microsoft.Win32.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9a9d281c1a708aaae366f82fd6a1742f65da2918cc4fa5eaaaada0be24277d9
- MD5 59c48aacb1c413c108161afe13fdbed9
- SHA1 31ace4b26d8a069c84aad6001e06c2a5483806f3
- SHA512 8252abe64c67863d9e4c70e820f0c69c517b8678a4b4c13a436118bc276e5f21e84522b93566c0bc009effcb251ed67bdbc60e4907abea2f33b6be3764e28d1d
- SSDEEP 384:j4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWfdHRN76+fVlGsa9h:j4QVrxViR9mlxd96lv
- TLSH T140C22912AFE8023FFFFB0E316975D5120EB6FAC52912961E1548D28A1DB2BC8D531738
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f7:b6:99:b4:22:72:5d:60:72:4d:cd:e6:ad:87:41:f4:90:42:b8:ac:9a:00:ba:37:a8:a2:d1:9d:fe:22:40:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F7A6-E251-150A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:25:8b:de:8b:6c:72:26:31:dd:00:00:00:00:01:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
22634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- TLSH T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net472\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Picture.jpg
- SHA256 334764b9ba6f82a33baf0381f723abc03c9f466677c350eb1229537951ebc1f3
- MD5 18d26e74c7a753f016465f8502126273
- SHA1 0d8bd15da64fbea731e7a4db4cd2b379fd419674
- SHA512 7f6c31cca441a5bccef9945621d3150f1ecad72e0f77d9065cdad31d7f03fbc97bfa063c01643f62c35f84993d508e30489e8219b37325604309ac6e02f6d8e1
- SSDEEP 3072:4r/hx5xi0TyxE9eNt3bbyB1PBKLGzBQdFiCt:ebxu3yxKL0yFJ
- TLSH T1CBF3F12C59D5F6CAD3D95672BAFB91C1A2521B66FB074FDF20E4820230DCA046FD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Plugins/7zip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2562825c7a40f36791e81906f7a3e77e41e5225cf1c8feaf2dbbb1fe0f767609
- MD5 ec5917afced382500686a1df74cb1dff
- SHA1 d69886bc5faae9fcec25e5c3ee6b8a0cf4850287
- SHA512 e6b3de065e542c14be07336d8134a282e956aee22b962b822a3340bf68157258997333f329cf9214475bd07369da729b014a616fad3582a29800cecff2b7879a
- SSDEEP 24576:m0/LsiV9P+XbiDmHzsvTK6BN2TBQLge+ErnuIAr24sNhHXZ:mcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHX
- TLSH T14F558D15BBF1C078CA8A46318A2DABB550F9E71FCE1058C727C0AE6E6F31CD5D225A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1338042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/ACTWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2eb4052edbb4ab611e3ba9d8bca13c16ecf2f15735c067f6166b72405941aa27
- MD5 e868c10d267e8f5daa0b22e6976f072f
- SHA1 e9b542466b950132e53f43db1a451d19e43e4cb5
- SHA512 4e4d35beb5cbdcda55072e22c7784d47f19e97be24c022e2d1802d4b2117f033b4f133cd0ee1bb8cb00519e5e60bec4f97afb4705c04285b95a7f7e0c58ebc3c
- SSDEEP 192:V29alCi98OgSwNxyPlaMrp5O+Rx71tvTkIW1PnZLFzSTSQMLuOF:V/lCi987HyNHrpw+5tvTunZxzMSQOF
- TLSH T10222096957E08335CDFB0AB3585397510774CA08D913FB6F18D8B046EDA326987E2729
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9332caf704cb885af67881ea83236a20ee5f1bc5b0dd8fd5258f6e8b0c85d639
- MD5 a3c567e99b959207b4acf8370c612ead
- SHA1 19626cc48cfcba7d27e9fa0027e93e2b4cd84504
- SHA512 a7a8e72c4e1efb1f84a3d872fed4cc61923d2424c9591abcb40eb3dfcfedff0aa8b3f5907133004c21502db48e4ca0b413f34682e24b59b7f958badffd23b184
- SSDEEP 98304:/P19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:19FPRkC8C9OH7c2ilInz0kfVo26Wsd
- TLSH T1063623186FE18617F5EF97F1D1A2424A87F8E057E34AE79F5E8444F92882300DE262D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5042586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/AntiFormat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8c8f74ae15e7d809d9013bdfa2a10dd54e00d4ea5ff4ed6cd4a163b80d2d318
- MD5 18f968387bb3589c423829fe447efa37
- SHA1 cac95e2c1e30c33e2a9a6f1b04e476a9027db3a1
- SHA512 fc47172c49959440472bd58bacf7b02afd60ac8a0bb67627a475b17f8ef09c99d9d07e1c0189e31b2093c6b8ade7f6253c50bfa4e854568588b41792b2cbce8a
- SSDEEP 192:Bdqoy8GaAx12GOUXNgyuCkIW1Pn/zu3kWeAwLuOF:fqo8TTl+yuCun/i3ZeQOF
- TLSH T10612EA214BE54339D9BA0F72ACA252010B76F704CC37EB6E85C56116BDB77848BE2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/BSOD.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dec534ab858a71575a3836b96d0f96df89eb8ba50f9bc69350faa0f7bcccfd25
- MD5 7bd7d4f54d13899f8805c4713de5035d
- SHA1 012d942b121f9eee6c330a12b1ecb516c59dc5b2
- SHA512 7d7b5562c002fdac9af41961d107138baaa029b0d165669ab9d6689b047282b01a73aaa799b7b7c71d2ae9228b559d1008f19c4493dea5decc4eaa30e6f610a7
- SSDEEP 192:HzmVCoPw92k8mMGOql1ZT0IW1vneql2GGAnwL29:Ha+8I5ZTUneqtGAH9
- TLSH T1270209294BC487B5C9AB0B764CA325520775E500DD53EB3F9BD0B8524CE36844FA2B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/BlockerAntiVirus.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14e196e089014313c9fa8c86ce8cffb1c7adacd7d1df7373d97b30d31b965df9
- MD5 f1776961f57922dbd1f4fafd0a556920
- SHA1 17a16693257693a3a513c254cbdd28850891d993
- SHA512 4db70ae9eba5d043d14e6a1fbba6c9c157440539d665be1affb9558083198c90493cc11ae1907d1db21d4706917d28fa011854fd3e546480d671305bbc2c46ef
- SSDEEP 384:cSolvX93A/mPCOZJIPzbMJLbjk/5O6lmYL05O4kZ:cSoN93A/mPCOPAbx/E6lh40
- TLSH T14C925E817BF95338F6B7AF34AAB592428936BC1AED12DB1D4951650D0872B40CEE1F33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/BlockingView.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7be557978fd6a735844515ca387fa8bd26e60636dd276b038782b5712b05c59
- MD5 19465fba559039ca36d169db18e3478f
- SHA1 59c28a6250fdff723059c4487625197039980aab
- SHA512 6525c8234ca974701f8835b3f6af6fb919793618c130bf236ca0c30ba37988ea126449950cb3ebef9fd0b29fd16fa3f4126efcdb3d27cc259bbf2b083cf38cf3
- SSDEEP 192:LbCYDr1mTGOl61LYTWEIW1PnaGwpMeSLOE7s:3BDr8S90TWOnaGwpMiI
- TLSH T14312E82E93D08275D8AB0B72DC93A6112775EE10C9577B6F64E0B102C8FB1444BE2A39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Bookmarks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da27b3619e958d58f0a8867d765421328632b834b3a18955508609a3028a96df
- MD5 94c2da454f3b2dc67478f9fbda262f67
- SHA1 f01c9280a50b1eec18285c5fb522ee13e139e13b
- SHA512 5fbe80909b04ae8dc0ecc13d32715a1ac645f954c8fbe1285d32c46025243da43a2edf3167a80c69bc9763654310283a23ba84ba96aa26b536fe34ee6d0f01a4
- SSDEEP 768:O5PKDtoU1bOU+texSftVGeAsmc2v8pUZVPykbbl1zFreRN03OMFzB9gB:H1bOUZeQb7VP5bxreRS3OMxB9gB
- TLSH T16AD2C90C6BF99227DDAD6B7920E30135037591196A03F72F0E9CB9A42D73761C6127AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Bot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 35d314e93aba55edcbd56a34fe0958cd62f98d78166aa9f22d54ced471c1125b
- MD5 b27e8a1aa30e17cc836cfe1c8ccf197e
- SHA1 d94a7d3f3c55da6c09b347ff8ed2344fdc00fb78
- SHA512 f66bb230d94a41987402deed44c24a3e4c18a716637212f90149b46f0e8c85184bc200755b5a490f2178a87c8e4e90d563811cbe2fec53b3d58ac79ec4ac4bf1
- SSDEEP 192:TmuXKAgnBQrPY6xXGO6e5TgycT4IW1U9y/L2bEgwLWd:Tr9gnBl6xWjoEycTt9y/L2bEkd
- TLSH T13222192957E08276D9AF1F720C6393120772DB048C13FB6F19C861599D7B3988FE267A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/BypassUAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b4aa36247da1af1de0091e7444fbf8f829d133743bb3b931618c66bbd10d10b
- MD5 0308533647523c84c8f8ab0bf54c7506
- SHA1 6f2eba4deef2bca6400102178e74b5156168a1c0
- SHA512 0133e69541ad396f0e9fa8b9ff0a5905a3e87e5ac62d6fea0461cf956a3a23f112ee8821f19d247278662ac3c7a4faa921bd80d550fcadf860698d2c9043e0ac
- SSDEEP 192:KZcVJH7Z1myVn8kPWwuv5YkGO2XWbAaugyaTcIW1vr/DTEaliys7/uJY2wLunhH0:x/7ZAKaeBXWbXpyaTir/35liysyJYax
- TLSH T19032D71577D88274E6FA0E729FB3D2110B76F9089D26EB2D15D4A00A087F705CBB1B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4253974511be8b5a75f34e760a43dbf0afa99b55f480eab20187371e016d3dbb
- MD5 5f2ef273d55cd4a1dbfdbab7329a5e94
- SHA1 63c4b78e7a116b79e9a99ecfe7225cd20c54e0e7
- SHA512 c5ff5be9b0434dcc4f3068c9e93a8175662213b1d1b46b54942b808ec9d88aa80e73e426ebb9fee891333998bfc5b975a216a353d7c42d80985ae83fe6cc0781
- SSDEEP 12288:4OcnqWWqar4YYFz0WEo+LySnL9MmeRvSv/9lz083WItYOHRDiSQupLGzax:u4r7YFz75ELy9vS9/aOHR+Sfv
- TLSH T1D105230C6ED7C5FCD2FE19BA3C65C152A7FA8AA0EB93D7038C9522FA6C837508195741
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
849294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
821KB
Virtual Size
821KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 88cc579613730f847f72e28b4e880bd8104edf6d6ab37ffa0d18f273889d1a40
- MD5 3b76e0d885816941919c7e7201d89c2e
- SHA1 b6779066dd3a7ac4d9465422ded0c08a3f3d3ceb
- SHA512 35fdd501d5ca16965b1d478a68384336d9b05b369b9f03a762395d93676f7886c9d944c8723efc1d9861707ff8364cf2fe1a173d40c00762e6261baccbdbc5a4
- SSDEEP 384:6tGWc3ht3Xa7LHDxtN5RV/ZBPugcs9/cnjqlg91YDa3ZswkSL7:eGWcR5XeLTrPN/6qCbYW3ZsT0
- TLSH T10FB229096BE8C208FDFF4DBA84B607109376B0977E22E79D86C2905A4771FD49412BD3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31666
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afdfe3bc505312cc83fcfe140f57d73a6bd96693ae41b96d239b56764d32adf7
- MD5 21220547940d1ce5855a751bad1068bf
- SHA1 655e7f6007df68aca30577cb3b120d555d5cdc15
- SHA512 1d7f9d366fb1c65896c102d2d866bcc39b6c5879487345738060d04b58b87b3c2bd1e3cc9f8e9436098ffc0b9db80fdb7889d5c0748f3484cb16baf3e4c29677
- SSDEEP 192:ssIPTcMPafbNNckmpJOQds1TLxIW1Pn/SLd77wL2zTU:s5gMPEjctpJrqTLbn/SLdPzTU
- TLSH T17612E76563D84239C8EB0AB759B362C007B9E614DB67EB6E5CC0A1125DB71124FB2E22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e310a1b264912ae886cd956abc42dee846455a99f67c3ea8336a202240bd7dfa
- MD5 73f6b2215342236793690c163966539f
- SHA1 212667c959a394f0a3cee417e89e297ef7d1306d
- SHA512 b9b031c877b8166da6e339188a9e9d25740962676bb44f9630487c511c333413f8d46968e430a0667fce6899d28e01540a9d23cb690aed5e98e92a765ba8a739
- SSDEEP 192:Mfxgo6ZiR3r9UdNltC5IO/dQ1GiMIW1Pbe/JPA8/YjfwLOb:MCZar+dNXEuGiWi/JPA8/89b
- TLSH T1DC222B21D7D48272CCAE0F3E58A3524107F5E648C957FF2F18D8B0069CA329987B2B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 714f94e4700f2b8720403d126de3fa441d94b70e4973f0ea881504e04b135d9a
- MD5 247f45357ef35f7dd194176205ef0b62
- SHA1 311aa863dfa2c93cfdd85c31ac1703d74f490d92
- SHA512 fe0c5fb2353a1261698e6a7378b242f9a43164636861a32f6c8c1429c799b269f1ff562b272f9118faf778e0182c13b70863e7931b5c65ab294115a3f8a98ba7
- SSDEEP 192:gZcVJH7Z1myVn8kPWwuv5YkGO2XWbAaugyaTcIW1vr/DTEaliys7juJY2wLunhH0:P/7ZAKaeBXWbXpyaTir/35liysGJYax
- TLSH T11632C71577D88274E6FA0E729FB3D2110B76FA089D26EB2E15D4900A087F305CBB1B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Computerdefaults.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 638f85fd9826ed3eb0af37b93787384b0123054f1cdc49bcfe22627c57dffd34
- MD5 4d9aa2bf4c43a59e2f410289d3f29129
- SHA1 3f36c28d6069fc659eb825bda68a0e750ffd14d4
- SHA512 47de643fd669e33e1bc8ec77c31aaa1f260618f58d713c64f77c5b6f493e02c00414d9708c52dbf8cd7e2b66f978b3aa2df4efe4bc9fab7cd401d9f04e1bd229
- SSDEEP 192:Wy3SaMWtSTFGOinSgyITjIW1PD/lfJlrljlQ0lIdlUwSxEFoqwLuI:WyNt5b1yITND/lf2iGoOI
- TLSH T15C22E7A157E44274DA7F4E725C72978107B6FA09CC23FB2F49C4E24648B3368CAB1B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Cookies.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad344365d332f6791c9fcc29248462aa80c4c8252f3965b1b5f0548d36db1a39
- MD5 f987ac238d4240080ec1c43b039c9568
- SHA1 e2c386c6fdef3646c138d63af7ee5c7585bdef25
- SHA512 3719367c99dc2d00c39aa2fddbca50da8676ae915786cf187e4219ba1b80d76b002c76fe9757e07cde12f8cf6b31579d57d3e020c05a227cec47b839d43c5eaa
- SSDEEP 96:suqTW1W8Vatk3SrOfZmy9CAO1xqeVrTA:pqWhUtk3rfq1xlVrU
- TLSH T196C1B502B7F85535EEFF4B72ADB2661403B0F1A08CB2DAAE4DC1D1496C327650971FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/DeletePoints.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7c6a918d59bc739f3245b256da4bffc55534d2a6da00a38c102222a7cdd675a4
- MD5 09bc60b1a31ae9d52ae8a1454372c1be
- SHA1 090a8541730bccfdd0da246e7866fd5146884941
- SHA512 a24576586a93cc2005a4d6277e9c1fa7a66eed0234bb24362422b35388c07e13157e588b57dd3ae71a6aa7c334f36161493d62ce4145ada38c2ea604ef555544
- SSDEEP 192:bEcxz1oUYMqYzB2VBTCGO70140TwIW12nHesQ7e3wLuS:ocxOUY9YzuBDxXTZnHe97e9S
- TLSH T1F212E86653E0423DC9AE0B73BCA313110AB2E604CD67EB2E4CC0F15A9DB75058792A71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/DeleteSystem.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a4aa8d3890fd43315697d6ddad73ecbb663ffc4da26cdcb7d90aba91d3490243
- MD5 0804070273d5f3b3dfaf29ed412c8610
- SHA1 c10bf29d20c6eb52d9c3f9694e09d3b6b0791c4c
- SHA512 21c8abc3029dc9b8db3475cda8d0da04ea81f2818e900380c6ff464075ed372f1a963e850dee82a42727c2749ba9ac625953dcc6b615632a19bc46272cb960ec
- SSDEEP 192:YA/eNDt04xLmIc/Xh1GO6p71VTZIW1Un1kI6K9JewLWKa6:YA2NDtt+RwJ3VTwn1kw9JiKB
- TLSH T11B12F930A7D48274D8BF0F7258A2526103B6EB14CD23EB3F49D5B2115DA72D18BA2F32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Destry.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 deaf30953149d0bef45a11bd89f4ef69f77115e50380c7ef3607c37ff4f40a1d
- MD5 03c3e9290329eec39c6543006f9ac9f1
- SHA1 78e676fc850fb5d4e1c75b813f15b841fdf7705d
- SHA512 b2c5b1b060a0349bc92cc5a8b286f149b5cf6b40264e7b613b76c911e4acc6352ed0fdd9d945fae9c025963cae02f3f2cbef8a62bff844764a66481119c6321d
- SSDEEP 24576:QCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATg:1F+LL+fIWybB8
- TLSH T13B15239832772A1FCCE72737E5E739A463AE323D0937229D04A5F37D1E415C05726AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
949118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
919KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/DisableWD.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d0c6f5d916933a1f8d852ca42163ff50bfe07132fcacac03db7d20f573284208
- MD5 e4f5af68ab62a442a5dcb6ce0e3d86c2
- SHA1 09b4710ae76437b1ade0309eb19c0667ac625e51
- SHA512 b3ec580c8bfa843261bf6f6ff1afaf90e48ab328d3d6daf2aeab2a93de523627e811816bf75725f04982c056acddc46cc06d252469fd9920a104f3275e52cf41
- SSDEEP 192:TQLEv8T4LLpNkQvmDbeNEDTRQmCkUE2WKU1GO0zb7lgJ1T9IW1Un/3eKtfxie9yf:TojqEdJUEDtw9zbyJ1TMn/3euQ4XbU
- TLSH T17B52E94173E85278F5FB5F35AAB221154A37FD09DC22DE6E15A4A00E4873A44CEA2F36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/DiscordTokens.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b01088fac417dec6a3fbd04e53b705a959540698be8aefbea525ed2b98b02f5b
- MD5 00d9e9888b4eb964544507cebf406b41
- SHA1 0e59cdbf25db6a49d00d0357509f01dcedeaf265
- SHA512 38e3fa496174fd7fce086d59a56530a867d815a191a4dea9cc9224a738ec29473240d8c101678da448316cab54743de30c0f54e0f1cb76257fdf8d0a22076964
- SSDEEP 96:v3LgZlObRf9x16ZsPqb6zzk9J0L050S0/0CUA07080AGLHNI:/QKQcqb6zlLH+
- TLSH T136E19491E3F99629FEFF8E716EF351110B75F9649C2A9A9E0680618C1D327144B31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/DiscordTokens.dll.config
- SHA256 c872f25091c3d72ab3dcc16f05cb381cad122b0959f0234d05b0967689aca080
- MD5 a891c01d8cbeb5cfb120056ce6806bb7
- SHA1 cda886be5295239fb032e34ffdc29617d70e3c7d
- SHA512 eaad6b0fd069891afbb4a78bd3618ceb68b7c2a341a795d74969ffce3dbefd1e1c099624202afbbcb76e70fbd7da0079a8aa5a89e10e98bc8094a57545103cab
- TLSH T119219C7151CC9E690A310A76797A8C04C6BA43B3756D0C8AB1DE267BCBA6C890B07277
- MD5 SHA1 SHA512 TLSH
Releases/Plugins/Email.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ab28f0e7684628105fc850b977d8b149cd71456cbd809c431f5901c9dd91929
- MD5 06a4b2aa82bd9d863748f771a2357519
- SHA1 58b6c24323a78111bc548ae535a15162081817f3
- SHA512 bfd7c7e1d78dac1279c96919fac135a9d29050b51b380a7b63c91dc93b791423399b48dbcb6c091adf712666adc0945b3b2a300327d056bcdb2c52e492a0a7a1
- SSDEEP 98304:BR1dWdFt15LrL3sO59meXDZu1Byz9nXvOs9H9wF9QOIkChiDC9OtH7c2iwGx:xsFtvvsO59jDZ6SLwFPIkC8C9OH7c2il
- TLSH T1D22623192FE0822BE19F67F2C6A7065947F5F096B287FB8EAD44D0FD1D423415A222D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4851322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Encoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 630b1879c2e09b2f49dd703a951fb3786ede36b79c5f00b813e6cb99462bf07c
- MD5 0739eb1131ae7ffef3fda74dd6bec2b5
- SHA1 feb43e7757014ad9b8210664fa4e5e2f779cc563
- SHA512 bfd95dcaca10301b424e270cd08f2475309316aa430be75e7b1506e007ba505abcdf8df52ba3a5358c4d0db0cb95353ebb1f1d8cbfd1d00753568528d30a8d76
- SSDEEP 192:1lv9Y4Ko34k6Ppll8dld5aTBGOzutx1b+T+IW1PnQ7Si2pjzlHL2G:/v9wo34RsrPaTMCuVqTAnQ2pjzkG
- TLSH T1A732092E67D08672C9BF4A724C73C64107B4DD048953BF3B59C1B14A5E776860BE2E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/FileSeacher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 38d9995863fe489bdec386d0be5c8a1557d076daadf989eff38bb4938b13407b
- MD5 fc30e28894efffa25dc6555d776557cf
- SHA1 6926bd7f87c3603182d69cddcb4def6fb8abcdbc
- SHA512 9956510db214b9e310614fccb0964255c0ea0d62bd313e5a552054deec058ca88864bcea40b2b5371540872c2f14c3923d75520915b269f9c2d8441c46a2d196
- SSDEEP 12288:P+cX6nU+FxnlS4Ys50ie6Cf/gAtGwTVa:H6M4YNVvNUuVa
- TLSH T119A49E401BD8C697F1BF27B5D0F2A2A1C7B1A456B53EEB8F1D4020EE1D1B740A9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
491190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
472KB
Virtual Size
471KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/FileZilla.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6579a0251280669586a186e3b321136a9771a8f42a8e92345449b2db98f48cf8
- MD5 eaef2e5b8fc7e14c903c52839ffae1bc
- SHA1 5fc9cbb78721f13cb7dd2bb8c4a4aba255445c43
- SHA512 ed053fe6207581f09c331a2655e7e55bc10d623cc4811c291226415c3b036474137e73e339a1e376464f3902a929d97147b8b1c470ccae5c97553769154eb6cb
- SSDEEP 96:6uqTW1W8Vatk3SrOfZmy9CAO0DxqeVrTA:vqWhUtk3rfq0DxlVrU
- TLSH T176C1B502B7F85535EEFF4B72ADB2661403B0F1908CB2CAAE4DC5D1496C327654971FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6b78c23441a0bf7ccd09e59348b014a9cb2d2682d3f65abd96bf80551b535069
- MD5 9d584c25a8ef554fd6c3016403eadda9
- SHA1 3563fb9afceec99a3c98f65db5e7824842e7f067
- SHA512 0a6d3938b21bda65f37c1f31b3209361fc4c214b6e697af8f5bba8b879f8e899804f2ca4a7cfa385f387abd36fdbc99a4c3ecf52ce73585a89d37f8d350dba09
- SSDEEP 384:I4SV+oAAEZLmv4BOLPCP0R1slE7IJmwWB+mbgX23Aq0Q4//OV9iRRPbgBuC3YsAb:fSV+oAAcLmv78+1sJJ6BlbBq/0A8/4f
- TLSH T1A6D20910EFE64324E3BE2EF649B6F2140771F0079E23EF1E0BE460595577A918660FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
- MD5 b464fc896b14bfa34f608da53856e999
- SHA1 55568eecc97895cad49a42bffe757e3588c5313c
- SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
- SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
- TLSH T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b171c709bb3f478e21326ba65e22c107b0ad868058e8fdf16afb475f66a24a5c
- MD5 46818b97de2afaea6e466278fae64e0e
- SHA1 b87b477d6a3b1795038529b048c956558edbb98f
- SHA512 d8615bd3ef400685c30316cbc7f2e3c42aca44bf754ede542737226e938ab5329d10d126e6f6d4db849a30b541eef6a0d964bb3cee902c1d169e49c85d305bc8
- SSDEEP 12288:24fB/+6adrex2smFgCx/3UtXfgzmRLLH2fYxxXWyiLeZAyVFFczP:2WBpadreUsmFgCxfUXo6NSINtAULcr
- TLSH T1D6D4237FE2E81869EC3E9A366CA8238539FD98360C53373AF7D2542059FEA470251917
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
642558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
620KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 765608a2ca5f99ea17521a9c130cc82f0afe4cf051e749e25c8761f52784d10d
- MD5 c20d6b1dae846a0c2a4afd0f1913bf13
- SHA1 c5c35a21eddc2f3acddeff20c30f47ae030044d4
- SHA512 96c8b4dd35b17255e8e97a9a258d659a4c1bf3670c9d8aa86ddbc6f97d91ae5c62d0ed32473c3ebea273b3ead5fdf058cff9fc98035a6e701e7532501f648d4d
- SSDEEP 1536:BTZjCnSGYDUTFm8Lq8rYYtGvAcRsAWY2:bjsFDu80YQv3KbT
- TLSH T19F33F13D03D8917ACCAD58F259B368A143F0CE6589DBDF3F10D895E66CA32421D22B79
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/HideMBR.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b8be0d88ef5795b0f445481379b8caaaa621f17f9b5fd6b3834c61f44ad3b71
- MD5 295cc202f2fa1e00db6b3376a27450ee
- SHA1 f6e4b975d3d2e258028023cc162feacef712ad80
- SHA512 73ce99a3e20ca94828340a174eb45654ea1b5ea823af63f5ad6de3fc60d8bc912ae315ed5a65d8887a7528121f8e8a9d51219e911851bbc2cd32ea0e5d18b383
- SSDEEP 1536:Z0xKAR8NpSniWGpvPbPe3g0qlxofMSc89yLsw:Z0Gii3dP7ed4gn9yLsw
- TLSH T12343E05167EA0165D3BE4BF01B32559B4372E31C5C33DB2E18D860672FBB61AC9A13B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Info.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20c31ac326b5c6076f9b1497f98b14a0acd36ff562dfa2076589a47a41d0e078
- MD5 6b2a220abe487a406d3da013e12dd84c
- SHA1 45c3f9438fa6a353446b3f410c0ef01d89dbf101
- SHA512 68686f77674a929dd699acb9724f68c3d6b0fa80b21f09c923a063f8ca4427ea705b122ce7a55327dd9513774218ed846f5d46612a73b3892e03c790294265dd
- SSDEEP 192:7mu9vDfrz8TivOvuvKvfa+ybvGByvOvxKZRk/GObl/ev18qb4rIW1CNN698e42ZG:7miqLaDyTvxKZNclyR4INNw4E4HilG
- TLSH T1BD821910B7F85278E5AE2BB64EB2C05042B7F547DA23DE2E0DD8512B4A63359CF90B71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Install.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6cb5a6c1e0fda7f764de99f62cf58d26b514523a339d1b26ca7fbead7eb0435f
- MD5 207b83beb3e1fa8579ebac63dace1731
- SHA1 83ad53b7f24f1aa55ea66e559e20c985ba5416ec
- SHA512 3651dbd8e948ffbdccd3e3d54c0f4fc2fdd207769ca4823d441bd36ba0f1dbd742edbd53f8666a9aa6806b306d42ca147d6459cc629283688409752780e4f415
- SSDEEP 192:mJklM7hSMO340nynmQbKGOibaz1hbBIW1UM/uUOa9nxJwLWM:mJsMhOLnyZ3XbOhbYM/19nxJM
- TLSH T144222B15ABD042B5C8BE0F769C63160147B2E705CD23FB3E69E4A2194CA33658BB1AB1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/InternetExplorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d35cfac94ee5886442850ded8720ff822a9901b08781f690c0281a0b87942cff
- MD5 6a536ba592dbd226b3e3633fa5bccedb
- SHA1 6580553b2a43608d12edfb4200fdda18fadee978
- SHA512 d61fd2a756fe9b77899a5ebde2130739981e8db142d972a7e463d89cd0168789a4f2d7b6b594556c4cf9631d2ccae7920fe0399782f5fa99806623ae3226d64f
- SSDEEP 192:iR20Qi1MkDqmTOd9pSCjseoNfzQE16JA+Bn1PmxwTMfUjT:iR12eqmTOpjseoN/16JdBCZMX
- TLSH T14032C509A7E88225E1BF877A9EF343265334F922E932CB1F09E559091E73B414295F39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/JumpScare.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2778e94aa9024603278c2d57cf28ae64b87b1889f60596c5496fde749415a17a
- MD5 c0c9b9916e83b29a59ddf2d54acb74b3
- SHA1 53c9796ad48ddba0b7575fcc8b6106daed174e41
- SHA512 521e26f1e84a2df4ad5897f5dd92ad7bca9c3e6dd9de14c65e0cdc04734f51924e972e431ae862daea54ded4cd9412fe206ba581d3d60b242ad1f08a092b224c
- SSDEEP 192:6zNu3vQvZAGOFl18T8IW1Pd//tRE63fHLOxA:6+QvZR48Tmd//tRE63KxA
- TLSH T1DA02EA7367D08275C9AB0EB25C6286910B77F600D957FB2F59C0A01A4CF32564FB3A39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7ead8e5894e8ad48bdc7278fd87753c43a6e92fa10af196b8c58a0870e0e23c
- MD5 2d709caaa4c814053182898e174b2545
- SHA1 8162a8412f32bb3d94579ed241a0b83858d31d1e
- SHA512 c6b65610b4eeab657e98300f936ea06dbade40fea262813ba289f18233f06fa1f72e7d23cd41eadedfdafd0f3bb6e01754568d4136c1046972d261dd8294dc2f
- SSDEEP 192:nF4XvgURnvMyIUUCkbf3HWM9f55GObFLHF1Bw6x6IW1m6Vh6p72YioNcHnbwL210:nFeI4lkbfGq+uLzW6cVh6x2g4z10
- TLSH T14E421865A7D4827EC8BD0AB20C6393101776E3058F13FB6F0DE8B0065D776A887A197B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/KillCPU.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e3e6d4e0b7e0590737c1c807903810dd352951543a91e3cc4c2942b8c1b9d2d
- MD5 9b1164bd19a288b3cab77469a8978703
- SHA1 cebfa54ea39d0589f622ff171e8f047ea7e33182
- SHA512 b2106a1e3aeb686b580f8b5692c3bf1ccec62f450cf7ffd3b5758a2111eee35e286070848d9c30a33b6ab29f712883c5941d3f70164639176421eeaf9a2e7ef1
- SSDEEP 192:OX82FapXzhMh1NmEgAEGNwfOjLKJ1iqSIW1Un/KxT+ubdjTlHLW2N:OsN9Mh1LgpUw48iq7n/GquZjY2N
- TLSH T12C321A26A3D44379C8ED0AF64C3373434731D7088913FB7E68D4A9251EBB25856E2FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/KillProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bfefe85ead82555fd68a53eaba9d1604810212b2a4435a8dc309038e7e3a692e
- MD5 0eb00d04c332e45c6952470362c80d1a
- SHA1 8b0325077d13535344637acfbb0791184cc941fd
- SHA512 be554ef76382967907ca075a6d0c24f546f4b648be4bbfbbec64b3fe1aedf74ff1f42c5a306d6a164328d2672cdcbbf4e74e76bc1cedf06800d5d87e44803149
- SSDEEP 384:91ksD8g86Fx5XYydeLojb8kWMGdpAxs5ezuyWkt:5zLPXYsGPezug
- TLSH T11762F99853E04535E27E6FB51972A20047B3FE069C52FA5D4980F18E5EB3358CBE1A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/LockApplications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20a28a50e694f840461a2b7a089114d6356af61a097fefc36727a9c2d395ba4b
- MD5 8183c705b0b6161270cbf9156be74d73
- SHA1 1332b8b5c54d2ba20cd2dc713f6abd4b9562bdac
- SHA512 725530e11a33a7503826d7660cbb258ca429f06c6684b4f7abe7b96cfedef93b38fd946fd1e6f1aead9e0133506fecca14df8509638e67f297a0eace4ff55905
- SSDEEP 192:R7QHqDQqpMrGO5ib1EiTxIW1Pn/+kMpC0ewL2H:RWqH+qqwFTbn/+kMpC0iH
- TLSH T1AA22E925E7E44275DDFB1B726CA362410775FD088D23B72F1DC4B0661CA36958BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 06a1d45ff28850115c36fbc110d361bbb0ac224958de86c09cbb0c4826d4f045
- MD5 db403de3e2cd0cfe89112684e34b278e
- SHA1 c9cd8326a6fed612a9143e296b951a86021ad8b5
- SHA512 4a28f6c4873ddf2ec35dfa8e45a4157a0a37b7d8aca953690cffeecddc53e84cb3affef72dab14c48047ce0b7ea5744ca32c492380f801020d21495ef9ecdf9c
- SSDEEP 192:O4/n3oEIh6xL40Xhzpa0hZWB1jxjX7kNN56gGte31HCKM6IW14X/b8YIF3tAJLur:VngcV40X/l4jcPyteFiKsX/bSt9o2
- TLSH T1A6621955B7E4C272C6FE1FB64C72A20047B6E605CD07FF2EA5C860694A63792CE60727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/MasonAndex.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d8c6900b380fd5a462a8d64bcf0540d8de84065cd95575957d2a87de4be86b9f
- MD5 821bc1e520e4f5dad28ca06efe43e76d
- SHA1 27eaf3ca98cec9e8916edeffcd506891dd03c16f
- SHA512 61dc926044daa37a3a2ca93378e6773b7a393da0ac1a9413185317a489d49e9e91fd8877749d84bb5b9d68a678559c88f8ae530f4a77d730427230107ca15736
- SSDEEP 192:yBvYy0vZZWJiN69wDIp6Md9IjVcE50XBrJUKBmLeawV2Jk3LwEWo3Es8rjJfJ7at:yBl9iIgCHBCKwCamqlW8r9fJ7aH
- TLSH T12F522A9EE3A84332C8FF1B3649E316017371B5028D46EB562EECA1EB3EA3744455175B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\Coding\.NET\MasonAndex\MasonAndex\obj\Debug\MasonAndex.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f9cb639747cf60477a7ce664e786ae7be79a96e1432e3ee62558a223036338f
- MD5 ba7e12a1caae23c854cc506734a80244
- SHA1 e072e0957cf434b6ed80c086cc70454546c74a20
- SHA512 300a420bbdb44cfb7920e0ba137f6935b8ec663b1b6e779f138eee461dc438fafd705aa6a18603ef6286c62e0cb1fdaec8e51766f7aeec43414acb9607c389bf
- SSDEEP 192:dp14DiX2HwQG8sBQGOz714uOIW1fn/WK+GwLu72:dpuO2HwzP44uen/WK+K72
- TLSH T1E402E82207D48375D9BF0A729CA246100775E600DD63EF3F4ED0B1274DA36A58BB3A35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4492aecda17cd5a31be59a3fba0ccd06c63f0a0b7773a8a83e6831c2ebe06001
- MD5 b7134dfd9e5dbe9e36740c9114f66c79
- SHA1 bd0fefadd74aff707db640638d66cae2f26ca03c
- SHA512 80aa15f717e915082dfefc3dcb02c1bcb400bc60a9cee991172b5ff5415da27b861ce9b1da113e172492b0bd7bb7ad13a8bf46eac2795913a4ee0b16bd419fe2
- SSDEEP 12288:ocHij8LgXvwMZEvBFbgBqDvoNvfv3FSu:jHipXvF2vDbgBSvoK
- TLSH T155C46C15BBD49527E06F3772E0E20F2E57B4E48AB316EB8F449097E85E937464C40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Microsoft.Data.Sqlite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c43b68536a7a354b44fdd3ddf2c53bed254c1b69823480aee6f8d4af62b8909
- MD5 12cd1de761b989f4b5dac3f3e333560e
- SHA1 d14ef97d558982ae7d7f87de05b1c0e6d5b79bad
- SHA512 f3dc38fa66e57ed5f530ba377076a87b03846fda50e2fdd41ccf1deab32d2d846a91ae94b363009f7e68d96e8fb1d11334db6e68a27a149a095477bba2d4593c
- SSDEEP 3072:APRl424jaEptdFfHoIcslPNMtMWnsdxS3jCp10:Ag2Optd9IIfCeUsmC0
- TLSH T1F8044AA507981553C7FFCD35B4BA68CA0734619BE5C1CB47BE40E8E83A53314BEA426B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:b3:1b:52:bb:7f:a9:ff:2f:91:e6:9d:35:20:91:c7:d2:86:0e:f0:99:ed:ff:fe:7f:3e:f2:f2:ee:4f:3b:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 9, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
170122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/efcore/artifacts/obj/Microsoft.Data.Sqlite.Core/Release/netstandard2.0/Microsoft.Data.Sqlite.pdb
mscoree
_CorDllMain
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Microsoft.Data.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d124bf678c1349e9da1ea35349d4c469bd15a425a7c8413aa2d7beac37c74a30
- MD5 dd7910b2bcd456e772664da2b9e42295
- SHA1 9fc1bafda692ea07d0e9367661e564fc34618304
- SHA512 b66ff2db6e270b0254811d76cc6a3cfcb3e5bbce565c2cb6695a000dd7efbacc513685263494df56593bfa161944415b9206b8829b0b9261a68e26fd691cd0bf
- SSDEEP 192:B91n21YPJZWxoTz48XfbrhfTpm6bdHyeB3UF3XIIL6F:hnhZqqXfbrhTpm65HDaF3Yq6
- TLSH T16852A606A3E5022CF5B60F76AD3386210B37BE569D3AD75D099C215E0FB3604C962BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\pc\Desktop\Coding\.NET\MasonObfuscator\MasonObfuscator\obj\Debug\MasonObfuscator.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/MpDefenderCoreService.exe
- SHA256 12a5cd2b6e4b043892d9e42e9db5c06969f5061e0e913d0eb04ca8374ad45265
- MD5 2bdd7f970c432b37bbb1a00084d387dd
- SHA1 50b8734e01505f03c93f2b931d6ac3dc97f24e3f
- SHA512 69682738fc565820a798c88049b6d7290a5b8a72c23fc1a915a495da104ecf407d535f7caafc195243a9e9def003f2606946effee668be243825829bc91a9210
- SSDEEP 24576:/g9pqz8YfQYRGcxonVvqdvoAyoFtobpGJgmzryyMyKiTwwxNkAGtQTM:/Cpqf7muJ6byTHyvikwI9Q
- TLSH T1427533B53BE0413CE71CEA7F8A0EBCD4910659900A69DE6EE75E56C0C43F9A2CF99431
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
3274304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Releases/Plugins/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/NetInstall.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 56f00492141fa0aec1cd01d57c4ea1ad58f45811d189590b5762c099e44bb769
- MD5 4288e79287100d8355cc559f99768519
- SHA1 93aa0c080d86a0c778dc17818d6defc5ab1f16d1
- SHA512 b915359d4dd9adb3bc7ad52f56b680457e380c4285bd224fd0a2ff24b6153f7c1fabe19250d36741e95181c82d2915f1b0fcec0ca0a6e874457a1d6036af1104
- SSDEEP 192:xZEJwWpRvLwPwzPrLGOUVpgysxeIW1PnQ9Q0f2wLOKY:xZsNRvLw4+lQysxAnQ9Q0faKY
- TLSH T1AA120A2457E04375DEBB0A766C6356510B76EA00CD23EF6E4AC4B05B4DB31558BF2B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Ngrok-Disk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d47f7fde7438af3d3ff3822611285336d8603f4fd893ee2ac28ac7daa04032e4
- MD5 bc00e5b486fc67d22c12e7249922637a
- SHA1 46b75f6aeee89f7d67beacb92bf03081eeb2994f
- SHA512 591a224597794b5f6635412067b46010452108dfd2e943d0a93051d3b2f2667a0063c4c7d1a43a98d6b3ce523a5061566420fcfdfba5fa4fb932c10d91865dc7
- SSDEEP 196608:+CsxED7kwTV6B/nCR7+AA3e5MryK5Rj1Bpw7Vdjz8wEO+Dl:+TED7/VEqt/A3TryARj1BpwLktl
- TLSH T1517633286BD49267F7EF67F1CD92014A0BF86017B29AD7CF29DA48FE1DC1304992119B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7368610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/PreventSleep.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 63c2b25952541d4e0a8e00cf224e70c77e50277d6ab231f3ce7b58fd5b76aef5
- MD5 905118caafb720cd6336f8eeec4b7b09
- SHA1 9f641d417a335c3d9533eae0e8ba5de416034ef1
- SHA512 4a8d255c8ee0d99b84f5afc57a96ac306869f8fa9cc351e58512914be0c90be9f6ae6ed367fdd1adbce77c0724a45d0bd684af96b825ff72b2d15a15bed77614
- SSDEEP 192:Lbk4MnbdGOwav19TvIW1Pn/jp4jTlSLuc:Lhyb4ot9TJn/jp4jpc
- TLSH T16102E93193D48279D8AE0BF61CA3A251077AE600CA13EB6F56D4F0165CF32944BE2A76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/ProduKey.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4222c6c4898f954650baa7359803599842d34c4eb144fc5030ac3855528af4b5
- MD5 10ac6164822a0d91c74915353fb978d6
- SHA1 ccf51db397e1c9a44bc124cdf15a71528f9fa5c1
- SHA512 88d1f7cdc6903f0a4d1261a4e0dadfc3db9db76f168908472cf945f733768a6c7a02fc047fa69d07d4668d9f031e49a78a23626386ff860080fed9e6aaf78394
- SSDEEP 1536:Bf7bhFSAwsbzcvesvH29p9coCgSeX06hfKRXso2G9eUJxDbir:Bf7b7SQ3cmsCXcovdX1TG9eU7k
- TLSH T19CA36C437BE04471D9E70A7029B69F218EF1BC215539CA1FA798A94F6CF1390CE2535B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ff8e5092f4b265babe7b461dd694ccba9286b386efe86e3be500db4a447ecd28
- MD5 9374b3cb5fd1bf3a388b9c9c76d2c36b
- SHA1 3c3ca15fd709d7014706aab53ac96cfef0013fe5
- SHA512 1c4e9866f7eade362a9d55a8b8098381e25c7e44aa3ce87e49eb3a7fd956e85be4e03a1207b25f45f7385fc1319832cf26aa7d51a3fca3629c875e3294c9ac38
- SSDEEP 192:kFEFkuiICi952Gr2nRGOEg1WTkIW1Pn/S+7nVR5wLWIb:kFEGICO24c8mWTun/S+DVR5Ib
- TLSH T1E612F86967E8C275D9BB0A33582366100A79E6048D5BEB6E25CDF10B48B32548BF2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70554db8312c03c8cce38925db900cdbe8e57e88da29b0bf2f61ed1bbcaa03bd
- MD5 b6622ea6248736152d6ef4add2c32aa2
- SHA1 fdb658a3b07345b541ff37b31c380ca7b99061cb
- SHA512 2fa3d3498f872d36a97fce24529b22147c276f5ab0ac19223fc3f9d32a91ac117a4c9ea205a348aa4909065937d1a196e6db42c44331c3c044e9c96db1ddc44d
- SSDEEP 384:t2Ke2Etr8SLzINyKU5kbbx3qB+ZMmoI+sHT4k7M3eLHtHCh:t2eECS3INzsk3xw87yw+
- TLSH T1C592072E67E4E134DCFF09B364B3D2500371DD366821BA297DCEF06A1FB21894296D66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/RatHunter.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d6c19dcd14bee254962c44fcf015845f2851613633651006747a31a554af6ac
- MD5 6613e14391da7e4f1f8111a959f4b375
- SHA1 2a4f88cf1c1c8115a39caf46886b6c041bf8457a
- SHA512 0fb30a693780357cb88c58bdfbdf9b2de153f6016c17ebb570a66be78a402ac88748d549f81fc3ee4a9f31883767c1ac79a84115534c8dd4a0aea61690c434fd
- SSDEEP 192:gmu6hGh0U44xXGO6e5TgywT4IW1U9t/L2FEgRLWiIy:giGw4xWjoEywTt9t/L2FEfi1
- TLSH T1A2221A2957E04274C9BE1F720C53921107B2DF089813FF3F69C461569EF3299CBA2AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/RequestUAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8862ef216fcf1ac876420ca1c10aa40d6d87a2f13c92e47b79a5f2323e39db4c
- MD5 460f11f444b4c74db325d06aeca71a29
- SHA1 11af11fad0e5e43639d6caec6c0deea7ce4a133f
- SHA512 be970c0e392dd76761a1dcbfc6c7c389c51f250183e07c5f80ee949214b6d9e704ca39421f2e2e1705964b47d86f9076bf184f370014ed91484c8ea4a176f6af
- SSDEEP 192:LHUtgZzv/vcimeeGOp8bzJgyBTkIW1Pn/KisawMLW0A:LH6gZDc/ebc8bWyBTun/KHakt
- TLSH T17A12F82553EC8371C87E0EB64CA3222107B5D704CE63EB6F59D0A0664DA7296CAB377D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Rootkit.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d14639316bf7974b32557218da86435c97b16834975ffc0c7d16f125efd05112
- MD5 dd9051f7d97e985c7e165fcc74a1d691
- SHA1 720185400bbbafb82215f570592b48454adc51be
- SHA512 51abff4b8e690a5138607cde2ad1a4f94a24ebab749f860f47406118e62489ce6531cc1eb0820b3ce9f0b3e4ecf2a583c13fb794931429f9906c5f6b62750791
- SSDEEP 12288:/WVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D3:+VOQj+dWID+yG+zIzy7VxflRGa+CiL
- TLSH T107D423B822F4E19DD54DC93A37F7025B4220F52F5811A36627A469DC2EF382D8ECDE25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
618286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
596KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0588e2202f86db099aa148ba85b90b754e6b2fafa0b08e116b99e639932f9daf
- MD5 fc1513d37be5e6c93c3018e05f9c112d
- SHA1 c07027f7fcada40bdbfe597c4af4911cd4ca14c1
- SHA512 1a9bf0e0ae3ad337f6c75224b4955014ac651307920760d9829fefd8fa6483b1b97a207b2be73e8dd6b14a2c807ab1693ae7bf076a976525817ba9086b5eba76
- SSDEEP 192:KlFfqh94qbr5rmUrFIYeNGOJeq1JQSnIW1fUst+7poRwLuM:KlFChWqbr5rmSD7kJQGUstspozM
- TLSH T1FE321A2D53D88279C8EE0E734CB323410BB6DB48895BAF3F54D4A4161CE73864AA2772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/SQLitePCLRaw.batteries_v2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a123485502527a230c9363cdd419c4056f350c9f3867fb309898a725bec801ad
- MD5 fdb2d1ff9b91ffe62047856cf6ac98c7
- SHA1 7c8a94febffb90fb73a0e906d377f508ddb77841
- SHA512 e13ee3691fbf73aef2dc2611712323f8983c6e2b592835dbef9b420d6174224b0320db4da142e679772e887fe60d985bde1f42e9bf4ae6fc6c14a56be359fc74
- SSDEEP 192:m8hGeCwvAnfmZlU8BdSwUBH8aZ261ApS9mWgmKvhaVenszAAe:thG4IeZu8WwUBH8aZVZgvaEnWAAe
- TLSH T161320949DBE2522AE6FE0B317CB716044339B6A9E831CB0E9CC453795E3370186127F5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_e_sqlite3\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/SQLitePCLRaw.core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d2ed8e186f124f988ebdb45d0354185b424357be2433bba0033ab9ec31bd25b
- MD5 26cbe846decab0836717301f0bc6ec0e
- SHA1 a3902cfce95dd0756bcd22c51dbf9e69b1205be8
- SHA512 4926f2182bb6a3d6fe9705ff50bc59b5df06b62574c6ecf05aeac9b27ecc3e2c177efb37351d766de901dbc7a1ea91063e8950dfa7ec2d0cc6e87e84e6d76467
- SSDEEP 768:SUTwxD03Fy5WiUxBPHVNaDJqq4qLN75A4c9q1ITd9P581Itm/DshU:wAFy5WiUx1PaDJqq4qLN1JirPi1HLsK
- TLSH T12333D7749396DE29F4CE5130A43B00D5A670D019E7BBDB23FA90E0B069723CB59761BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/SQLitePCLRaw.provider.dynamic_cdecl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97a9f37f5701b19bb89503bf708b5b93a2426c176292d84778a63c3005afb460
- MD5 20a73d16e6cb948646890711b8613266
- SHA1 3c4ab0ce56ffba52680c3c1735227eec0a02a214
- SHA512 5bdea5e1db409ca391432582dc86a3219c286f08eb30b92c1e2e5d423c86a551034017eb4b65fc0c4ca4e8bc37084f2f6da9d6acc38d345ad79e24d4d1d31491
- SSDEEP 1536:7MQWHeW3PDeA5d65blrRV0H/pmEn+EALJ/ZEJgWW7S:7F6nXQFLE+VV4QW
- TLSH T146530EA2E3CF5EE6E18C0BB1BC7B06481075E65BF562E303C55EA234FB8338585E5295
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71250
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/ScreenRotation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd2b320433843d4d694ae8185c7ef07a90d7dce6d05a38ac4481ad2eab9bcfe5
- MD5 b9c83f29b6fd7595c8c565cff6fb3ac6
- SHA1 b301ed16a0c415e2a08b29f77cf82dc3f3f3ef52
- SHA512 e5d6e13bc620bdc0fe5d48ccec6ab0066b29382ab87040257c14b4247962f07db7f829cb504311c43cb600981b7610b23e51e1876ed737ec5549d71fbe01f6a0
- SSDEEP 192:712wUOPy0c054P8NAy32P7JGOlnbi1ibTIEIW1Pna+pgpk+eHL2Q:R2wU/0Bo8ND32AGboqTIOna+pgp/ZQ
- TLSH T1EF22F92E57D08272D8660B72DCA3E6100735EE04D967BF3F56C9612789F72484BE3B29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16242
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Script.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9739c1d56b73dc57ed79fb6db547cd908b21da8bb0842f15e0d316ad1e226b5
- MD5 9404a3b613d35a09f073ad9c94df234c
- SHA1 b74686c34244d89e926fc1b2d4c3a8754201a0a1
- SHA512 dab66cb5893113cf4736f6976e28f4c49b80808b5a2704f31da69557a6adb74d960da5e71cfbaea8fd86decd9d0c2f01bbbadc8cad72e7084d49f11f5129bfb2
- SSDEEP 192:l6o66c9/CGOgEu1iTcIW1Pk/3WF7wL23:lx66oXDRiTGk/mFT3
- TLSH T11512E82657E48231C5AF0B325C6356010F79EA04D913EB2F5AC4F11A98B766D8EA2B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/ShowMBR.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8acb377b7dc13d333e0c6bf221dd56569807187efed4d8a0f757d896e08684c6
- MD5 3a83e393931db364b6069d15da29cbe7
- SHA1 dd9143b60df41502d1500839f0740ecfd8f11369
- SHA512 bb8000411c7946ea3eb6712a84c06cd22e1f90dd8a86e7e30c01f2185c19d47d6eeea22508d70890af071f1d84fba148911f31f814c1b997807894cf6ca71d9c
- SSDEEP 384:dugLJuWhSRRa3v4ZPE1ScYcwmY2OJu3LTz93Zwn1liysag1N:nJumSLa3aP0ScvB9SLsagn
- TLSH T10B724B4273E64235D7BE4F728BB3610A4732F60A5D33CF1E0488516E6ABB6928691772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Smil.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc18ac689568aea34f287e1ff20bfee7cfec3f3f626aab3d2c23a180969ae0a6
- MD5 2672a80cf701037e262f1bb55c5202b5
- SHA1 fe35a751182023ea77e876a327d5e47f1e02885b
- SHA512 e1356770d6e23795170d855ae8cecfa29521a0dee86993e45c875f6cde2f0682d79a56d5ba6ad5b88817e886e21485e5755960a80bafd59d2bdd175ce845237a
- SSDEEP 3072:QiG22Q1qS2U6A5nHpIT999Vyai8AXUtmDGZLCLCZnuY02eI0/90jkrTxrWqY:QojqSd6A5n6n9TCX+CugC50tz/90jkrV
- TLSH T185F3024956B96453D7F5C2732CFF7E004364A66F9B169BDF388CD86A6F16384221330A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
- MD5 902760412abffbd10be14842e83f0c09
- SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
- SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
- SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
- TLSH T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:68:48:ae:8e:63:d0:cc:97:89:10:b1:45:84:7f:68:66:d0:47:4a:08:eb:2a:b6:89:66:c1:09:09:16:a3:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
18706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
- MD5 bd7f42207f4fdb9c7eafb0013abd7334
- SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
- SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
- SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
- TLSH T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ae:a3:86:d1:9b:06:39:d7:1c:ad:68:32:06:75:f7:af:5a:40:e4:f5:66:01:12:56:75:99:3b:c7:18:c3:38:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
138594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Net.Http.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d566e051fb3e4bab4553945a5f611ae931d9f8a56b426168abad3ed458da492
- MD5 28ab7abe312cd7dcec9c5390a9548db3
- SHA1 d2dc0c583e406e344cfbe4f39abe8222351929c3
- SHA512 c193acfcc33846ae1a68bc0b3fa5a42099d3f7c3c6916a678d0f1ed960d9953ec7001d8e74a5812953cef5f8e648f91785b4355a161c0e2235410bb4b52d2373
- SSDEEP 3072:gcLbBPuoDvWLLot2fbhTWhISam5fGBDyNAFZbRfAY/EROUv8M8Z8:gcRn6HVdOISaMfuQvD
- TLSH T143047C1527FC865BF3EF473DE03516118B75F6856503E7AE5C84A0FE28A3B90CA212A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 9, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
180046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Dev\WebStack\External\System.Net.Http\obj\Release\System.Net.Http.pdb
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
- MD5 a57f205ce75d4e4a19020e8b627469c4
- SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
- SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
- SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
- TLSH T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
105250
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/System.Runtime.CompilerServices.Unsafe.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
- MD5 cb5b861883d2bddd9833c9fe956406f7
- SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
- SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
- SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
- TLSH T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
14046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/TCPGET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4ff01ca94eb2aa3cf2dd1216cfd55e2a97b9bc72ba3f71711d0e5359a065c5a1
- MD5 fb923b9f1e26be97bb065cb3b761462a
- SHA1 349ed1e5f581fce1182be43ef575803ee0ebcfd4
- SHA512 0589497d195e4ae0c4def2437a01b0da1751868812e24127df1be8a1946f3773e25564f71d08a96610408ee33f57ad70429bae5eed2ef383b09ab94e2eb4a813
- SSDEEP 192:PQ9oodFUBEGh3/PMxPb1GRO1F00Y1HoLIW12z/tD0jIgNQLO0C:PQXkBEOMxPb14AwHoUz/t0jIgP0C
- TLSH T14B320969D7A4833ACFAD4B720CE3A2021779D702DA177F6B10DC70156D6725D8B92F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a19ef7ace3118ff9e5be24b388aff3e56a5bac0d4069bf8480721e3f4508706a
- MD5 757bb1b9affdd672c0f478206f0a6e71
- SHA1 a3b7aa6cae3ad1f3595aedcf3d7e97096ca5c5ab
- SHA512 85ea59a85b87aa35d7c5a57922f5858872017c06dbcc64955c45943bc484fb42327aeccc248c394999b2750d6f02fa6c88eb4c0f88eec45fa3d3c203cf8dbd28
- SSDEEP 384:/2PogNdG+EsAT8yViF3sVSVY9nzlrBFKJWpk59509P40:jYQtssVwY9Lj49sPR
- TLSH T1F5828C6993D88378D47D4DB60CB262810771D6194D67EF3F49F8B0061DB32EE4A61BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/USB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b8ffef55e9f920496c8877bc60ed8d0d7028e84507e3bb41be73b16ae29a1d05
- MD5 7026ba664d7df39eb2699caa9309ce75
- SHA1 db0d6e10b2ddfe5d48c062643b79842bf055b43b
- SHA512 bb01bb7025189d7182d29fbe3af2110648924f74d2c9959ac82663bc37dd1d5bd245596f0be230278aaae1ac9d09da6df7ee536728aa386ce5ddf5575f50c6f8
- SSDEEP 192:nPpwOCkKdPfS0GcHUuaYUrULqJINGOr0JBrokrIW1PMGU/SIannlraaIMLODX:nLziPfS0U/YhLqzLbsk1MGfnnlWa4DX
- TLSH T16D52195943E88639CB7F0F724951616007B2EE09C863EB6C45C4B19E5BB36808FB1E3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Update.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51ca4545217d68e70d7a4840ca35f35170e7487b6363e959b96b833e49c4225b
- MD5 b967d541c4804e015409c96b60c70717
- SHA1 13ac34f22ed5e545f0f03958a5a31503d4feabbc
- SHA512 04a6b9e964c34a95e3f83d20888ea6f37b145d606e2affeb15a28e2dace020259033b4214c314e9f8731b6ffaaec5035f286267ea6bb8781509be510f7728fde
- SSDEEP 192:yob+4SrATXA0JLrX3fkcnSti6i+7o8p9GO4bhXPBMbOIW1Um0zu7ueV9By2NHLuP:yob+brATXA0J3vkc8U+TpYHb/Mb/mwuO
- TLSH T169321A1EA3D48336C97E1B710C62D6410775DA06EA33EF2E49C5E4494E732588FB1ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/VB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a037cbf600cad79523921d0f2d0c1ad5a2ad32c295dfa7bd47bfa46cbc149ce6
- MD5 c0c59974cdae883969a7889aacfcc7ec
- SHA1 76eb5bc68265fca34a98702d8920bf5d3e48ee25
- SHA512 96c7cbb6d0e12dd57589569536653cc3f0dae4c945a386ba11f16b472f66d4e1d19fcfbc80ecb7a9dd7c862fb7fb6e07b4ddc8a495dfa805a095e445753c4ffb
- SSDEEP 192:BMsaeShQZqhVHnkhLYGOFeD01F4SPlF6IW1PnxlVsGpwLOE/:Ssa7yukh1y7F4BnxleGzE/
- TLSH T1A1221A2A43E48374EAAF0F322CA391022771DF04CD53FF7E2DD4A1469DA75644BA2B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16090
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/WDExclusion.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bbd4262c8821a0290fe40a8e374c6e5fa2084331670ede42e995d3d5902efcd
- MD5 5337f0fe8bb85d8454803809d2129faa
- SHA1 93c1991c32f813540c4344ef8fd6625155e6817d
- SHA512 cef7e4280a5377dea4189f31f83d7a618264d7f0999e5a7f4f9e4a0e41bfa37e1ce037e4dff60b0f7e8ee15a9d46997f0d72aaf9d17e0d61e8419aed76fcdf28
- SSDEEP 192:Zo8Q7GQqAMVR6fX69dpyaSG5SWuEEgytzZ2IW1Pn//Dn9LJ1AF6C2TL2r:ZEy/WQoWuGytzZYn/7n9Ln7C7r
- TLSH T13B22D719A7D08274CDBE1F72587282510B75AF0489A7BB6E48C8A40DDC736588EF2F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 18e28bae15bf08f6db5a86982d5c4fa0e4e69badee0acdad5e96fb00f0c674bb
- MD5 b9dfd4acbe607ce48fdc292457278a8f
- SHA1 931f4889b4fce3c1810b3a09f508c33a75ca5fb8
- SHA512 4ddce1025ea79354d3e131f249b2d88e1ab35b4911db40348e5e8cecad9d8650579ce88b612bb60eb284678961baa0fa5e875f0067871643be3265234ceaa04c
- SSDEEP 6144:Es+IzAJMUTQpGR2VbmYA44fb78+fmmJtiCnT6nymJa7hez4HqIKhBKbAAt5u5HR:Es+RJMUTZEVLobgMLaPt4hAAt5u5H
- TLSH T1F1C46D11BBD09527C16F37B2E4E20B2B57B1E48AB726FB4F046087A95DD37525C80BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Wallpaper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c25f01c631c3b2e39c33c5c14d3d26782a937f5f56f256975901484141e2240d
- MD5 cd5e12fc4943af85791b113a24017c16
- SHA1 76d2ba48b3a9715168623b34d94e439805a355aa
- SHA512 3a5857ea736fee549f43d385ef586de9ebb2bec519db3b17fe7bc3ef55a83cf764019251572cdcbe11a026cb3765971c3818f044b1ea17042c9673a90f0786fd
- SSDEEP 192:Az+7g1dXj9GOhl1ST8IW1Pd//lRE63fHLO9U:Aik1dXjYsSTmd//lRE63K9U
- TLSH T1DC020A666BD08379C8AA0F725CB282410B75E708D957EB6F59C0E11A4CF32564FA3B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a35113e1d9412701d85b5af01b4ad2b1e584c6e0963e439053808b29b4da90a
- MD5 5d6987094c7ae4a47112d84dc474e8cf
- SHA1 44d3cc8bf362d98b570ee17a41cb65538dbd7bc2
- SHA512 a50bb686369ee238ec2f6409cd213222695d80da0ad5bc227318b656a2ae1c6b1af5bcb36dc5efabf784197bab4222cfa08496ae74a09db2a0294425f72a0f9f
- SSDEEP 3072:S1WR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZ9l:S1+22fFcgBgakL320zYZHpMXM/5Wy
- TLSH T175247D06B3E58076E5BE4A3588735A199779F8118B71DF9F1B94026E0F633C18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
219678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/Weed.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 646bd334d213df10a1ed1cc70324b91f803a35ef9f29ee017730e2e1c07372cd
- MD5 263261188af203e662e763b98bfa4d89
- SHA1 94aef91006016627c0d850e3ce4ad41f582a815c
- SHA512 3e3e413d2ba3dc647ab5aa89ddb9ec4cb77fe165ec44e9e577e6b081856bdc52e53ec5a65751dc892ed7cdb590de56f79f5dc98f6ed72c06b3cbd8e7f058d195
- SSDEEP 192:ouUwF5iaFyQyqunte+2uqFPqyFWS5IceUv0W/dFB96B5JWJikHNdioJTrRb9:ouUI5igUqG4+nqFPZNMWHB9S5Jqik3iO
- TLSH T1C7322B2AE3C88637C977063318B35A0983F4E5C4D627EB2F2AEC211BAE7335416517A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\RemoteSsh\RemoteSsh\obj\Debug\RGB.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/WifiKeys.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3eac1cec6dd4f199c9cde38031dac175aab8dc2b4657b9cedfa5969ddc308463
- MD5 760446c8ff73a7de335ba94ea2002bab
- SHA1 9f375195a5a1ae50e5a22d9f57f23d9b580be1b3
- SHA512 743e2d0b21cf37e48f1f77d1a74b678183c99b780382fc4ae5d959e0481f0feb101aaaf0c6c754c9ab774342fed69c508c802ad19e4f1fdecc2668b56cde47c7
- SSDEEP 192:LLQIH1/3BSGOdu+1iTCIW1Pk+jrqGOXYIwLu8eOrre:LNvBfC5iT0k+PxOXY48L
- TLSH T19122F81697E49335CCBE0E33AC72526207B6DA08C8A7DB2E58D4735A4CA31548BD3731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15962
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/bomber.dll
- IMPHASH ea9a717aaf9e6cf1f5546b8c994ad07b
- SHA256 d84516b3e9af0139176ebad64b4e98b542c8021a29832aee3d4759149843b1b8
- MD5 58594ee9ee8d73513c35ff4c97531758
- SHA1 84fc72d50216c5330152e3979d3586276bb4041b
- SHA512 e1c08919b6bc942d8dabfb3b4b0e6ea6073ac6b83b08ea1443e8126a6cdeb79db4632f3338a0b87752deab768da25a18d685587f1e9c4c4309b111b2ee1465ae
- SSDEEP 196608:i4ZGXirMr8Ca7D95dLU6TWHhtbYPvOTvWJQlHHd0dAH9fs7jTVrD6N7i:iNirMCCZBbTeJQldbH9fsnpE
- TLSH T1B4863391BECB0479C04E263264F4CF7A05BAB8714B5648AB8FE11C75B8562C9FF7131A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
46528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongW
GetWindowLongW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
HeapSize
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetDriveTypeW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
DecodePointer
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=33138,
count=182, id=261, version=33138,
count=19, id=260, version=33138,
count=2, id=253, version=34321,
count=20, id=259, version=34321,
count=18, id=260, version=34321,
count=38, id=261, version=34321,
count=7, id=257, version=33138,
count=136, id=1, productName=Unmarked objects,
count=25, id=260, version=34436,
count=1, id=258, version=34436,
bomber.pyc
- SHA256 3e062e2abdd88f7f046cd73304a626d20bf4eb2473bc30f14931fc8824b8f3db
- MD5 d401170caf3a3afe070e500a68b3588a
- SHA1 1ab0626cc6b42e06d345e8f139d8d490fc03721f
- SHA512 b11d383d519bb742d6d51a23676b4a423663629125d8e12cb4b142c546639e481b36058627f33d4c627cce748cdbe50c7af10e2fc9a92ee451a35f4cde6ee44d
- TLSH T19E51C75A46918E3FFA90F5B970C0B52876B637BAD34936236145709F1CC06E0ADF324C
- MD5 SHA1 SHA512 TLSH
Releases/Plugins/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8bc7a627149386cb3cf714ae0101f69440f72cf2e7468a677b727b32aaed755
- MD5 9ed69fbbfdec5d95ea229da3969dd77b
- SHA1 7972339f0a1b6a28a2f335c84cdfc5d9beee72b6
- SHA512 61bfaa00736487ed736a27c1a9e45ce14b578452471866d195ce1a4736e72bd4bec98938b8cbb83ffbf09cbf188e9b8760452cc95ee30565414882aadd0171a6
- SSDEEP 24576:+9itfCdSZYeP0jsLpPl44znxuhv7fBTu1Z:W5QF6
- TLSH T103355B0177E8DB37C19F977B9422082847F1D896A7A7FB5F5A14ABA92C87740CC412B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1162638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net35\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Plugins/donut.exe
- IMPHASH 21b1752e7eea2cc224406a71808830f9
- SHA256 3c6710646d8eb93fc6055378a71a6114518c5f456e634dab028a72a40c3f47aa
- MD5 45336a23b777f9bc23781f13ba04d3de
- SHA1 ab1b0046761a8e735cd7871573745333342d40b9
- SHA512 2a34facb93a84a8451754cb73fb5214164f3378f32c5f0a3ed8e1b5eeae7f61b29bd102ba3df3e75052d73b9a49bf6b4d7d0f30f0cf9f2d28f045eae84e715fa
- SSDEEP 6144:vlt6D7xhNh2LeL0AGTaObuzrY6ysBcq8n:P6D7xhNh2a0rVK86JBD
- TLSH T15C448C15B3A510F6E8738234C9119706FEB27C4543A09B8F23A85BB6AF776E06D3D790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
kernel32
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
CreateFileMappingA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
SetEndOfFile
ReadFile
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
HeapSize
RtlUnwind
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
38KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=159, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=253, version=33218,
count=40, id=261, version=33218,
count=17, id=260, version=33218,
count=17, id=259, version=33218,
count=5, id=257, version=30795,
count=106, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
Releases/Plugins/freemasonry.txt
- SHA256 ee771ed8e55d54288c2dea4a96a531683f1deec39e462b6e69c1dd16a06beeef
- MD5 ac5634a7db4b9b815a2b7134d44da218
- SHA1 956a89165100bd1c3210aa74a17d7792a3ae4997
- SHA512 1c56af5fa618c2a4487b180cd91735489e0629f0521b9b086d4177da582d97dd3db87dff20cb92eb07773ada7609c0c830017e2b55edf0ca6af96f9abc1efb39
- SSDEEP 384:i5+8xNLmTvjf3GOOWyaX9iLuyKZ+1tv1aCEuVpJC/HeB/dmM:YX3KT6OOWyu9idm+TvgCEEJC/Hm/MM
- TLSH T1F6B2D9E0AA643637C7DF13BB996127DA0134D69117297064F69C0276440BF8F876FA2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Plugins/uninstall.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3784162dd9ec7becdd4f871876a4dd82fa7915fe31a0240a5da9b6b23c994ba2
- MD5 294ef964aaad39bfca55fe78d0113b4b
- SHA1 5ad16484341fe0e920e16ce33eeb43038e66950f
- SHA512 2932fc20c22f11fc0abfb25b7a525eea49e5852d3f236fb83a90d8872914727e9b8d56d1e6cb6adce10822eb81f9825d966d72e4bfa6f966a6d7d360dcf2a575
- SSDEEP 192:sQUvWv7vq8rVZC6HzB1GOcbhdPBfbjIW1Um0zHcIV47UHLWyk:sQUvWv7vqaVJCvbtfbOmwHV47Dyk
- TLSH T1CE32191997D0423AC8AE1B325862460207F1DA02D963FF1F09C4A459AEB33584FF1FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7caa6b9ff04aac89bcd324f73d96be3153a7456a0aad282d19f225e6473f5790
- MD5 a6314905fef88e334b24951c87d5fa64
- SHA1 8ec7aaf6a8e350099b62a8d2510b81f1e0882e2c
- SHA512 ea4b7ee050a218ed4fc411c2147eac9d219a9f274676ceb59868bc6d74f26a60f1c92cee8ba415dc24792c5261526750dd821ffc470035432363255c998589ed
- SSDEEP 24576:OB4F9bgtOr7iZVrnLuKYT9g+16hRrfh/v7fYm:OB4F9bIVZVrnLuKYT9g+0lT
- TLSH T1A2554A50B7ECDE37D16E0B75A4B005241BF5D406B323EB8F1A68A6F86D53B016C492BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1377294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e71e09c1a2706704333d3ad20e286ace441c8b512dd2dbb6dc69540daec54c8
- MD5 3a08a49898a5179db5a9266c253a9f76
- SHA1 340bdc2b764574e3010e70abb39127fb86302e57
- SHA512 2dcbddb6223b3188b588a5dffec5194da6b704aa4d6da8a43f461d1062e1262f3a8d1f9059c89d02378a481be65b665248092946e203b21b691e16403292073d
- SSDEEP 768:wmuVTRTXz5SdjKb6UWBkyN8/AN/iDD9zk4/9hl:wmSSdjK2FliWiDpzkEhl
- TLSH T1E7F2D752A7FC1229FFFB4BB07D799A251D7BBAD63902C50D0154910E19A2FC0C9A1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0d:1b:83:18:29:57:15:9c:f7:cc:2b:80:92:c6:63:1f:d1:a8:d5:f5:2c:9c:bc:80:1c:86:3e:a1:06:c6:60:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 22, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e9:0f:71:30:7e:5d:f1:12:36:00:01:00:00:01:e9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
31062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
15:1f:de:b6:f3:56:f1:80:ad:c0:ff:4f:a8:55:41:ad:fa:07:51:b3:2c:1f:9e:57:30:1f:5d:fa:af:6c:1b:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:26:df:ba:4b:22:b9:82:82:07:00:00:00:00:01:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
14422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Injector.pif
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80230af406263f3e136b2bf17e57446c662126dc3e5e619eff45629bb1af05f5
- MD5 fbdf9de8dfdfc35ecfcce91337427a59
- SHA1 bc5d0acc87a10f27b6a153548f98d9ce45d4de00
- SHA512 e2aa82b93ef572b50a5bea444b06a5ba6c9407f55c53f44dd117cabd4f8b143363ec5321a6efbf94d2c9d0814e2b37e6e25aba12b6cb09243a0317b00d762759
- SSDEEP 3072:2Z6wu2hblforeghGjluiFeOUiCRUdxsnHtUIuq9Hc:xwu2hRordhGjlMrBRUdxsNwy
- TLSH T1E2C3BF0133F56B23E6BE9AF209A141C247B6615B1266E7C92DC560DF71F7B8087D2B83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
116338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\analysing\Desktop\MasonCPL-123\MasonCPL\obj\Release\MasonCPL.pdb
mscoree
_CorExeMain
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/JLX86.dll
- IMPHASH 065442e6edd35ac709de7695650b14e0
- SHA256 bb4315535a02ab1041c2d9501c79e090e3c1e69ea2eebb564bf9a8bb84bf50fd
- MD5 230e9947bdacac72fa6556c32a3fd721
- SHA1 c534758bd97f59782da939ca8c43e76df394f920
- SHA512 259b16a89d681e84d6590116c85e89556ec009848fbaed4d6c27c4a77630c152d596db172ff95e6c7d79b5c2986252d58bd04f2a963bea75b8a3f1159683c1e9
- SSDEEP 1536:2VTJkN5UBzOMFgjIdriQ7nrloBA4WAWJkKNgOqIm3wedssNZWsWkUYXcd545YExn:+JZFCkriRBA4W1NgOqImAsNrBm5nEfJ
- TLSH T1A8836A107AD1D071E97E1E351868DB609B3EBA20CEE09DAB375506BE0F302D1DE35D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10540
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DecodePointer
RaiseException
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
DisableThreadLibraryCalls
VirtualProtect
GetProcAddress
LoadLibraryW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
WriteConsoleW
ole32
CoInitialize
Invoke
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=140, id=261, version=27412,
count=18, id=260, version=27412,
count=1, id=253, version=28518,
count=15, id=260, version=30034,
count=22, id=259, version=30034,
count=39, id=261, version=30034,
count=9, id=257, version=27412,
count=92, id=1, productName=Unmarked objects,
count=3, id=261, version=30148,
count=1, id=256, version=30148,
count=1, id=258, version=30148,
Releases/Tools/Stub/.vs/CPLApplet/v14/.suo
- SHA256 cb2349d897532962b179e7d9227fc88a6115dea29987fc86dc969011aa717df3
- MD5 698a96e91c83fc738968daa515fc9210
- SHA1 bdd46cc5a22af109a485a39a21976ce52a34d5ff
- SHA512 de3fa76db5e3210bc552b425ebc6ca7aa54420c6cb3f1f466c34609579e1ee22f6bb6c6ebdf97688daa39f5e73449cce437e71fecf0fb3a28e56113f2db5eaf7
- SSDEEP 384:ftB7IJj0NvTIQkTgxgiOn1qdwVQgpT4UizBo8NOn1qdwVQgpT4UizBcgwgX8wvUA:7U2Z8Pjn1qdwVj8Qn1qdwVU8eDSMb
- TLSH T10E23972033F8A258F3B74FB66EFAD595117FBC61AE25C25E2155734E0839A11C8B0B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/.vs/CPLApplet/v16/.suo
- SHA256 fdedc447e6fa416951caebd333afacbb5fade6dddcdeed89c46b946676f18857
- MD5 0ebbd33e06c2254e755f282a74d19e93
- SHA1 9b04afc096ac65ea4a4ed6851f096548eb4a41a5
- SHA512 e6429160f0c0109d9dee3c7c252630707bb8ada06a0b75b9edea0423359b4d86e24e4d2bfa06f9371992873a1bec307bdc0e0b92b8d3fde3172140293500b1da
- SSDEEP 384:ZymhdIVUIjtvaprCwv+El8LdfDtfPomIrYf7sidJ8GYrttotzflQ0vw0Ib:jiVTjlapFT8pfAisW8xoG0vwHb
- TLSH T1F453AA1432E0A224F3B74FB69DFBB995523EBC716E95C11E2154B38E1839B81C8B4727
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/CPLApplet.v11.suo
- SHA256 6502f6fae1bd41985a4bb11d99d612de8dd1017edc3a1b3bce61e755d137d653
- MD5 9c93eaa331e5d95f0286f57c247f1625
- SHA1 fa1deae26aab88b8999fcf921ac536023fd4cd6e
- SHA512 b7cd757ab06c31d9039a0b51f45e548db7ee8f85f9b8dc42f630620ccb133cea8883eb487d2d6d557cbc2f484f3d970532346e054177d7bb1606e69323f74f6c
- SSDEEP 384:EUIh6Uqlm/ttoJn/1Eq1V5eSkis/wX6zB:ETbqlmy/1Eq1V
- TLSH T17472212027F95648F3B74E317EF6D6A9547BBD21AE22C35F2155738E0871A81C872B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/CPLApplet/Analysis.vb.backup
- SHA256 9ecf533c4d8c59b7fc98e2d94a2d6121cc07a2964782b4167e95e2341eee9ce4
- MD5 9733fd8bccaed72cb52f312a269e125c
- SHA1 f993cd03f7670595ad09a5437e21a2ccce244ca2
- SHA512 e2c2cadbb80f8865ac045efc6cbf8cd3dce5c4faf60ee7710f4834e86799fb1f342c34a493f51dd8611632877abece269096a179f24bf2a5426748be66a93232
- TLSH T1AC51E91BBA927636851ECCB8C41FA00BBDD40643D1449C91F9CCB3E85F722DAB161BB5
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Application.Designer.vb
- SHA256 02f379d5724be98e20719129751477f14eb6688de482997713406bbe97e3620d
- MD5 d1310027c13772ff6b18080e993ffd84
- SHA1 eceae9dace971615363793033085fa7075739611
- SHA512 5ceaaf654e8a59bb149a3e9970718359389963325fa5c8036b0179e59128f05aabb839f583d07984cf88180f8d2cef5296531c4e92acd170716eaa2316e5b98c
- TLSH T16DE02BB15CC46E725192D4D02002D829C670E29FC515C87F308E6F4DE31165CD11DAD0
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Application.myapp
- SHA256 330cf4612ea0a34d581c7cc22709f23902a918708f2079d90e24e5cfef7aa7e9
- MD5 dcf8a316c9be1143fda5e627db3087cd
- SHA1 38d9f1f87eed79bf895fe233ce2a4fb1566ad63d
- SHA512 7c78bd9a0ee66b904efc10bf164db1cedcd9c8876e679df002e48b913814fef1ca1fe2e4240e3a0c49f9dfda67b8a588a32c10f83e88bf706e4ed884a9793ad9
- TLSH T1BEF0A7D8C3515174C6C6E2B2E668C9C911A3E67C8AE4CCD8A4A15C9C615518922DB98F
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/AssemblyInfo.vb.backup
- SHA256 6404cacbc2f6d0bcd41831c7f58325e5106ab52f30e6a0d3b6ed460a9fb072fa
- MD5 253223d3731896050505e14c6624f4f1
- SHA1 481d3a47be594f51764cf13bdf8090e694859db1
- SHA512 c642a8bcbabdb2b9177dbbbd1450c40b6ff8521b6c1c495ba1aa67d3a07c49043bccb11fcd6fe8b426b06feb25045ba591f6e3f8ba9bd5b782ab681d5f08f35a
- TLSH T17DD012248146F7E21F150D9BBE937C95857A073522DC7C98B0CA3B22C6C79680230351
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/CPLApplet.vbproj.backup
- SHA256 982919a3c7e71cb09c3edaf4386c0865cb766de7a6ca8b5ef30134f5c21b185a
- MD5 bd6dae092b1dcbb1158c02a51ee3d8ff
- SHA1 3cce7f404b0ba6c114b7bbee59325c3ddb648571
- SHA512 b798bb112a7a50b71ba09b34f784b090fd832e1bd8f1ea65e86cebc7ca8b3e1b065c482b9de2f06ab480eb0b45d2e9b744a40713cea0355d8d7b13b8619ea96c
- SSDEEP 96:wPnpqkpJ9cAVq2pRHOAi1rhHBxNs2Ah65+0+4RIAEOI1fU9dlNegcl/:lAJ9cIq2pFTD2JI8GUDPeh/
- TLSH T18FB16425D7FC9FED53E221739260E5041FA093E316B01468F28DDA889F936851267BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/CPLApplet/Exclusion.vb.backup
- SHA256 01693a0e1806c72d51ad01064a1bdaa513240047f31212ec9fe2857299a8f5bc
- MD5 9e2eb539bd3e67eb731cbc5cef40f6ff
- SHA1 e3e6d913a05107d2cc3252c29cc5f595ea76aa8f
- SHA512 c2cf31d268e329ceb386b6d363f12e2c1cdccd93940c14d45e9e47d828c9a858a863fc7de3797e7e9e5b7de8181a36fa7c43d93e008770da2c4cb6ea95b82a94
- TLSH T1B201E717382227A3C76F1E0414A9430734A7142384444D60B0FC222CBF2C6E7D31529F
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Resources.Designer.vb
- SHA256 03d336b9b6cb39d71400cb42a32303858b47238060cade591160990dfc37a6a3
- MD5 92d8b193e43e2b448c332ee06ad57bfe
- SHA1 7d880d9c0f6f033842f7fdbf7b41cea8a20205be
- SHA512 b7597ea05ebedbbe169ec5dccf92ed79cb3d83e8612600a436b6c54244feeecaa9a34f69b9bc25fa4ecd2f5e7ad0cb42ca1073b0780c11a9af490965f35ded00
- TLSH T10C51EFBB5F9EC5315422DC47A900A452CEA211A7C53C6CA9F99E11EC8FE3384037DDB2
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Resources.resx
- SHA256 b1ebe25ff520e1e643e8c1721710f7a6ae238e82dc00275e655d2cd9775c7c93
- MD5 af3c5bab0c237dbf68008fa09ce04c84
- SHA1 384cda15c55d73d9668478be89f1d3ef1a6d4863
- SHA512 09602a1ff5fdeec6c43e0ed45691ec96b1b38fbf3ffebb8d8809bd8a3ab2a8eebfe4708c2fb7d401d0913a9f91c67b0c232d2f8b694fc8397c9d3ab8500406f8
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFC3qxdRMvDbu8KsrbEKAy202lUf:Zf+tLPfYnLvFVOiFQaUD7Ug00h+
- TLSH T1D5C13045B2D5DD260E93483CD64139847BA8923F0234AC94B4DC961E9F53B8267B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/CPLApplet/Settings.Designer.vb
- SHA256 4f18e37b36d9eaa1a3e4806c17dd5d8e24939613faca577dfaecf149de7abb5d
- MD5 4e06cbbb602675775c388af9979aa7c5
- SHA1 c4e5fc28481e9b1d44b387c99a01857983805335
- SHA512 8ac92c13a7210cbb8ef6f1e0c492d39c9b5163ef34ce9cdf2afa37af32d2130ecc83fc42a74e3b9e1bbad0e8e7273957ce3b107cd9571eaa58cde5e328be9e63
- TLSH T18251CCBF3E89A73D5545DED4CA0AB652CEB002A7991C7CB4718D21C88F5678013BEA70
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Settings.settings
- SHA256 8b69ccd0f9c62cf44fecb8a9de2f0c307ff382a60ad3b9ec9c660ab28552c1f2
- MD5 0915ff283653f2db02461610ded08861
- SHA1 ac69df072032a81c4a3b9861805d43d26f9b2096
- SHA512 f9034231d2ec8360047a18dd5851d3fbdc409f57293b9b6e06d02e1ac228391d491243a8807d3c2b051a9c9a723647909e27cc3c0d7b8b51b5408c4cc37a3a19
- TLSH T1CBD0975AF488880AC220BEA0F4ACE33C8540633B456C917492F43C4C090B0C31BD34EB
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/CPLApplet/Test.vb.backup
- SHA256 b9177c8e1a3910724763e146b74d8a111d1a071d0b972611c7b3440166186cdd
- MD5 1682d71b87229d59fab663b31f379b75
- SHA1 0a8ac52e8ee05ad10735a2556714389c2d2ff9da
- SHA512 8af3bc43a89f36f9e5c111080504d4da477a7a1a0f0136e4703b510caf0dcd71d7e613f861d80647451fca614ebc2f00486f7303563c2851612058b50e0f5325
- SSDEEP 96:LjwQCChHU26hXTRxvpsYUAY0YD+Xj/HZtD2LTjaX23k+qC8V227Tzn:LEQxCV9iDk/5tD2DzL8V22b
- TLSH T107E18526BE496A3043CF459079AF964A7DE716632008A8B0B8CCE794CFB56D453E83DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/CPLApplet/packages.config
- SHA256 4a7cef0859d1c41b8cc68b003f4082c7fba22b26d925aa935d53b6cc194fc736
- MD5 aa4be4789db76c29fe258871b30f4ae1
- SHA1 3a59516dab671a8f7db8caf438d98dedc235d8f4
- SHA512 cdfce5d8bd643cf123f5fe49db815d58074cf18bed267d2f9a5d26e2ea7cb030fb320e44bc160b2b1620768ef8ad57d511c92264382390d04619208f30ee3305
- TLSH T1DAC02B016214933386001C00B3B8C0044BBC713B702003CC7DE086404B2104A034B6D4
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/1033/IlDasmrc.dll
- SHA256 5d7c2f2b975af894be11a560971b018eb8bf498da5c9056bcdd7bca88bbb3113
- MD5 9d0c1bd1ea78db915f6b5daf9c53fdb0
- SHA1 5c69d5bcbb7ccdd95a2a3a9334c460e7c1668938
- SHA512 539cecb94a9b393a30741065a20a1338c742ee491877d045ae09281136b9ce95d84706c1a087519a3a845d015d46ff227c0f06ee1f2ecb85cbeb67b994db6e7c
- SSDEEP 384:8b3nqW3BHWOubNYAL1PWbYe3jKESkYqgzPk/SMnC0GftpBjEUa3GRNFtAHRN7MVD:8b3NPubhYKESkxi6UaBMGmkmx
- TLSH T1B053CB83D3EA84C0D4A199B0AD3B94A59E373D50643282DA4E64FF3F6E7BB109552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
62:7f:96:15:84:51:82:1c:e8:fb:2b:8b:d0:dd:67:9d:f6:4b:70:61:cd:32:1d:9c:0e:c5:0d:ab:11:a1:54:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e9:a3:98:5d:06:ad:23:6e:72:0e:70:76:14:71:64:b4:51:60:39:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/1033/TrackerUI.dll
- SHA256 458a438434c49581b052fdcd0db5b1e21ca966e738440426963b24177ff9559b
- MD5 0aa38010fc32780174009c5530925c40
- SHA1 802a3933d4a401bdeae237d39beb24564e483913
- SHA512 ce5d8cc7c7504baa3ffdbdf11dfcaa27df087e6bb13baaca4a04bce0fac32ee202dab42bc7cf52e8476dce05119714b7425b1f8db63b2eb89d91c940e5c39d39
- SSDEEP 384:MXWD8WQTK78xJ8xClRAtkQG47h0GftpBjV4X3FtAHRN7LUklrhfbi:1jRG1iD6ALUOji
- TLSH T1F5B2A55057F84042F9F369B02AF9C9536D3BBAD25930D21D109DE29E0FF3BD19A14B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:a4:4c:39:91:61:a6:9b:d9:69:62:6a:bf:4a:40:22:8a:46:43:c3:4a:3d:6c:a7:70:86:f1:65:3d:6c:bc:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9b:bf:6c:80:5c:0e:5b:6f:b1:11:6b:50:98:fa:d6:ea:46:0a:82:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/1033/flogvwrc.dll
- SHA256 19b0cac27da5ce62d473c9620463b7d2fd17dee8de3268b5a08e120964b743bb
- MD5 6a7ec16333a987c588deb9edd2d645bd
- SHA1 8a21b738dd8ed1374aefee79f72b7c4abbce0d02
- SHA512 88ced1634396968c1855e9eef67fcfaa17205e451f2472dcf487e10201ed84539afc6e941224d6a168583398ce11dbaf5320dd33f4fc81ae8051077b00e7a474
- SSDEEP 384:iWzcqWZRQxnq2ELDF5RKfwMnC0GftpBjiu8wFtYbFtAHRN74lrhfN:0dcfXi+KRSV
- TLSH T187A2198187BC9406ECE36DB067F8DA837D3DFBD20D20951E2595F2991C92BD1EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ed:b2:11:ae:df:b0:3b:c1:e7:2d:4b:d0:bf:cc:f1:03:17:76:b6:7c:2c:22:de:4f:a4:ab:5a:5c:43:da:f3:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:84:84:57:47:7e:36:ef:a2:51:19:b5:5b:f4:f0:41:82:e0:bd:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/1033/gacutlrc.dll
- SHA256 950f6c8ed8c61a11b66108a7143006f28351d1a46585ca4b2781aa0b0089697c
- MD5 0ad7732dac1ddde05a48cd7ffe0868dc
- SHA1 33792687aecab9e6b1e606cb426c4d3b20b06681
- SHA512 286cd7c9c568c68eb2a944a96b7f4e43874d6c93ba42058facf7b1310ee95b5c3b591901b4bd5166eff0784180e9ce9e44d699a96b4bb9e5f9ad534b8a741a78
- SSDEEP 384:go1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWm/L0GftpBjW5FtAHRN7Ob:gAIecY0QrQNCeK8iEaowk
- TLSH T16FF2FB8297EC0105F5F73E307DB5A5A21E7ABD92AD39D21D2198916D0AE3B80CD3077B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:80:4d:59:0a:6a:6e:82:a3:ce:4b:53:06:9b:fe:ca:a2:6b:7b:15:fb:75:14:dc:da:a1:7c:d2:17:af:b2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
4a:19:2a:59:9a:1e:53:e4:0a:17:1e:85:90:0f:cb:8f:a1:7d:fb:9c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/1033/pevrfyrc.dll
- SHA256 84e1f46ba4c03134d96bc9f3b6bfa0132ea8eff8fdf72969a7989b4753b02584
- MD5 af37abb1080964dbfdd56da426b336cf
- SHA1 46a1b404f7ca2619b63dbab771f177efedc0f4d9
- SHA512 07e5ea73a63d7f7c8129ffb659f3f86ed0ccfc31417f75f03d0990e127b71c9667822e29f416f4beb514063e8d454c4c9ea237fb14fcf776cd5889b7b129d22b
- SSDEEP 384:3uyneWNJXWbh8eMnC0GftpBjEso/FtAHRN72ClumkLet:3uyLQh8Ri6ImmkW
- TLSH T16BB2C6819BF84146FCF36E3066B8D9463D3FBFC15930921D0198E16D2EB37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:04:26:58:be:74:d3:e5:e0:85:55:82:9f:f0:cc:f0:84:ca:27:71:c5:e5:3a:f8:d3:2c:00:50:11:d9:01:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f7:89:1d:50:84:1e:f9:db:57:d4:7e:c6:08:47:58:6d:55:88:b0:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/1033/snrc.dll
- SHA256 2e6caa99964a3fd86ee7c3f554750f866faecb02112da698f578d02adc3b3b48
- MD5 703f3f14aaee73373ce01d9e68f1a950
- SHA1 a9019d12161699b148a803ab095c0273ac855d33
- SHA512 c69681e2bdb5384b8e824ac4c947c826c924a127ab2e1fc9d3098f14893c8d3c34790f6703d6244d67905fdafc27a719553efe4e317f67b0c492644aaf44ec4f
- SSDEEP 384:mDWJBkWS2ekwaaRGm7+bNItWIbdInm8J55M/L0GftpBj0IOFtAHRN7ClumkLR:DI/sIddInmU3iy0lmkR
- TLSH T102F22C8193FC8505F4F36F706AB496A21E3BBD91BD38C61E2185D56D09B2B90CA70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:26:cf:de:54:42:bd:b3:08:27:64:97:65:0c:b9:c4:4c:ca:c1:1b:b9:a8:59:5a:30:50:b4:30:7c:a0:6d:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
7e:28:f6:48:5e:33:a2:ff:4d:ca:6a:43:87:0f:b4:14:d5:57:31:d1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/AxImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9d5a7bb49a0133d3658a45ff08f5adfc6740e4085f9ff1d482a239a0c2d997ae
- MD5 e1d5d953e848d0a0808e31d11add3dd5
- SHA1 e29c00a39d3326fc0256c26a42af36161bfc922b
- SHA512 ec75c9a16668ec0d06e3b9189e939e9bc9f6878f701b785bebcdc95e93871ac6a2cfa49dde00d9079c945677cc2650bbd79c5a5c8b144589d6c71f54d0213d0e
- SSDEEP 768:4/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrn3itSc/Bk+:4/uG/5O7QBkcpoVTrEdg73YS6Bk+
- TLSH T10453D614A7E81212FAFB4B74ADF5C047597ABA53AE26D75C248D434D0E337808663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:5f:2c:29:66:5e:7e:87:90:03:83:81:24:e1:99:b7:6e:0f:30:60:a0:c2:0b:1c:dd:ac:1b:b5:fe:c1:fc:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:db:70:79:76:d0:4a:15:05:b2:fa:8f:3b:29:58:12:a7:8c:7d:bd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
AxImp.pdb
mscoree
_CorExeMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/CorFlags.exe
- IMPHASH fb1db825db945cf1996cb2b13e56c7f9
- SHA256 36b16cb0cffec65f99eb1a442dcba8696946c0a8fd10f9cb5f98629663f0da66
- MD5 3f10de142d081aff5efbde5be98999c3
- SHA1 d5232ff17d255d84df18516dfe2a53f01ec00618
- SHA512 d05d69bf3176f210429198fc7c988d467a077071adeee3fc512cf4c6f36a8cbeaf2ca3c935d6bc05c272a9e43e4d4126b2416237dd53224fbe648ee10de59671
- SSDEEP 1536:4AJelZaeQ+Ph5gS2/dvzeeyv8+WN18HWcq2bFX+IKCQTaudzrNr:4AJelZaePhESKcq2bZ+nxTagNr
- TLSH T14B04285337E1C072E8A20975D5F4D7F2697FF8614B3454C7A2886A1F6E213C2AA347E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c3:f2:08:90:37:a3:df:da:8f:33:d5:65:a7:15:d7:45:ed:75:48:ea:f9:a1:02:1e:84:23:41:a6:0a:1c:97:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
73:22:80:4c:b6:8e:7d:a2:d3:ce:b1:9d:6b:60:1a:70:ae:c9:12:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
70511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CorFlags.pdb
kernel32
GetConsoleMode
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
SetStdHandle
GetProcAddress
GetModuleHandleW
GetVersion
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleFileNameW
MultiByteToWideChar
GetLastError
RaiseException
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
IsValidCodePage
GetOEMCP
LCMapStringEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
GetConsoleCP
WriteConsoleW
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=172, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/FUSLOGVW.exe
- IMPHASH ed217f59b96438ffdaf4447d2e2f667a
- SHA256 c3e1f381588e6614d4ad1810710b8bd855dc03ce7d0f87d58007da9eed3c3ade
- MD5 51c6739dcb693b84cbcd66478a384e25
- SHA1 fa069f7183d39857d38a06f3331793a9cf2d08c5
- SHA512 85ad0b05aa8a724879bc0f247c09dd12e08110492caf0ae9c385fe1db6ed81bdeae2db5dcd827b06584d720687568d8c9b8ad47228f19c611f5ca625d83c6fba
- SSDEEP 3072:om5lkC3+WeDLO3Luj5lqQHPubRFMesSDdhBv:okkyIL5jHq1RFsyBv
- TLSH T1A11439237AE1C072E8A20975D5E8D7F2357EF8325B2454C3A3916F1F6C613D26A386D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:7d:c7:33:db:cc:91:6d:53:e9:01:ee:a2:95:5d:95:82:60:df:ab:03:f8:22:60:60:7c:c7:c4:49:06:50:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:11:10:34:43:cb:29:75:a7:35:d3:98:c0:ff:84:f2:ed:d1:11:44
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
85620
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
GetVersion
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
RtlUnwind
LoadLibraryW
LCMapStringEx
HeapSetInformation
HeapSize
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedDecrement
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
GetStringTypeW
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=201, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/SDKs/MSBuildTaskHost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b8ed1f99bdfd678d7f57ec11260cbf1c9ca9bdc1acd726fc78b8edb9bbf8b39
- MD5 6e745b8dd6d9353d8ff33d4db9074b6d
- SHA1 f9c384ebea0c56596c21cd5a5e00b483c6ef1fa1
- SHA512 fb02c7ebfc674c6eb0224d1c9ccf0806669d500ebd50c91bff0899700ca346a747a4e31bb4a4563327f7c66dfbff54bf669123333a86b32e8494a8a3b6ce1197
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0B52rUIEd7yjoVy2:s+vFZNOgbiWmNLzpRK2
- TLSH T1E5F35A0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d4:ec:45:a2:7b:ef:01:8f:1f:92:e7:e8:f1:fe:54:45:ee:ba:ca:7b:92:0b:a7:9c:22:bc:3b:d9:82:f7:fd:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
64:9a:87:0d:99:97:26:25:20:fe:b0:5a:0f:e0:48:a7:a4:f5:fa:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
161422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\x86\MSBuildTaskHost.pdb
mscoree
_CorExeMain
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/MSBuildTaskHost.exe.config
- SHA256 3a3a6b3f6e446a01e310ce8662651bb1d9be470f48e98f991687c167c090d2aa
- MD5 f67d8a80685990be9d210f6b42573e93
- SHA1 d7431915b27e28abca10a7c0ef7ee64ac3b0f0df
- SHA512 ce8172f1bcb6508513f27b3e8c883e94bf731457f6b4fceb72bce4048b7547866ef1b565a816b1162d610ce135e8c6ad2fecab10e4c10515dd2cb5deb8674e9d
- TLSH T1A611CC94E1E8BBB68E4109E77A6514246FED03E3AA8D410DB09E7D868F159C7430B2B1
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/PEVerify.exe
- IMPHASH cf2381f1ac623f10a51e0b293248761f
- SHA256 4179f460a7595f6d8c174fec75249f9b68288eec009fa5556a70a2f920b82c45
- MD5 e149a9e4d6f03e1f20180d9a04408dd7
- SHA1 ed743bf3d05eaf0f3caa06094dc5bc938e71506d
- SHA512 2a0b5288e92015300d61d57ad83e029132287e6f5583578ee20674d568efeca740fed1f067c4c89ee8ae86a7e4a7c34688e86878b2fedd3743aceb3137f6af44
- SSDEEP 3072:vYyJ2eYoEIzFF48LpbjOG6aSD15TRHjibAVNJmtFi:AA9ZOG6bJobqJWFi
- TLSH T102243B2377D1C072E8920475D2E8CBB2257EF9729B6454C3A3806F5F6C653C26A38BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:ec:83:c4:fb:10:13:77:74:06:43:df:c2:15:39:f7:6d:60:7f:45:32:8a:f9:9d:23:86:aa:51:e8:09:0e:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
47:f7:f4:51:34:16:a9:ec:4a:49:9c:86:34:ef:a7:57:37:77:c9:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
81344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
GetModuleHandleW
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
IsValidCodePage
GetOEMCP
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=47, id=207, version=50323,
count=17, id=205, version=50323,
count=129, id=206, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=181, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/PEVerify.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/ResGen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0fdefe2f4e84a6899d668bb57e6a815211847a63961b9814d31eb019dc5fd772
- MD5 6246a38965d8f5f21ef48f6335eff60f
- SHA1 93402944985a534194c88ff21e1683bfd52d5ed0
- SHA512 d0f62783ee7a50e4e6877df05f22f33515de20dbb1e4433bae3716824e6f6ca8c5974fd67ab569ebaf8721728fc2d6204dd43d59d9cece9c94958f0016254f3c
- SSDEEP 1536:DGcZg4cHAqgLsVmXitf8TLCnZc/xW7FocH2fQfiHs75HdjJCY8cJCjGL:DGSg4sFg4VmXitf8TLCZyIocH2fQfSCj
- TLSH T1A993191493F84212E6F74B717EF490435D36BA539E22C79D7C89634D1F627808AA2B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
20:cd:af:26:3a:2a:c7:e7:db:02:b1:42:75:d3:b7:98:73:a0:60:0f:91:6e:0e:ae:1d:90:9e:3c:95:c0:01:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3c:09:2a:c7:8f:af:2a:d2:ef:03:36:40:af:0e:50:68:14:ed:0c:4c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
81902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ResGen.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SecAnnotate.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 558c66f7c5584a92e7b414d037dfc04d60d8d06423ee846802a2dba825eb189b
- MD5 4f6b31d613b55cde700fb5cd3e485177
- SHA1 c78b8a02b3ff5c812c57b3a1939fe2c3897fffb8
- SHA512 e6184ee61830d6318ba7137b26e1272f9cbf597ad1d18392bff9a47d39904f110e1bf31548444971d370f4ffd792d5b0e8e1335376162d3b0a083f026c1a2297
- SSDEEP 24576:F836z8thQhhm0hK+H1GgJeVinsjh3MggZuGQu7xU7:Xm0hK+H1GgJeVinsjh3MggZuGnVi
- TLSH T116456C0AE7D88377D55F4B37A03104453FF2D44B6B43EB4A7A98AAB56C03BA09D92173
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a4:e5:35:9c:0c:12:23:7b:9f:e2:21:b0:e4:85:82:ff:7e:fe:04:ae:e0:51:23:4a:44:0b:7d:b3:c7:ec:e4:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d1:18:4b:65:bf:29:8f:30:c9:53:2d:6d:52:c7:65:0a:fe:98:da:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
1253438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SecAnnotate.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SqlMetal.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0ba2dbe554d85a843468f964ce932a9247d3652e804e687fc002110234b1558c
- MD5 69384c8a0d4597b4cfbe2a049bf5020f
- SHA1 99423e8fac1f706df77b19629d178a33a8826b2e
- SHA512 bf61e1b283a29542bb8975f4b5464f4261075b51465fa663218a198766f55d69880f310e40b7e9a0d157c6a8cbd1e3652006702ba52c8c33ebc852db9b99a90d
- SSDEEP 3072:MH8OfRNxUMYiX7CYxYawPw64WpVNljLEMLKq7+iip6upr0KLodUBosc1DieMcDJD:MdUhiX7CYxvwPw64WpTl5ur0fWe4pgF
- TLSH T19054193567FC0218F6FF6A3455B951098AF3FA139536E66C145C51AE0F63B808AB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:68:a2:45:3c:fb:fe:46:10:f1:27:55:19:8f:ef:76:2e:7a:15:d1:70:4d:15:07:e6:e2:ee:c2:45:74:61:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3a:e6:b4:8a:be:90:12:18:02:cc:54:03:2a:dc:31:8e:d6:ed:8f:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
287998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SqlMetal.pdb
mscoree
_CorExeMain
Name
.text
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SqlMetal.exe.config
- SHA256 0c25b05ec690e10f9d10a1974cb9d25537e7da9ce5012ab1f9f354011e68cb12
- MD5 8a97dd02f54478fc19cedcadec12bd98
- SHA1 bba9917f4b3867b2bd863f22deefc7ad3a93e6e0
- SHA512 123b8ac7d6ff2c018aecc20bff1c4fb5ab95dcd29a88090d9457cfa99093d980e88d12c9fe5f83a30c815c59eb63d5cb2922e97f6b8f35afe5ad73a82d8cc38e
- TLSH T10FC02B818C44FC734B01071387B181686FF5F3C280584014EC6FACF6090114803833B0
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/StoreAdm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad17cd90a078c4b37085e0f065f7af1426667d73408d9acfb74d81e232f4711d
- MD5 bce790978c48589199f2f1c4d153eaab
- SHA1 862fbe3a0abc4b8f81ec8192277714c832420529
- SHA512 2790e3052cbcbd743d08e39af281b0900fd2e4306adaa431554799633a7051a03b31aa3b374e4e015c85153ba9f1bb0e571b92ccefe33c8ab40e1a9d80dff5cc
- SSDEEP 768:NDNlLjCRr4pkoceXe6Iq8bgQXRPiIFzzp:NBtLcedCgiPnzzp
- TLSH T12713B624D7F80213F2F74BB099F5D087A876BA53AE34D65D28DA534D09227C08A52B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:7b:62:7c:0c:8b:98:7b:d2:8d:d1:62:cb:eb:14:33:bb:f6:54:50:dd:60:81:e1:fb:13:fc:77:66:b9:b1:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
81:da:1a:9a:5a:ff:8f:db:6a:53:d9:ba:4f:37:b5:83:2b:8d:bc:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
32126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
storeadm.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SvcConfigEditor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19dbd5d07c117ebfc9c39dd64cceff3499314280f1df611e380f835d80486c04
- MD5 1552f3e5390a30bce06a70069a09b6b7
- SHA1 0970aa17d307c5e5b8e14545f17876956abab840
- SHA512 62fdb9a957631fda1e058e14b64bd65bac050b250f9a5c2cae9e4659c7938df4bcd5558c03af8dc66c5978276b2351dbfd11343be07d5ffc45844202209c9c09
- SSDEEP 24576:ioQ+mP31vZo106r09Ni4SaqKj9yqBR++m0izcmhCDUv5CT9Z9GTtK:Ser09R++m0izcmhCDUvMGxK
- TLSH T119B5C72037EA110CE9FB1B712D3A81D517B6BE6A7E04CB5D21A9124C8D73B538B22777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:2d:c6:8e:51:0c:1c:58:64:aa:82:84:1e:ea:38:b2:f8:85:0a:58:6e:a6:c0:4b:07:9a:2c:14:b4:75:62:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
19:87:54:4d:f4:f2:12:3c:b7:a0:03:ae:da:06:ad:06:41:26:90:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
2405086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcConfigEditor.pdb
mscoree
_CorExeMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SvcConfigEditor_4.0.chm
- SHA256 731d8a58fb9e20d8a74f9b563a1eebaaa3a1aad5c904b76f8421fb92eb261818
- MD5 301b0030c9e35ef5ecd8dff7d005e6ac
- SHA1 505527ad90d24f89649d5b738093630529a2402a
- SHA512 010da137194f9fed7344546709b63aeac981f9ca7a80a13fedc986f6d8436bc0d0a1abc74cbe3ad428d5aa37d18bf14ab8a88c96540a0cc2a62a676402634fa1
- SSDEEP 1536:A2NPu7MV1k8yjSzSJVWA3sh1bfiIvYSRDNCfYsB:jNtm5Nsh1WwsB
- TLSH T1CC43F17353AB663ED6946BFCAFC69C25BA115B04C94550EE853CB23430AAB4F22D1CF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/SDKs/SvcTraceViewer.chm
- SHA256 bd58ad22dabaaff41dd9a7317c9154fbb6bac0af79693fdf8b143488cb93b759
- MD5 b2ca8bd7fb01ab0be666b7274dd536d5
- SHA1 f56e0be005aa64d2f5611a71960577579f508540
- SHA512 a4f73b464ca24842fe43d50453ba38072019c8765b14c335aa5f68a9357fb5c7d8604a29bd4a1bb5c8a1143977603a95bcddf30ad3d6839deacc3856e0bf7ab9
- SSDEEP 1536:qJUgqfkk52CjyL6BdR6Q5WU5Pj+Nvzr+hQfB4:GUz52Ce0FD1jW+h6O
- TLSH T15C43F152DC13E4A1E1A929BDBCE3414B8A007208D34DDBA4D576F18E7025FCEB0F911B
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/SDKs/SvcTraceViewer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d0246bcef7da19aa8e3efdf59f83e512e77fb11b913e59e543f511ee5d71f7a
- MD5 d0a66c70d8d724895a4aa39b9ff52f23
- SHA1 881855e21e3c0e9247422f71748a4f7df31ee980
- SHA512 d9228e69e6484ccff07193f6e2ad7ca3321a7bc9cffbb9e1b0c4578b5a14a482c529c8b592a102efa02578735ef18fb2f8fba796934074b0c12ea83b23689d70
- SSDEEP 6144:ewvHeaP2EcsiQ6HxtuHH+xeqKr5lxDp3nuGuHCFxoQ2/TEFxiw3AeD4sdYH4oPd0:Ji6J7nuGF5XxiRsI4oPYDhHkje
- TLSH T1CCE4290033E84B2AF4FF4B75B47854D597F6BE979699C24E1D89B1CE1EB27808813263
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:7c:05:d9:69:03:77:41:3c:67:51:8b:53:c2:3e:68:63:63:6f:d6:4a:ec:a7:2f:b6:af:7f:89:ff:65:f6:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
05:b2:92:6f:1e:08:f1:08:20:96:74:22:49:cc:59:e8:9d:7f:86:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
678382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcTraceViewer.pdb
mscoree
_CorExeMain
Name
.text
Size
654KB
Virtual Size
654KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/SvcUtil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 acb7bf20e53fde4e171067a6de2581bd2df374e26b75349c42c14278e5595024
- MD5 9f2bf87473dc29e0ed74d026101d80dd
- SHA1 71bbc200110ef22e6b2c90e9bbc0f49f7a6b4088
- SHA512 c12cb4ad24403fbd7eddb44f5d447e31b19171db94a8ac6ec6c4b9cbdc642ba69b55294a0f60f6e8f52b16b3bacccfa93a459d63b1c344fa3d001db4f92730a9
- SSDEEP 3072:Q3O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerFwyegYm1/K0UJ:SBGxsI46nYNs0xcXxY7J
- TLSH T17E142A3937EC1726F9FB4BB4BCB9C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:3b:47:3e:2e:6b:cd:9d:09:54:e8:2e:a2:2a:5c:90:24:c7:f6:1d:7e:0e:d3:ca:31:60:3e:76:e2:fe:63:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
cc:37:f1:ee:1b:a3:37:8d:09:ef:e5:6e:1d:ae:92:32:c8:43:15:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
191246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
svcutil.pdb
mscoree
_CorExeMain
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/TlbExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 502282813e8087248708a0a5841381e6a2d75478e22453e076e21b7c62ec2989
- MD5 466371c28d4604976360c08240a6a05c
- SHA1 c276d350e5091e332561a0a4b7f1515620311eb9
- SHA512 20d4280243524c6ee14b6934f495deb02f6a4a3f1e7b09172675bd2cd8e46ad5984bae17a600efc64508ee2a04025a45c3c0800d7662fd1cec6f904ddacc8c98
- SSDEEP 1536:/k8soxMSqgD2LJ6lXi/KcTGBWEc6b2G2ouwR0J0F:/k8WSFD2LJ6lXvcTGBWEc6b2G/uwRc0F
- TLSH T1A553F714ABF84212F6F74B71ADF5C0479976F697AD25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:1e:96:1a:d8:14:2b:bf:24:44:1e:68:2a:bd:13:2a:98:86:b2:09:a0:bb:4c:5e:f9:8f:23:18:ff:ae:e3:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a0:d9:7b:b0:24:12:ff:44:ed:97:0b:84:31:7f:e4:6f:6f:c6:87:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
53726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbExp.pdb
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/TlbImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 044910a5c27e72ee21d7ce09962a8b30d4be77458e629451cc1fb73deccf6cd4
- MD5 7b60fb55c7df5f801f8ea31859f0923f
- SHA1 e51079cd87c7dbf2aeb5795a4ec10c4ca4b0eed5
- SHA512 0f37ffbab2e714460630e5de345d391b1804c129787077dddf52f0331c6a95e6b09354b7167a0f7b44daf589c51ab7cca81d1404a7967ead82410ace613d8ae1
- SSDEEP 3072:r4v7VpD9Zp5q4l0QSmIydxiC7ieldIVr61c87Cw5uGjsJx9BzdcOyK7f8y1EAxbO:r4v7V19L5qfytldIZ6CuDjj
- TLSH T1D1142A2567EC4A2AF6FA5774E8F5840687F2F55B3A1BD30C285816FA0A237C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:c6:41:d2:f9:97:a5:4a:85:bc:a2:59:91:b8:fa:2f:f5:46:78:e4:e8:1e:a2:0d:f4:fb:07:0f:24:c0:b2:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d5:0c:1b:59:c6:e3:7e:d0:51:84:54:d6:78:a8:eb:ff:ec:61:e5:ea
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
182494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbImp.pdb
mscoree
_CorExeMain
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/Tracker.exe
- IMPHASH edb7de4623ae335f2538be97ec2d53e8
- SHA256 84f8b8e2fa0a5fa5e9f3401851a7d2cbf7e8b3e903b9b563d1703b91eb917a6b
- MD5 2920b40a1463fdb24a682f10e32b3f5a
- SHA1 7fe2eb274c97a608e7fed9bd7e352a6076612a2f
- SHA512 9929c97d375eeb41e86e071b45fc9da46ebc3f7991eaf4e160b0d90a07b24bd05f240895808714693272d584875b0cb82b6ca53a0b9bbb061ce62a8d1ee7e4c7
- SSDEEP 1536:LfD75vVY3LmG8OfRAEB8lwPS8WvcREScYlVb95TDS+BxYIJLZGj2XBkx:LfD75O7mGvg1YflhvDBhJLZGsBa
- TLSH T11CC37D127AA1C032FCD2103496FC9E635A7DF9725B3890C3B794964E5DA0BC1AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4d:77:26:91:af:3a:ce:5d:95:72:50:79:69:fb:cb:6d:2b:fc:e7:45:2f:55:43:cb:de:a2:0f:92:73:e0:ec:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
14:1b:e6:71:75:cd:ae:f4:35:e1:72:ef:9d:ce:d4:3c:80:e4:b7:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
21275
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetVersion
GetModuleHandleW
GetProcAddress
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=13, id=205, version=50323,
count=119, id=206, version=50323,
count=119, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=1, id=207, version=40602,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/WCA.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2089cfba8e27c693adc7bff30fe174b7584832b0fd342b162dc6993e9eae282b
- MD5 c6846a484e08a5b12466a077db6c3e5d
- SHA1 fe50b5a8b5378478b65a8217841f2616d513c48d
- SHA512 395e58186ba9a5230c1b2c93fe83aa6dade8c0126d1ca58cb72b17ae905a9230c519692aa6920e7d70e403d0c9a7744bc4c09d38c3e52e636c4a60740b7dd4a6
- SSDEEP 768:0YLUUzqRtIzYAQ1gqiF9ZvCkEoONcit/E1isyc/:0YHmRtSYBgRbEo+cIE1Ny8
- TLSH T1D0333A5073EC8356D9BF4A302AF0A5864B7CBBC21911C56E2DC4B1AF0993FC19E51B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
42:8a:71:6d:3e:da:51:a8:17:b6:fb:c6:c3:6f:5c:5c:61:91:38:fc:be:5f:fc:ec:4f:bf:29:ee:5e:ae:fa:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c1:ef:c2:1f:a5:2b:80:7c:68:4a:f5:a2:ba:fa:1d:fe:e4:1f:13:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
42590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wca.pdb
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/WFC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 785c6b25fbbfb5d00eef40feec4fdf59f46a88cfc781aeb21d65812bbe3e527f
- MD5 7f04e827f35e2f6848abb1dcccea8c73
- SHA1 c87f3e90b488d4cad413e8e274f32255c0e7bd76
- SHA512 b394312136276da998f56a86329f81db2ed52bce7604a05bf2634d087283a665640eec2e044d00328edf57711ef7eb2362e698555621e8cb1987a3a8545eba3d
- SSDEEP 1536:JAILVy0+uumc78EarZaT/Iz12o1LMDukAF8lpBkv:3Vy0+uumEEZS/Iz126LMDuk68LBg
- TLSH T13643E821BBFC4156FABB49B029B18092A97EF7E36842D40F388D65485753BC09A3177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:fb:c4:8b:50:62:b5:6e:8f:41:b9:45:ff:24:42:b0:b0:0d:70:27:ca:24:17:fd:9d:b5:68:02:b3:a3:78:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
67:93:ca:e9:4b:ce:b6:42:db:e0:f3:81:80:3d:2a:38:58:80:2d:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
48206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wfc.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/WFC.exe.config
- SHA256 7a4d790b4bedfc8686b46449f40d85b3e369bf7fdbd0f70865b97bd956f1bc9d
- MD5 07e60daad155b9397fe3c0a0638365e5
- SHA1 3b0500f261b48c48c3407ced4befc9da008417dc
- SHA512 32c9238e644057343a71608be1e759910ea74c30e0db794037525c376cfaaa025a4afa4f2e065aac04f7fdee54f05581f1368424f70b80656009fb52fef99fdd
- TLSH T1BE8168302240FFAE1B0253156F70E1F2E29AD3BE5B584849F95CAB68CB1749F43136A6
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/WSatUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a376a95c516641164d9f9bd6bdc162d6c9cccb4e1cb9efae29079bd63201a90a
- MD5 c2789058405bdff29e7070738bddb0fb
- SHA1 f39b839aba53c61fbb1c12f379b239fb3d3b39cc
- SHA512 fb90b41398feeea2c4b5a550bfcb9dfb1c6eb17afe76d6a3ab995ef9a5e06371f670cb009a8d1b47746b6564b8f67cb6fa864151c43a9b7914e542f5553ab757
- SSDEEP 3072:Cm4uRNrlmBELV+VuZFquunlSiYV+n8nkTrcp3ScYRs6SXfCzE75Foc:VNrl+ELV+VkElQ7+u7Xf8Jc
- TLSH T17134F62033F91209FAFA4B3159B580C29B7BBE277E19CB5D5445124D4E72B82CB22B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:aa:f9:11:e2:4d:39:53:2a:fb:27:ca:ea:86:a3:e3:94:f7:f7:bf:dc:7a:fa:aa:b5:6b:c6:53:4b:6b:42:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
58:8e:33:8b:f9:91:4f:8e:86:4f:4d:d1:7c:6b:45:e3:5f:b0:0e:f2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
231342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WsatUI.pdb
mscoree
_CorDllMain
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/WinMDExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1b3e76e8934d690eb462d77d3fd20266e70c6ff9fd223202a7f58b04a4109c85
- MD5 72ec26d29e040b53d1bf329141f9bf57
- SHA1 15e5f21fc209d73a0fb13449f51430ec35bf956f
- SHA512 66af8071416246e1171b4aa3f3757cfbeb08e79af3ca56fbce02bc916ebd035190db09369beafbd1368511fedc2bf87bad8dd7dfa47087c9306ce7c92a73abc2
- SSDEEP 12288:Y3mUaWs/++jX9O1NKV1BTP7EVFFP8NHQsFnBLCqGiWSNAPY9WqphQpR:kW7w1NolPFVp3WS3WmsR
- TLSH T1DE556C07ABE8A777C68B0777A03205097FF1D04B7717EF057948A6BA1C1BB909DA2163
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:36:27:45:4a:79:37:a0:aa:34:78:82:c6:13:56:d3:f8:38:6b:f0:89:85:fd:68:4c:dc:58:d7:9b:f4:bc:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
5e:44:ee:2b:46:23:fc:ac:94:8a:0d:7c:9a:68:97:60:0f:f9:06:43
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
1355662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinMDExp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/WinRes.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79b0e33fc7d5771b3e1f4144b3aa9c6e69667dbd7467506f07355da2ceb2d860
- MD5 f941a325df85318c5c976d2df750d579
- SHA1 8ff7e49a6cf5e488159a8e4deb687d3ab2c9a673
- SHA512 ef88868769d1857a3a222c2f25f338167952196823ffce1c28fbe529dd6e87cf0ff6304e644b1c97481cf3cbb4b0c26a4acc93d384e572cb6c8137b248d4fcdb
- SSDEEP 3072:V3LDQXGAJHPxTeN4hWtrYyldospVa4B3WRUzctcNm9RnLevrRxD5w2:JQXGAZZ24otrYyldoiVdbGk9k2
- TLSH T1D3E36C2473F88652D1BF0B322AF19482CD76BA43DD36C75E189166DE1D7338086627BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e1:4d:36:9e:76:4b:14:2c:77:20:7c:03:5f:0a:ec:ce:04:58:86:0a:f5:30:b0:ad:de:a1:4a:3b:55:dd:aa:8c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
53:08:57:5e:bd:17:63:78:c2:db:c7:15:75:75:e7:0f:65:2e:cd:02
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
143342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinRes.pdb
mscoree
_CorExeMain
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/al.exe
- IMPHASH 35f7d7b0035d9d9c7dd3306a0690f78d
- SHA256 f6c6ca66956bc2a63136c769433cb4ca0a820351dc22515f791a098f0b3e4471
- MD5 9d381cc31bd46357f144acd242b8eb22
- SHA1 a2394f1737f4a16abdf527e4c00e91b0f147ed28
- SHA512 1037cd5aef45db81e24d86a0eb150f7e52d121ca09caab9ea74da89ca6d309f6fc9c219e6cc56ea8cfddf3a57f31f82fa6a4a356032a9f09431c6990d753641e
- SSDEEP 3072:gmzrEJqNKpw8oG4VO9ntat9uYpsYzFDL+wYZfP5q:1zoh8G4Kn8uYb9CU
- TLSH T183147B127681C072E9B345B016BCE3736D7E7D325A259A4FB3A8AD9D4A70380E735363
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c9:15:f8:55:89:f0:f4:ca:96:39:87:3f:39:25:09:c5:08:35:35:23:1d:6a:f4:91:3d:3c:3d:bc:ed:9e:96:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b9:d7:85:84:51:be:32:ab:c9:cf:c1:0b:1d:9c:98:d1:6a:88:43:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
15180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
InterlockedExchange
InterlockedCompareExchange
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
WriteFile
GetVersion
GetModuleHandleW
LoadLibraryExA
GetTempFileNameA
GetTempPathA
RaiseException
GetTempPathW
GetTempFileNameW
GetFullPathNameW
GetFullPathNameA
SetLastError
GetShortPathNameW
GetShortPathNameA
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
LCMapStringEx
WriteConsoleW
GetEnvironmentVariableA
LCMapStringA
CreateFileW
HeapDestroy
CreateFileA
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathIsRelativeW
PathCanonicalizeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=18, id=205, version=50323,
count=148, id=206, version=50323,
count=61, id=207, version=50323,
count=171, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/al.exe.config
- SHA256 140b18429bb347220d5dca9d46d4fc54c7b8271c6015a0f5fc439c7b89556506
- MD5 358bc4d63c6584639a5462675976af93
- SHA1 7767bd5a2bbd77ed64f70acefaa881e0338a41b2
- SHA512 e41ec7e5014c22acc20d1581f8807e09e4da458ba2cf8d6aba09864eab5a671a85f8ea3822f39d0e888b3449a825de04195b8be1d58c945f7c3c9ffb05c82bd7
- TLSH T1F4C08CA946B4FA2B0C072B4379900A02AFB001C2A0085004F1BF7F500B0548D8307317
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/aspnet_intern.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c16b0f36a32b40f255c9316fe9538ebc310d07398998de3d8187290f736f4dc9
- MD5 ddb0b409c437cb59e30d236a200a92f2
- SHA1 990bc9c2a3d7acc2ef5bd60c6750cc908c388d26
- SHA512 c7b666cdd4b17638db71efc4bc2aa6b90b599b93e29822fab892206206627febb54c288e9e127b66283f34af5c8708de1b4a5d265638eee87cc82982535ce799
- SSDEEP 768:WYHti7yDXWiAcoT1/lxfYx6iOgge8XckdH9U6Iq82UOVsQGDuiZrq2/u:W4oIX7AcoT1fffiO26ck9pNU3S2rX/u
- TLSH T1CA73E61497F85222F6FB8F70A9F480439D36BAD36D21EB5D189A534E08337C09662B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:aa:91:ed:74:59:29:00:f2:54:16:2f:45:77:20:c6:23:5d:5a:a6:e0:43:c4:5d:ff:d8:a9:74:6b:74:cc:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
1a:1e:f0:d8:46:82:cd:37:92:17:70:65:11:64:d3:55:01:4b:c6:86
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
63758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_intern.pdb
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/aspnet_merge.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 32d524fff75a202cf963da6cc509b7e46ce694f99a3470f58e33754ff7edef14
- MD5 23f2879d2524112653377f869da8cbb9
- SHA1 01c92d9277a1735f63e1ce3ed670a9a56dff64a5
- SHA512 f4ab6aaa623ccb4baca830db942e5606741a06c163b6c0846358179456b0501116b1c5dc5df621ad903cfa41194c9dc48776a60bda863fcab16203e679da1e07
- SSDEEP 6144:0nzj4nK4m+qSneJ4YleygNmqnodRu/GZLt+2AdBZyW4msGBQ2I3zlPRNs+q16xPC:0nzj4K/efMuuZLg2AHfI3BjORsVnvQ9L
- TLSH T1CD153B0077E8D217D2AF83B691F95509A7F8D006F313FF5A48285EE41C53742AE692BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:f8:b6:d2:94:66:79:b9:0e:af:97:42:8c:fa:4e:42:5f:7f:c4:11:e7:3d:a8:cd:bf:02:e9:db:27:d0:80:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
28:93:db:6f:ed:1d:e5:f5:b9:89:7c:76:8a:1d:47:4e:30:15:e5:25
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
928454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_merge.pdb
mscoree
_CorExeMain
Name
.text
Size
899KB
Virtual Size
898KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/aspnet_merge.exe.config
- SHA256 2ffb24c9c3f6feaf9fcda61c13f85ab1b36880c75f3f3d4e0048d633aa8b7121
- MD5 6778eda0faf4164aae0d3588d7ab73fc
- SHA1 1fc8d0ea98e6ade71b1cb5c8a08a3be5a6cda43a
- SHA512 f02d8148d73c98da35e0e6e079d3815b491b907a09ab92feec91fb3fabbfd40df43ab1cc1ed6dfb5d87f965087e48694663de331b50f4ad4afd441b7b3cbc49f
- TLSH T17FD05E5408F4F96B0E02166766A1865AAFF4B2D2A1589004B8AF6AB10F015894343376
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/clrver.exe
- IMPHASH 8b2123e573c22d47c97d402c43d0b828
- SHA256 3f6829d51e8530ee4b81ca1be060cf81944717ffa8cf52ea507f3f260288c914
- MD5 e169cf1292d139312be5d094261cd179
- SHA1 96cecf59a4a2b758e2a901fe6ece7c84c1fc55fd
- SHA512 3db41631e4b2715cf8fea91836ae5b0815f9a03528441ce8000a51606992bf3af8766d1653974828daabd1cf04d352da780bbc8e6bb3cca3c928976753c72de4
- SSDEEP 1536:73f9CV+/tnJWGC0WzxGMZ2suPutLkOz0lwR44+I/:73VCSpAdRCGL3z06P/
- TLSH T1D9833A12B6558031E8A1583943ECC6936A3D79728B794ADF6BD45DDE0FB03C0B6347A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:e7:aa:bc:a7:72:94:4f:85:f8:e6:53:c3:1f:19:ce:67:f8:6f:99:4b:ad:0d:6b:6d:b8:a6:f1:54:12:c5:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
02:c2:6b:a1:0d:44:de:7a:8e:44:8c:3e:a5:21:45:97:e3:61:bc:8a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
15077
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetVersion
GetModuleHandleW
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=10, id=205, version=50323,
count=95, id=206, version=50323,
count=84, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/disco.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1fd270bd647b7c9d55ebb3a3e2417136a2ff01120e9fec9976ecef76d1536bfd
- MD5 399c5ab3b0dd977a5dee5004ee030e4e
- SHA1 9cd3ce91461890a6b7862d5e5e3e55b42b664e9e
- SHA512 3600eb502687e8be616065d61b46f8d00b05831e1f81458807d0b776269be0ea17692a673f9139ee578b9bf20e7184df52b0810955b27b310ebab237ce01c2f4
- SSDEEP 768:7PJD0SLoVy6f/IELS5c7d1ZstJC6Iq8fhHxoCwiGp7pJ:7xzkVy6fScJgJBohHx9wNptJ
- TLSH T1DF63E71493E84212E9BB4BB0ABFBC3C387BEB5875D21D75D2895534C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
73:60:9c:21:94:a3:4b:2f:22:51:68:d7:27:01:e1:47:8d:05:9c:b7:54:74:de:bf:95:4c:60:93:e8:8f:fa:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
79:cc:6d:9e:41:4d:0c:4b:a7:93:3b:e0:71:c1:96:0b:29:9e:c1:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
48430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
disco.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/gacutil.exe
- IMPHASH 1d5d62a00aa56ac222a0558af3bce499
- SHA256 01841c1e9ea4ce1af3ca7b8e6c7b4244cdab178709dc9c295688ead6517e5d44
- MD5 aa1feead921075878fb4a8337f0a83fa
- SHA1 77d0db38a20716cfe2d634fc6851188c8a61c2cb
- SHA512 d57f62eb9cfd275913607c8e51e986d3e6527db7baefa919ac1e0fbd13e8da0d03e638044e917fb43cb127fbda445d84272d96440028d4fb73618f7bcb0d88c9
- SSDEEP 1536:ot+3UJxD3I8kNB4ZKSF158B+1qEWZBRxByquayaHMRBkj:ot+3qx1kstunZuayaHGBC
- TLSH T148C35B2279E1C472E8D205359AFCAA435A7EFB721B3454C7B398128D5DB0BC25E353A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:51:2e:51:da:30:19:a1:27:f0:a2:12:57:b8:3c:fa:67:d2:cb:df:63:f1:93:dc:7f:1e:fa:4d:20:94:bc:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f9:67:eb:3d:3e:50:0f:3e:23:d5:6b:c0:39:92:38:62:59:7c:d2:a3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
37561
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
GetVersion
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RaiseException
OutputDebugStringW
LoadLibraryW
RtlUnwind
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=42, id=207, version=50323,
count=13, id=205, version=50323,
count=97, id=206, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/gacutil.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/ildasm.exe
- IMPHASH b59f10d55307ec747fb67fa01d1ec22f
- SHA256 94edb927d1e4d7b4bb0c17d19f455ba0d4348bacca8c0fd38f9ba3b8cd40e46d
- MD5 48130efc4eeb45983655ccc822cf666a
- SHA1 4d264687a92eeebbc5ced79ef91158114365aedf
- SHA512 88a269dcb95d99e06773f183f705230e7e4f5353432919e204fb0a916f2b5e76d3f9fad7058094d2ef56853391d6f78c515c222b0d31b22a7c44cf249052900a
- SSDEEP 6144:zzN7KmpR6JjQMIsjZlFVMsp+/Y++zyFDSbZFq/mSSkmdI0ZtQmU56BE:zRKaR6iAFVMspC9N0NSSkyIxmO6C
- TLSH T142B48D33BAD0D075E8910176C598DF6978BAA971572A04C3738CAA9E5F303C1AF386D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
df:f1:6e:fe:37:74:ba:8e:bf:a0:4a:7c:25:51:0a:08:88:34:6c:04:d1:a6:7b:43:26:e9:91:c5:93:91:ff:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bd:e5:fc:eb:14:f6:65:e1:e9:b5:0f:9d:5b:70:c9:43:6e:f4:46:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
319535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ildasm.pdb
kernel32
WriteConsoleW
HeapReAlloc
SetEndOfFile
LoadLibraryExA
GetCommandLineW
GetVersion
CreateProcessW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
SetStdHandle
SwitchToThread
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
RtlUnwind
CreateFileW
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
InterlockedDecrement
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleMode
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
DeleteCriticalSection
ExpandEnvironmentStringsA
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
421KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
874KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=50, id=207, version=50323,
count=23, id=205, version=50323,
count=145, id=206, version=50323,
count=264, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=1, id=207, version=40602,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/ildasm.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/lc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4265e6a8c272b414eb9fa6f8e1ca1a43562c873e794a64519c2a68b863a3f9b3
- MD5 f27fe843c8753ce852fffc6e92934ded
- SHA1 ca9fe2ac13ab8a06e051e767e896bc742a5a28ab
- SHA512 f0a0d6f3cb7ce9a1946921b95b82ea9992aebb5c6f5e2ffc19fa2d3c9f31327e19ddf48f007c4c818d51b610cf1948aaf35854a7a7aa224b878ed1ae99e6f035
- SSDEEP 768:wnSMzuxFp27Nc8DO536Iq8Wg5YZiRHdyi+:WS+uxFp27NcQOMfgOZKdy9
- TLSH T13523D82897F81213E6F74BB0ADF5C487AD76F653AE35C75C2889834D09227C09652B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:ad:9d:bd:14:34:87:a4:5c:98:43:67:b4:03:9c:e6:b5:ec:ab:91:47:f1:b0:33:12:71:21:9e:b9:c5:ee:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
46:df:ae:57:18:e7:15:ce:e3:7e:bb:c3:af:5c:76:03:9b:a2:70:e7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
lc.pdb
mscoree
_CorExeMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/lc.exe.config
- SHA256 140b18429bb347220d5dca9d46d4fc54c7b8271c6015a0f5fc439c7b89556506
- MD5 358bc4d63c6584639a5462675976af93
- SHA1 7767bd5a2bbd77ed64f70acefaa881e0338a41b2
- SHA512 e41ec7e5014c22acc20d1581f8807e09e4da458ba2cf8d6aba09864eab5a671a85f8ea3822f39d0e888b3449a825de04195b8be1d58c945f7c3c9ffb05c82bd7
- TLSH T1F4C08CA946B4FA2B0C072B4379900A02AFB001C2A0085004F1BF7F500B0548D8307317
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/mage.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7bcca9c675e5d5fa19228b908f3782aa471b3dcadfad5e74e59f714e5987892f
- MD5 fb385070072163697b84bfce9048bc83
- SHA1 dd4450919f4b479481c0069bfb8a26564071aac9
- SHA512 5398c4bb46af8f42ccc81a381fa48f6b54def0074de607c637c8099ca6c963c0ecc2e182c520aafe1e716f639232413cd8f823582eb5f30a95771922ca34846f
- SSDEEP 1536:5PNEYvp+o4ncDe2zHB2l1YdhfZyA1YdhfZymCiL1fuMVPQRHQBugjh43Xosh3:5yYvp+o44eAHBCYdhByGYdhBydiL1fuJ
- TLSH T124933B416BDC4316E9FB0A746979E043AE75F25B1922D7093CCD91DC2FA3B9086623B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0e:82:2d:bb:fa:67:7f:10:8e:e6:1b:04:1f:f5:b1:af:9d:16:be:9c:a6:f1:32:bf:97:d1:b7:b9:c2:88:2f:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:87:b2:9d:25:ab:40:06:cd:10:da:52:97:31:3c:38:48:92:9f:12
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mage.pdb
mscoree
_CorExeMain
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/mageui.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dba6c3285b9da61c866409567d6a80b2bd50c9805697bfb1eda230f45288fce1
- MD5 adc82c51e6bf961d693c76c8bec7ef7e
- SHA1 989903893150acae7cec0dad9cc354df6dac8377
- SHA512 25d08647a4ad8ff6db89564bf778e2dc370f99135f01cafe22dc49043214d6f1850a735dbdfeaff814e4c2db4897cab63f62d1ac2fbc3d2febc8b1a598cc7538
- SSDEEP 6144:0KbZEDs1H2IDvhTp0rfcn6IkfQOfyAZK4hTp0rfcn6IkfQOfyAZKD3WkAfaPn0oq:0KbZEDs1H2ivhV0rfcnMhV0rfcn/yaAr
- TLSH T118E4843137AA5208D87A1B705C3692C953BB7E6BBF18CA5F2859320C9D3365787127E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:ef:ba:27:6b:e3:97:fe:0f:e4:52:c9:ff:e3:c4:69:73:61:77:86:2b:0c:ab:5d:5d:ba:dc:ee:cb:91:1e:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
97:5f:e2:d0:0d:fe:68:98:3b:02:3f:cf:12:84:40:44:e8:bf:21:9b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
701342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mageui.pdb
mscoree
_CorExeMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/mgmtclassgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e7c7ad12ac7bcbbe9a0416b3ab85b7b6dd6c8e623f1f72ad3ab876abf774ce39
- MD5 57430d13dc79af2a5e0c814eded25953
- SHA1 19eb454582ea78b3fd02fbdfd98880b84e790f1b
- SHA512 3ea4a1de6f4c22800a9fac16f9c51ee04cc6b75cab112cafecb1989f8cff4c0af4fe993db3d1a7919b54b5251e884eb4845be9982ab9770606395cee5834e7c2
- SSDEEP 768:ipJl9YLfWjlpO0lccT6Iq8oYh2ib0UGqeJ:mJbCUHlcc6la2NUGqeJ
- TLSH T16623D824D3F85313F6B78BB099F4D0836D76BA53AD60DB7D248A538D09127809B52B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
13:a1:52:fc:39:f8:c2:27:68:a5:7b:b9:64:fc:db:ad:59:a5:c4:34:ef:63:ca:3c:e2:17:01:9a:a2:20:eb:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2a:22:d0:bb:03:8c:04:69:d6:41:9b:46:53:26:a0:33:6f:da:b3:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
MgmtClassGen.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/sgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e180af8f6c824647199cec379347f9cdbf769595c571fbaf325d365bee73a2d
- MD5 e4797f6000ffc97067011845d580bfb0
- SHA1 6302fd7bd2d5a41b47293e4560e5adbe5450819f
- SHA512 ee34f20b13d25b2c058fd3d3f0309eff03a580e887ecb4b2ec88b01378a2b23e44f9c8cb1fd51e291b8cfd391e1fddf95202b5d7080cee9489cadf0dcddbae60
- SSDEEP 768:FbRwSIUjOjyET3c8oQyqC56Iq8CUX5oxdijflQwc:NRwMO33cdQRCQFUXEd+Qwc
- TLSH T17D63C61493E81212EDB64AB09FFBC3C39BBEB6835D15D79D345903490D2A7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:67:44:05:e7:83:c6:53:e6:bf:b6:14:96:2c:7c:4c:f7:5f:17:9c:a0:dc:57:68:74:75:4a:3c:5a:84:70:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
dc:ff:3a:a6:4d:19:cc:8d:25:f3:ab:0c:6a:4a:8c:cd:e8:bd:f7:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
46302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sgen.pdb
mscoree
_CorExeMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/sn.exe
- IMPHASH 6fd1c67b79af1ea44f7e5d30b1500226
- SHA256 9e74b92f2ed1625772156c0b9a65f59c9d001c1a3ba26e7a064e7dd77ec6813a
- MD5 b849aa942c2c19dfb2009d6d9ee4a694
- SHA1 d6d57344cdbc5677ca3b6e05227b563c70d09733
- SHA512 c1aac1d4ab70648776de1501fed068333810f2c60e66c753cc5cf22370508dd267b3e91d85b4f143f8a9b278088b99f8b0cffd5db366c8784d5bc6323d8b1421
- SSDEEP 3072:P/SWuNmOqFea8F1g+oG1IZga1084irw6pUJVqaDpYRalv8ECONXy2LFXPOfkS:PSNne8F1g+oG1IZgaZOpOOI2JikS
- TLSH T1D5246C237AD1C031D862053985F8C7F2397AF822AF2545C7B3952F5F2E352D26638AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:a6:df:7d:77:a6:e9:6e:a7:72:8f:f0:de:83:16:24:74:f8:bc:99:05:1d:46:24:c8:96:6b:d9:e4:e3:45:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
29:e3:a5:26:f3:99:ac:c3:85:47:ac:3e:d1:d3:76:70:d9:8e:6a:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
104842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
GetVersion
GetModuleHandleW
HeapReAlloc
SetFilePointerEx
RtlUnwind
MultiByteToWideChar
CloseHandle
FlushFileBuffers
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GlobalUnlock
GetStdHandle
GetOEMCP
IsValidCodePage
GetTickCount64
QueryPerformanceCounter
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
InterlockedDecrement
InterlockedIncrement
FlsFree
FlsSetValue
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
LoadLibraryW
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
WriteConsoleW
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=111, id=206, version=50323,
count=217, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/sn.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/wsdl.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80145d05468bb9a81560241758c812940553927c945b4bbb384d2f942424e36a
- MD5 52efb69ba051c03a12ac24034ec48291
- SHA1 8dfead7e8d9b87d343774560bd73ecc5ccefe92f
- SHA512 f532e5667e91ccb50b77d46b53ebf3f86c3e7a1a4efd5866c7ae75ef5d8b1514199cb6a7184dd6b49472c417c01b3ff2e030eeac8aafeb256af7d341e612a1fd
- SSDEEP 3072:YYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZw6OgqJIE:2T8rLo9YJ/bhuK3fSRbfMA97cZbC6xg6
- TLSH T1C0A3F71573E80612F9FB0BB06BF692C287FEB5466911D78D2C94128D0C7ABC1AB53727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:0f:15:2e:c4:06:38:9e:17:18:14:ff:5e:3c:f5:cb:8f:d1:ad:08:19:b2:8f:bf:f3:1f:73:d9:9b:bf:bd:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
84:14:df:73:02:51:ff:1f:73:3b:07:46:bb:01:04:27:5c:84:61:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
82302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsdl.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/wsdl.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/1033/IlDasmrc.dll
- SHA256 f21839bc8431056c6f215db3689181d92bf5b290ce26a6493fe538878fda7a9f
- MD5 840fc4b1cf2a5fa0ceb496a00844caae
- SHA1 59408c85e007ff54d5a5f3cca1a1c16904744f62
- SHA512 0c3627955d229566025ae577667514919c40d996ff10262247581b8256eabdb5476f0aae9282addd6c29fb9c25098f06ed7254e32870f16f5624b059363353e0
- SSDEEP 384:mb3nqW3BHW1ubNYAL1PWbYe3jKESkYqgzPk/57h0GftpBjOzFtAHRN7wslumkLUi:mb3NcubhYKESkkikEImkJ
- TLSH T1CF53B983D3EA84C0D4A199B0AD3B94A59E373D50683282DA4E64FF3F5E7BB509552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
ad:32:17:62:f8:40:7a:b0:b4:0e:43:15:e9:11:dd:6f:43:1b:91:7e:c7:a2:e7:24:c8:3c:eb:04:18:0c:90:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
56:be:bb:c1:74:c1:35:34:0f:08:ed:67:8c:fd:1a:e3:e7:96:35:b6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/1033/TrackerUI.dll
- SHA256 e65bcd147059c12c94f2600f6d730e70229560b91aa24578e67788d93d003c6a
- MD5 2335713f3d19c960b94fb69c65ad25af
- SHA1 eb909377b3c5232ea97b16ff63ffd87a43aa8fce
- SHA512 6f222462b87297f17164add8e01443e386434663071eb8b199816cd6aca82a1e6031ae2a5304c67edaa2524aa3ef0943c25e147571a5be5da0847a3632dbb35d
- SSDEEP 384:wXWD8WQTK78xJ8xClRAtkQGb/L0GftpBjN74FtAHRN7qplGBSjZlH:JjRGkijvqiBkH
- TLSH T176B2A64147F84142F8F36DB12AF8C9536D3BBBD65930D21D109DD29A1BE3BD09A24B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:3f:c4:a3:7d:6d:90:dc:ad:0c:ad:db:1a:79:a6:13:89:e5:c6:1b:d2:49:76:29:e8:4c:b5:0b:fb:3a:55:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:80:0b:75:85:22:0c:f0:af:52:5e:ae:4a:fb:0c:76:2d:88:4c:ab
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/1033/flogvwrc.dll
- SHA256 c804e695bd2791992f502c3114ea0c89bd4e7e106a26fffdea408f6d556c83e1
- MD5 740459c9f7e1029ba0b5debdfe79e13d
- SHA1 26b714aa485d1707d9c9f3b21b3d5e15fc505ea5
- SHA512 1855703daa1967e07e269e31cc4e2c7ee9369e1d389300fa850eee5ac0161fd6d2e14acb338f08bd2e8b46c09b1318ae89b578b8aa48fc4b241ff2ff3763a0d8
- SSDEEP 384:KWzcqW8RQxnq2ELDF5RKfPMnC0GftpBjNLFtAHRN71zlGBSjZl/:cIcfyiAuBk/
- TLSH T121A21781CBBC8447E8A36DB067B8DA837D3DFBD25D20911E1655F19D2CA27D0EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:b6:80:60:74:85:47:a3:8b:00:49:6c:1e:af:82:55:22:e5:ea:27:83:a2:5f:8b:2f:48:5b:af:d7:37:32:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:b7:5f:0f:4f:60:61:be:e5:ff:2b:d9:0f:fb:5b:18:cd:81:bb:53
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/1033/gacutlrc.dll
- SHA256 d0c9faf8ca3086be7bda156f833439b86338763e8ef9bef237b85cbf6bc42c7a
- MD5 fd0e244299b906f943838fc7ca1ff710
- SHA1 b61b97d58c0b327c5777d22e796d99dbd2360548
- SHA512 dd097586017bca60dd1998745bac83f1a664203c571b69b2e9713af8b7079d63ed54648a50222cec6966f119f2108aabb7bd6728415d4e3a8f3de46ad6c0e314
- SSDEEP 384:ao1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWI/L0GftpBjn0TFtAHRN7B:aAIecY0QrQNCeKei9pr/Bkch
- TLSH T121F20C8257EC0105F5F73E307AB5A5A21E7ABD82AD39D21D2198916D0AE3B80CD30B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:dc:b9:4c:cf:00:4e:81:0d:0c:2b:c4:29:a5:1d:9f:52:c8:09:95:f4:50:1a:5a:a8:8e:5e:e1:b2:99:18:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:d7:dd:19:eb:4a:12:ea:25:1d:e7:48:f5:12:5c:22:5d:5f:a4:2b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/1033/pevrfyrc.dll
- SHA256 211c5a12176338f7cb507ff427eb57396c6c5439d4bd3e01958f61c130bc2725
- MD5 be48a25b015a104103e45ea7ff0ad9d7
- SHA1 56271c4126dd400cb0cd1c5c341f16e5606dad66
- SHA512 bd9350c5f2a8f22a45eef63d63f315cce34181af4888a8f6ba9eb0477d2e0512ad70c6a5995a1ebb6834e643b64ca5df646433c3390e07c804714f064b3d054d
- SSDEEP 384:guyneWNJXWyh8YMnC0GftpBjEG+FtAHRN7R2lumkLTF:guyL9h8vi6SRhmkTF
- TLSH T153B2D6819BF84142F8F32E7066B9D9463D3FBFC55930D21D0198E16D2EA37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
af:a5:2c:6a:32:22:52:4a:9a:5c:43:c3:91:22:d6:b2:6d:48:b3:cc:0a:42:a4:0f:6d:00:88:85:91:74:3c:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
fb:62:b9:47:46:5b:ea:35:8e:bd:91:df:c4:0d:35:00:68:7b:35:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/1033/snrc.dll
- SHA256 a4fe8f62b2cbe33a375be673db70359a20d90327af0d75f4e2c3aae58f3e827a
- MD5 3845b003456449eb0a5bf2dbf37f1770
- SHA1 562bac7d9ef1a35641a1f482be2f6d083f46dad3
- SHA512 1a07f3031887930b1a20b5898cd0d9ab4339c547f24519d461e21f3d55d0563089f4455460feb5230d2af585baaefaa767c04cbdde9c4e4d79afbf4ba1c4159e
- SSDEEP 384:54DWJBkW72ekwaaRGm7+bNItWIbdInm8J58MnC0GftpBjEAHFtAHRN7FlumkLa8:LV/sIddInmUji0Wmkt
- TLSH T1D0F22B8193FC4505F4F36F706AB496A21E3BBD91BD38C61E2248D56D09B2F90CA70B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:83:85:4e:dd:4b:53:b8:f1:b8:a9:69:9b:c6:a7:d3:a6:3b:a9:d7:17:91:db:b7:8e:03:a0:46:35:e9:2f:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
24:d0:74:85:24:1f:02:34:12:75:7f:93:2d:f9:ce:37:ab:ae:1d:5f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/AxImp.exe
- SHA256 bbd3ea037031f6984c6986af3601ce5f9320f7185ff7c2690e0223b68e88c746
- MD5 ee74e6e742c3c4fdd7ec1f746a42c4c7
- SHA1 048ec50664e7bc05bbd598843a3cef5b45018262
- SHA512 3e88202630b3cdbd4c71db7ba90da2e0049d78e2532e5472a3ad3e2757de67e7c5e03da47ff6f9126350f65c0f4ab79cc9156a5f3db74bd748343836729a0691
- SSDEEP 768:Ngs/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrj4iRdQpjimki:Ngs/uG/5O7QBkcpoVTrEdgn4oQpjimki
- TLSH T15D53C514A7F81216FAFB4B74ADF5C047593ABA53AE26C65C248D434D0E337809663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:1e:72:a8:9e:05:bd:73:bc:ac:8c:e0:c3:20:9b:11:c4:5d:17:53:15:1d:50:7a:51:4c:49:ab:71:81:6c:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ea:5b:ba:e3:5a:41:bc:cd:4e:e9:9c:cf:4c:58:d1:e1:90:0d:27:5c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AxImp.pdb
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/CorFlags.exe
- IMPHASH 737eed44e0e3e2f740cf6c506763184a
- SHA256 71d08b20122df9419bbc21b86e754e5e53c8bdd1cd1ba2c562450a54e936cee6
- MD5 bdf5b8b320a7273a0d04b7eeabcf49f0
- SHA1 b77f839b382173f65802e66728e9621c2dd66ed8
- SHA512 c6861bfb45d4ba0f07b8d75b9290d688d5e5438e4a37c56fcdcf70425b8714c1a1efcd7d4da78e3465f2189d9eae0bd2b71342261f2f6b539586e65d9e29e6aa
- SSDEEP 3072:VoiaiIGBdEEImASTwxm+/jjsHf3JF4z17YGPPclzi/zKOfiHRQ/A8uLMkw:VrrRBdELmjTg9rkfH017YyPoVYagkw
- TLSH T153143B4373A490F6E0668538C8D0C7A6A776B8250B3186CF52546B6FBE737D09E387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
83:2f:7a:c5:c1:d5:a5:06:75:3f:7e:1d:1a:90:bd:31:46:bc:bc:95:a5:f1:52:97:27:6c:89:8d:54:31:ef:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2b:9c:cf:68:d2:c0:37:40:78:1b:fe:c1:13:d2:53:c7:c4:c6:14:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
35664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
CorFlags.pdb
kernel32
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
SetFilePointerEx
SetStdHandle
WriteConsoleW
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetProcAddress
RaiseException
DebugBreak
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetOEMCP
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegQueryValueExW
RegOpenKeyExW
EventWrite
RegCloseKey
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=173, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/FUSLOGVW.exe
- IMPHASH e6d4b494c7c8b97faa526620511ba540
- SHA256 e4fd3e973e7228419929e5ab2908bb8f2ba7b618a1c7dbf6e9a1c5bc94e60f6a
- MD5 30ba20235c77f2c02f70011c34fb0c2d
- SHA1 49dfcf90c80b0283a81b7d0aa78adc244c136c0d
- SHA512 c2d4aa4205f6dc46dd889fd3c18e67ab3c0ce25b53f688528bb39034a38e48386ba432c0c5dee7a87b681f622cfd11661c833e25e9ac2617341cd24633ed6052
- SSDEEP 3072:yzJYFWJCAGLPggaRtQDIpkkuwT81+CNCktKIaLQqG3lADFHNwy9U945OkDa41OIB:rLog0+DIpkkfT8tQ+aLQpVAtMIO4ykj
- TLSH T18D245A43739480E6E0665638C9D1C7A6F376B8210F308BCF52645BBEAE236D19D387E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:1f:d8:35:fb:7c:5b:32:68:de:ce:fe:82:ca:19:a7:3d:be:37:d9:94:de:7d:cc:3d:1a:1f:c0:64:7f:0d:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6d:ad:a1:a0:4c:84:7d:db:79:71:da:d4:a9:62:7c:83:87:cf:46:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
57124
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapSetInformation
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
HeapSize
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=202, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/SDKs/x64/MSBuildTaskHost.exe
- SHA256 f564a371a9a800df01446911c144ed527ee59b3556f8d559b1384e210ddcdc26
- MD5 59b2329778331d09b5a08f2964e4bd9e
- SHA1 a89521b9b9eb2b6fa9018c1ef38301ffc073c898
- SHA512 dc2cb734e3a50470ccb700fcc2f577e06a46ce34e13e407307d4a97978d6e54340c38f9e948c5c989054b78d9400bd102feaa1f3e56b8f1e56671a76ba3cea27
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0BK2rUIEd7yjdVj79S:s+vFZNOgbiWmNLzpRRS
- TLSH T122F35B0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:4f:21:3b:a2:19:12:17:8f:0a:c6:1b:ec:35:ed:57:a0:da:51:fc:48:b7:d4:08:0f:a7:f5:a6:e2:77:30:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f1:35:c7:51:82:99:89:73:56:a3:8e:05:81:8e:7b:d8:de:69:fa:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\amd64\MSBuildTaskHost.pdb
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/MSBuildTaskHost.exe.config
- SHA256 3a3a6b3f6e446a01e310ce8662651bb1d9be470f48e98f991687c167c090d2aa
- MD5 f67d8a80685990be9d210f6b42573e93
- SHA1 d7431915b27e28abca10a7c0ef7ee64ac3b0f0df
- SHA512 ce8172f1bcb6508513f27b3e8c883e94bf731457f6b4fceb72bce4048b7547866ef1b565a816b1162d610ce135e8c6ad2fecab10e4c10515dd2cb5deb8674e9d
- TLSH T1A611CC94E1E8BBB68E4109E77A6514246FED03E3AA8D410DB09E7D868F159C7430B2B1
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/PEVerify.exe
- IMPHASH 8c709d5483b1595d7a170659e58b93aa
- SHA256 3bfc496f6836e8262ed508bc05cbf7ca86f0246b0317b6e0b17bbc7507aa0ad7
- MD5 53d51690d74ab0151a1c5906fea155a4
- SHA1 2d6b034371ce6652dc37cb8aee0b4c381747b265
- SHA512 31942f384600f2580c6e42d6a70fa35ac3c21ae8026f4431ec03a7dda05b5d3f33c0e569c402f68fc99bdb93a35512b77c1202f517807768e0f5e4728414a241
- SSDEEP 6144:BL2oLyPCNNqFT+LXiXRof1kIQRrLJYWFgbkp:BaEyPCNNqvRoSxgo
- TLSH T156345B5A73A4C4F5E4628538CAD1CB96F672B8150B3186CF12641B6FFE23AD11D387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:a2:60:3c:ac:8b:6c:73:c6:9f:d1:6d:b5:36:46:14:64:4d:84:a8:ec:f2:2b:42:23:e4:77:d6:15:1b:6c:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bb:19:9d:14:40:6e:d8:16:ff:ed:e4:ad:ac:fb:6f:f3:b3:2e:a8:7f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
50772
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
DebugBreak
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidCodePage
GetOEMCP
RtlPcToFileHeader
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=48, id=207, version=50323,
count=129, id=206, version=50323,
count=10, id=205, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=183, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/PEVerify.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/SvcUtil.exe
- SHA256 ebd0c516b5a866a0252c30fc8eaa42d58876a44ac22e45d49a5e49467f66b1ed
- MD5 f773f80240c6e2311e808b3c0e06e571
- SHA1 ac8136c8e70a0277dbdbccc04245cc16ea744f88
- SHA512 a57ecd15263058d380d4198e632f0955741ac6b421252876d454ae456cec9b210af59871cccf6ba34a402a4ad9d3365e061823bf9e86ae0b9b5b75e70f05dfa9
- SSDEEP 3072:33O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerZwyegYm1/KTSf:nBGxsI46nYNs0xcX5Y+f
- TLSH T150141A3937EC1726F9FB4BB4BCB5C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2a:67:17:08:44:81:14:7c:fb:fa:52:be:69:2a:bd:13:45:18:fb:71:73:53:dd:0d:f4:f8:2e:fd:09:09:83:fe
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
34:f1:1a:79:55:07:12:85:fe:be:04:c6:00:12:30:5f:07:56:82:79
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
svcutil.pdb
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/TlbExp.exe
- SHA256 97f595488aa88df5331096c5f8c5ba51499c23598305202ec6f0223d18c06f85
- MD5 7112bbd499e542405ec42a3bb52488a5
- SHA1 561118517c796d1ac405924e150f16cb4daa6f79
- SHA512 5a880ca58a833f3b9602bdb28146a80b6f025ecbfd9b163f7e6b8fe901a7e9db137e767eb69768eb5603799807a3bd2b3cbaf7c7802d57de24799a865ec5f23b
- SSDEEP 1536:68sTxMSqgD2LJ6lXi/KjcTGBWEc6b2G3oJaQinq:68PSFD2LJ6lXTcTGBWEc6b2G4JaQ0q
- TLSH T1BF53F6149BF84212F6FB4B716DF5C0879976F657AE25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0b:7b:cc:3b:37:21:63:52:66:50:2b:1c:ce:6a:a7:14:e1:16:ea:7d:87:d2:a0:d7:85:98:94:16:c1:ec:0d:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
91:a1:69:dc:f9:b6:af:71:e2:cd:a9:05:5d:a0:38:3b:0d:ee:10:f0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbExp.pdb
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/TlbImp.exe
- SHA256 76c24910eae1b750141d0c446b0fb18125cc43c4388fa66d29b0fe0da9a4e220
- MD5 acef4e9b8b39de4c677621fdf95049eb
- SHA1 4a130290334e8bf0b8f8df54ff1cd872cb6c7e95
- SHA512 0604709d84d96928687fec7c9bd57d1daed064ba335c9eaa9be3e3423a1dbc9b97f98ce97dc2c77a1eb3b73d4e8cda22e2321b2ec330d61cc031ac180b11b56c
- SSDEEP 3072:x4v7VpD9Zp5q4l0QSmcydxiC7ieldIVr61c3N07Cw5uGjsJx9BzdcOyK7f8y1Ev5:x4v7V19L5q7ytldIZ6C3NmDHh
- TLSH T120142A2567EC4A2AF6FA5775E8F5800687F2F55B2A1BD30D285817FA0A233C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:fb:bd:b8:5a:e5:63:96:0f:d5:b5:fa:ee:66:d1:16:74:da:fa:d0:29:5b:e4:ba:68:1f:4c:ac:35:47:8b:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
0c:1c:15:b5:6b:a5:d2:97:55:15:95:be:aa:bd:2c:fc:c5:fe:f1:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbImp.pdb
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/Tracker.exe
- IMPHASH b517539aa03ef87abb610ee2854c1cd8
- SHA256 5d963c4282e4886b7d45e2af6d66fe3e670988325d6c8c767f45db374c704d0c
- MD5 e75207c8611f4a259640801e4c999aae
- SHA1 14984b5d9e8a22c74e4f187595e17f2442aafd08
- SHA512 b699044d55b24247ba5df79c9fe8d45b91d9c59b5e8708f22094fded77321a7072a5eb3076d8574a422e40ff10852479a08e8a46654012feb632903d9a8106da
- SSDEEP 3072:Wq9nBVeTEle6ef5eFqPmi/Q5hF1pOujmsFxT7XcrCjDu/Gl:dlbeT1Df5s6mntzOuiMhjuU
- TLSH T11BD36C1632E850F6D8A79178DAE18A46E7B6B4B7433153CF076482AA1F637D06E3D331
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:69:24:4f:e4:41:ef:6b:1f:bd:c8:b9:b4:0d:ab:ba:48:c1:cf:7d:0e:73:fa:26:d2:04:2b:c3:34:7f:c2:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9a:c4:d6:e5:38:a2:c5:3f:f1:b6:4d:45:3d:d6:0b:84:54:01:68:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
11468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
RtlPcToFileHeader
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=118, id=206, version=50323,
count=8, id=205, version=50323,
count=120, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/al.exe
- IMPHASH 364ede3acace322dd1076fa9279da829
- SHA256 53470f7ad31a60a5f058b851f0eecb121dc1ff044d2ce754609dc1335919847c
- MD5 736b03c2b5ee26241be7d01ebf61c320
- SHA1 ad85dd06e7dd97e71f5f11492e62dc32d6341ca0
- SHA512 0d37f34c420928469793998a118d527ea775ce5619f103b37cc75fdce4ca4f9d74f4e706001bec761b0557b196adf2377b466d5b72019a6c51060f69a27ad54c
- SSDEEP 3072:8Bv+81lr0ArllqD1IPLZHTMVCD4Cu1EmoQIhwd75qW3KKvj6rVWOY39wxZQXD4Li:0v+S5lqDQpTnGGmPqwdAYKKLUVY+8oi
- TLSH T1DC246C1132D810F6F4B79638C9A19656EA76BC5A173083CF13A456B99F73FD0AE38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:63:7f:d6:cd:7b:ae:e4:db:d0:d1:28:8a:d8:15:34:db:d8:b8:3e:09:2a:5e:4c:6e:36:1d:78:91:a0:56:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:3c:39:9a:1e:2f:50:bb:37:70:3e:88:9d:b4:6f:c3:ca:4d:51:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
54464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
CreateFileW
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
GetTempPathW
GetTempFileNameW
WriteFile
DeleteFileW
LoadLibraryExA
RaiseException
HeapDestroy
LCMapStringA
GetEnvironmentVariableA
WriteConsoleW
LCMapStringEx
SetFilePointerEx
HeapReAlloc
LoadLibraryW
OutputDebugStringW
GetEnvironmentStringsW
SetLastError
GetShortPathNameW
GetShortPathNameA
GetFullPathNameW
FindFirstFileW
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
RtlUnwindEx
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
RtlPcToFileHeader
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathCanonicalizeW
PathIsRelativeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=146, id=206, version=50323,
count=10, id=205, version=50323,
count=61, id=207, version=50323,
count=147, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/al.exe.config
- SHA256 140b18429bb347220d5dca9d46d4fc54c7b8271c6015a0f5fc439c7b89556506
- MD5 358bc4d63c6584639a5462675976af93
- SHA1 7767bd5a2bbd77ed64f70acefaa881e0338a41b2
- SHA512 e41ec7e5014c22acc20d1581f8807e09e4da458ba2cf8d6aba09864eab5a671a85f8ea3822f39d0e888b3449a825de04195b8be1d58c945f7c3c9ffb05c82bd7
- TLSH T1F4C08CA946B4FA2B0C072B4379900A02AFB001C2A0085004F1BF7F500B0548D8307317
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/clrver.exe
- IMPHASH 3a07376d2c7c5610b71b0d9a122bf39b
- SHA256 92a572073cdd25c0b487911fdad52430299d8a6e0349dbf136cdebe3630cf762
- MD5 3df1900f00aee7b9e767de9d3276c386
- SHA1 71a35be8cbc01a74edb174450a1edf3d3aa6ccb7
- SHA512 5b6bc4ee39c2db89d6b3128d76c8b8e48ac93f984db1ddbadbe8fe3cf6d543a1bf94a56953b94c26d2f11d6c0910c30d02a8a3fee882e28a2230ecf36442b993
- SSDEEP 1536:UwbG7iTd8NzuoYGszYD69kgwobfMrhd24WmnbI9uBkA:rPTeNzuoYc8kgwobkP2fmnblBv
- TLSH T186837E5822A400FAE8639538D6F1CA16EBBAF893177147CF4754829E1FA37D15E38732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d3:05:8b:0f:50:ba:09:6d:89:56:15:4f:eb:85:4d:e8:05:1b:b1:83:b9:87:64:ab:ed:25:ab:cf:2d:b1:1c:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:e0:7d:37:13:7d:fb:cb:5e:e1:30:ae:23:a6:47:77:cc:be:cb:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
7368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=93, id=206, version=50323,
count=8, id=205, version=50323,
count=83, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/disco.exe
- SHA256 e3f437bf0475c59627ec6df7fa41770a372a62655f53cbf6ea582ebf7d06e46a
- MD5 4ba26b1bf9d687438a84df3fe72c3427
- SHA1 7adc99bae76bdfe4f6bb9f902df4c50fe9f890b4
- SHA512 c6f32bed9366cae9e0c385586b0212642158846a699e2f580c101aea3444a8e12186053f6ed0b8e5b689445c76efed2f6ebabee7e762d4cf9b7bbdb97b2ceccf
- SSDEEP 768:JPJD0SLoVy6f/IELS5c7d1ZstJI6Iq8fhHxox0iMUg8:JxzkVy6fScJgJ3ohHxy0rUg8
- TLSH T1D663E61493E84212E9BB4AB06BFBC3C387BEB5875D21D75D2895634C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:01:82:46:69:d9:17:5e:75:ef:ef:d8:e6:eb:be:0f:b3:3a:ce:87:67:33:3c:03:c9:79:c7:03:99:fe:0b:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6f:ac:f4:b7:c8:01:c5:82:00:42:66:aa:38:b4:e2:8d:5f:51:dd:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
disco.pdb
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/gacutil.exe
- IMPHASH 1859f09c53c6a7ccf0c78b8dbd0cc5a9
- SHA256 7f25f497ee07285262b185af7434f38a21a1770c437b70df32ea61d2902c423b
- MD5 beb512a9b84f30319b01ab27448963f6
- SHA1 0a3eee699071ef0ab96207369d3c4209181a56bd
- SHA512 37af2b1b152e03b712e037e82cadc19183b32fae2a3d00c9fbd12652b94cf9d456337aa5a104e67361fa8611163df6083a8187f22daff5c135e95ba21df9d164
- SSDEEP 3072:OX46OsHdZTdvZsTy7BYqlXW7X2o2cjOWpSjQrqpiLteyLSk7L:OoMZTH8y5KGzcSwDik7L
- TLSH T101D37E6736A860F9D497853889E18A46D776B4731B7193CF026443A91F23BC46F3E332
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e6:e6:fa:e4:60:e9:9e:9e:01:41:7f:91:e9:72:c0:ee:c5:2b:39:e3:36:d6:70:8b:b0:e2:0c:90:a4:bb:bd:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6b:30:52:18:46:f8:f4:93:91:7a:f1:02:8c:bf:a3:0a:33:1e:3b:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
26496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RtlPcToFileHeader
RaiseException
OutputDebugStringW
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=43, id=207, version=50323,
count=95, id=206, version=50323,
count=9, id=205, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/gacutil.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/ildasm.exe
- IMPHASH ad5fa249b30d415c373e2bb8cdc77172
- SHA256 d7a8fe9448d0a86251b5e45893fb4e367ef95f950f689a1d82a1a2aba04f48df
- MD5 66886aebf02f9339f9b74e1ea41ec1ca
- SHA1 1d88d8890e1d4c996dec4438df10a1b16bff18e0
- SHA512 d4a79f067a46a7e2d681405cc1fa56ea9521ddf566473be9ed005535b9ef9b3a0ba65bbcb268048368c3057a551fe91429160f49742a9d0422c940b7146983fa
- SSDEEP 12288:X8iPgHkKugX5Sgn03FzdS2axJBRdVJAuK+ft63FcJIU:9YkKugX5Rw3YxrRdVJAumcJR
- TLSH T152C48CA6F39842F9D426817CC892C257F6B278450B3186CB729C5A9F1F337E15E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
40:10:51:ca:31:06:d0:d4:ee:3b:16:52:64:57:a9:08:7f:46:2a:ce:db:07:d8:ee:dd:3b:a0:68:9e:c5:73:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ce:20:ad:e9:f4:66:0f:31:38:50:da:1a:73:9d:4e:97:83:3e:f5:3f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
278072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ildasm.pdb
kernel32
GetStdHandle
SetEndOfFile
LoadLibraryExA
GetCommandLineW
ExpandEnvironmentStringsA
CreateProcessW
GetConsoleOutputCP
SetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
WriteConsoleW
SwitchToThread
HeapReAlloc
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
GetConsoleMode
CreateFileW
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
DeleteCriticalSection
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
WideCharToMultiByte
CloseHandle
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleCP
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
RtlPcToFileHeader
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
883KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=51, id=207, version=50323,
count=143, id=206, version=50323,
count=11, id=205, version=50323,
count=265, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/ildasm.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/lc.exe
- SHA256 ffa352f9ea4380a4ef04c080160cd5f6663928dee609a884ae81abcb99a7cf8a
- MD5 e83f4a38d95ad5e83826f7f1a1f66a0f
- SHA1 8984668625c487cb333a415d4d198da48afc9cf2
- SHA512 95c75dae48be257d390999594c634aa42cda9d080c79dd0d92a7140ac3fa2d01ef16f6d0ee1de116aa7458a899c46d74a442992c2962d74b6d440f62d6124c70
- SSDEEP 768:zSMzuxFp27Nc8DO5O6Iq8Wg587iGdBNGa:zS+uxFp27NcQObfgG77HNGa
- TLSH T1C723E82897F84213F6B74BB0ADF5C487AD36FA53AE75C75D2889434D09227C08A5273E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:b6:a6:e0:32:e8:ef:ef:25:b5:e0:8c:2e:7b:81:13:a1:0c:2c:d1:ac:f9:ee:c5:d3:7b:58:1a:84:94:93:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:a3:18:26:12:66:06:7c:a8:c5:c1:9c:25:db:68:87:ff:e7:65:ce
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
lc.pdb
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/lc.exe.config
- SHA256 140b18429bb347220d5dca9d46d4fc54c7b8271c6015a0f5fc439c7b89556506
- MD5 358bc4d63c6584639a5462675976af93
- SHA1 7767bd5a2bbd77ed64f70acefaa881e0338a41b2
- SHA512 e41ec7e5014c22acc20d1581f8807e09e4da458ba2cf8d6aba09864eab5a671a85f8ea3822f39d0e888b3449a825de04195b8be1d58c945f7c3c9ffb05c82bd7
- TLSH T1F4C08CA946B4FA2B0C072B4379900A02AFB001C2A0085004F1BF7F500B0548D8307317
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/sgen.exe
- SHA256 e218a5fca6a07f65de07c4152df2d551ee541b91c69b13fac9fbec60e8a82c69
- MD5 69b6756b81b10ccb9ba0674f548ee264
- SHA1 8f88bcb4f15e15375a59b1f35118b857e8129986
- SHA512 8db6e9b29c3cdbca582ea9af1b798c0136f42f831411d0ae4a030c4959b39269b35ef55dff2518a0cc3968a3c8d768dbef6f296d298182d0ec3fe1c28c70dffb
- SSDEEP 768:ubRwSIUjOjyET3c8oQyqCP6Iq8CUX5xxYidd8z:ERwMO33cdQRC2FUXhYq8z
- TLSH T10563C61493E81212EDB64AB09FFBC3C39BBEB6835915D79D345903490D2E7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:fe:e8:99:1d:b2:41:88:6d:e3:62:7e:f2:5b:de:23:12:97:75:92:26:e3:42:88:ac:7d:2c:1d:b2:9d:3c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f0:88:e7:bb:74:fe:a8:40:f5:71:b9:a3:cb:0f:a1:79:bb:a6:0e:2c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sgen.pdb
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/sn.exe
- IMPHASH b43e39f72141c38455537524fa7ef186
- SHA256 bb9a9594ca93e51d9f465ff68127fca1c5dfacf289be08a532da40e5c858c5f7
- MD5 b1074a14788df5c8f231027a838bc2ca
- SHA1 c2e2e1381933ed5701260f389e1df82b52e3e8c5
- SHA512 0a1a748e9ae90c32be5a9d9e9b2a01be1885e692eb95c6ce7d18872e027b2f0f857c79062e1bd65e3703cfe9f7389edca45ae7ff436c3295a5cd2670c2d04568
- SSDEEP 6144:rH9xY5bF43aCJbGsT35SD2D5b+lrdLtoInBK:rdxYlF43aC1GB2DuM
- TLSH T164343852739488F6E8264538C8D0C7E5B272B8151F35CBDB32A4176EAE337E05D387A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:42:18:8c:1d:28:0c:07:7d:54:1a:a4:24:47:be:b5:61:37:f0:3b:33:5d:3d:63:1d:21:c7:bb:43:3b:ae:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:77:d5:d2:7c:f8:64:ef:37:ba:db:fc:67:17:78:51:ff:07:4a:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
74168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
WriteConsoleW
HeapReAlloc
SetFilePointerEx
LoadLibraryW
MultiByteToWideChar
CloseHandle
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GetStdHandle
GlobalUnlock
FlushFileBuffers
RtlCaptureContext
Sleep
GetOEMCP
IsValidCodePage
RtlUnwindEx
GetTickCount64
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
FlsFree
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetModuleHandleW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
HeapSetInformation
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
DebugBreak
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
FlsSetValue
RtlPcToFileHeader
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=111, id=206, version=50323,
count=10, id=205, version=50323,
count=219, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
Releases/Tools/Stub/SDKs/x64/sn.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/wsdl.exe
- SHA256 2f483df7d102648951048bd274a1d3e1aa0edc74ec9caf23c4baab03473deaba
- MD5 94d7f58c6ac2e333f67d4d32dc4d127b
- SHA1 3f0658f6f8339320d8e61f71bb38c6feba41efc5
- SHA512 95596da07781532f97199a11749ae90e61217a20b56fb008d59a64ef5b3b6b6a45138d2c444adc2ef379d7d9c12fbe34d4e1e98a16df0b8a3e07d4f100a4dbbc
- SSDEEP 3072:qYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZweOglyRGQ:IT8rLo9YJ/bhuK3fSRbfMA97cZbC69gy
- TLSH T101A3E71573E80711F5FB0BB0ABF692C287FEB9566911D68D2C94124D0C7ABC1AB13727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:fa:3c:f9:14:e5:89:d7:dc:79:e0:c7:40:46:08:26:9c:3f:42:7c:8d:11:25:80:96:4b:4b:71:38:43:07:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a5:50:34:6c:a4:1b:00:49:83:1d:b7:a3:fe:e9:41:1a:43:9a:25:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsdl.pdb
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/x64/wsdl.exe.config
- SHA256 f6eb3e97a30ef658995a93abc39936150e2b374c4991ace89a670edd47761a04
- MD5 edab76159a2c4c36363e4c6a00696269
- SHA1 6f8f257d7b29567ed44334f08d11256030432ec3
- SHA512 431c4b236866c67fee470421eafbb4075d38b4a939000d3933faa5253b8e6a7c4398dbc8f70c5b59bc362c5f15cf9795d7123a419a85f0458b9d50caa4b182df
- TLSH T13FD022888BB8AD778C0B6B033A6046012FF092C2A0086008F1BF2EA00F0188E0387357
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/SDKs/x64/xsd.exe
- SHA256 4f5f82d032ab09ec1c429345374d64a6acae525532a1b349a182d25ac333563e
- MD5 1d5d04263b58807df2c9feeff1fc5b96
- SHA1 cff0338da55579f74650e4d9c5b59b53f69cc768
- SHA512 2e8bc0831e3d45841ee183759076a503f9b11c7eb8b1a34e3a2c632508f1f1601b800d182f6608208ac892bb94447016652ceeae6ffb12da290d24fb72fe23b3
- SSDEEP 1536:vYfan8nrNH7alpJjucAdfYPHccoxK2WpFBVGU:9nMMlpJjucAdOccoc22F3GU
- TLSH T135930A15ABFD4205F1FB4F34A8F5C0625A7BBA166D31D75C189D928C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:ba:7b:98:21:eb:67:54:d7:3b:64:28:b7:b1:f1:ea:77:4b:40:01:31:6b:15:75:44:be:c6:03:e2:e7:bf:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b5:1d:ff:45:19:ad:ee:f5:f3:e0:98:3b:72:19:79:02:35:be:ac:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
xsd.pdb
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Releases/Tools/Stub/SDKs/xsd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a20c0479bfd55ed5680d4652d86944d1282fd135994669012e3047628e8844d3
- MD5 e885af77cf8dea8a891f14b5eef4a400
- SHA1 28b570055dbad10778e062245131622480beb141
- SHA512 c0ca5210cd273d72eb4639072034bfdc9ae19ba239dbe53b1eb1748f541fc43c8282f6c024da98ebc7602f60ab067fc2c1acb73ee764e4cee8c1429f19d719e7
- SSDEEP 1536:tYfan8nrNH7alpJjucAdfYPHccoiK2W+OD70GeQ:jnMMlpJjucAdOccot2NOD7uQ
- TLSH T1FA930A14ABFD5205F1FB4F34A8F5C0625A7BB9166E31D65C189D938C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:32:7e:01:07:d4:f2:ab:9c:5b:1c:29:8a:88:dd:11:a6:14:e3:ff:80:92:43:7a:74:5d:29:61:e8:13:ed:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
75:18:fb:16:70:1a:b0:99:65:a6:5e:c0:31:39:79:f5:99:61:3b:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsd.pdb
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/SDKs/xsltc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a9fda11778afc8d4517e89afa36159aa5f4fb971d677ad7fa4b78b824a48ca2a
- MD5 a7239515201dfe38668bf54bd16de93f
- SHA1 b31fe9a9e53dfc939a1c0542de0589ad902cf230
- SHA512 35ac063d062843038c57b03dc2938d19bfcc2656f361c95e7e8f8b8f2f30d11cd3063c21eac8b31648ef9d93b8ced6d582097ceed7a84ae83e3ab36803d8028b
- SSDEEP 1536:nIuzQF3kgdNtQLXWGHAOjoa/MACRB3rZh:nIuzQFUgdNtiWGHAOjzELRBbz
- TLSH T1C0435B55B7FC1213DAF70F71AA7591420F3EEBA32922E52E2888D19D09133C887217B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:99:f3:d5:39:4b:b7:49:96:8f:55:e3:f4:cc:27:12:e2:99:a3:36:eb:5c:89:b6:1b:89:ba:c0:be:af:96:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:b6:ea:45:8a:b1:ec:59:38:98:31:f0:d7:78:69:6e:87:f0:00:42
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsltc.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/3rd-party.txt
- SHA256 bc60a1270f7bd2db6857e54d25e834a2ddfcd72902cb9301e80fabd78f7a093c
- MD5 0bc65fbf534d0e423a1fba68b8722360
- SHA1 87697c8949efa2f82cb1784771d9b787a3ec261a
- SHA512 ea511a9a39e2b92831d9a532426cab631b20ba661330a6f3c247700ec1e623bd6f3d71384a1920c4a470a3819efa6467478c3eca53c89e5dc9533239e815e850
- TLSH T13FF05960024811CA2D450E48C0E9C382F379268FE617FC8C397EA178E7A4E9643DF185
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg
- SHA256 618e90213655c042c966673d95648b4b152dadd4c4874c4e193df018f6eda05e
- MD5 fa0463eb37f30431e785112bb3bfe293
- SHA1 a4f042abe3bc9f6e162aeab1969347eef590495e
- SHA512 269ef668f8451dd6c67e1a53ddb73163bcb3389b247e78de941f633a1e75df72a3c65b98fa5bd8d5dcdf9df944f67fe3ecd0f786945fd45eef96b9bdb39323ee
- SSDEEP 98304:gekPhpW1Q7lk4GBi8ZL8ny/V8DO3ihMO2AraYcrGrAd:shs0lk4GBlZgy/V5fsW+rAd
- TLSH T1F20633CBCE49B9C2DF15517A429CDEFE76CBCBCD2380499F831B199101569E80AD37A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/License.txt
- SHA256 d3baf5f0161cc0d7aaf96a331a84346a5fd09faef67bcac33be6cad8beb393c2
- MD5 61f959993b15dd5d3d0e9c46d39630a9
- SHA1 3ca050fc84f37b895ed2772c76c5d823b9ad5d1a
- SHA512 f4ac86733ed3fcb0978f5e058becad0ab1043a9e89f93d5f81c8aee1620eed9138c3ffec8dc55d5eb8a2c1cd9bce495608a68b44b610613a2674b83dc3d00bdb
- TLSH T16321A31E72540B721C9603605679ACC9F12F711B7B9F2E85202EF340232A068D5FB840
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/Readme.md
- SHA256 f52d1587f84f8dbba907bba469ba3c9e8d26f9d62706ad4f7c31373ff047385e
- MD5 aa3cc3623a7902596af8c96dd8ed84bd
- SHA1 272aee93d364dacef8fc924dbe7f58e144eb97a9
- SHA512 eabd608e89c2b06025db2fe67015e2ba792becb6320cb4a5678eec3b615bb2c6a5f6ecad0eb42042a91196a86684a91b23d453468f18218e1f13fd5d980c6dfe
- SSDEEP 96:X8BZQm0JPcOrBo9AocFoLztr3cnJj8jANd1Nt/qnAgNna1iyKaQZlWNBzU9oQqur:sBH0JkWocvL/qnnaWZGhujEClj
- TLSH T10CF1C8FF0F4424CAAF0358DB6B55F2E9DF274257A9C4D8A878AC4334E3CA16541BB950
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/changelog.txt
- SHA256 64e6bed846a077129be2f7a1109c14f3cb033eb709f88b1031bc270aa76cbc20
- MD5 6fe19f81d97fa923afd4b8714b1e1f7f
- SHA1 e191292aafcec1fb9ad13c4ae9088a557d457824
- SHA512 6aea1f30c81c450cc14204ea61d122aebbd0cd7600aa809cea47a255357776eae4d691cc86e7872177a6860b2dcf0b706ce05471ba4ba9fda7829cf43961580d
- TLSH T1C081352A56C1519E198306B2235DA660FA77125FF743BCC8B44F433C3F47B95469BA31
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2ee2037a59920bbc2f8c942e25ab71448d64d5d1d38dd358257aaac1bf2c5c0
- MD5 e37edd3c83ac1c3d35b5cd73fabfd93b
- SHA1 082a588b197b4f2d10193f8eba565c96378d48c5
- SHA512 e0f18fa36a0feda4e814faffa4a3e47bb5d0e827cf48a2a7513d1c4f940b186e4e40803d5d4d4ba10e9cc5e582cde7e53376838257e42eef5a7e723bbc938390
- SSDEEP 48:6gdGASB7rEr0Jd6tzif2HJKubOrPhBnueJot6Ut/MogqkNXTw:EAy7rzJkef2jOuckrk
- TLSH T18B91622267AC07BFFCBB4B35BEB3934112B5B610DA13CB6E4D8216165C267644C22AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi
- SHA256 683a4fe842732bc2e5faf03b4c999a51fb07be8bfbe4579c355677d4c1f1d282
- MD5 196488e18bb1d3d1eef97cb0618372df
- SHA1 0d04ba96799b214acd726657662c575c1f48981e
- SHA512 3f117c5b7c34d59388bcc7e41a7166296ae825b4e48b388f647d36a6223aee3cd3e1f336d40ff7b2a72c364b50ec72438991b686a93531b1838406350ed13f91
- TLSH T1A9D022D07F006489C38680780460A8E113FAA0DA4EF4920F30C8220EAC43A376F52451
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afe62d5447c2961d89b763fc60380744df38e785f4a386d61556ac0138e70c1b
- MD5 b5e099f5aa58eb62248d02eabb633f65
- SHA1 d447c68f05d70f36cad9e4955b35e9d8bc03947a
- SHA512 0e0e1d0afa2154cdd2e47803162abf44155ab810481766c5bf2be04d28e270314c969c2d2d7b46ad37c890a7a93376de27da0a17a0667a727efb79b2c4ad2cab
- SSDEEP 48:6F1S+014jrjWmqghYhPhjhcuR8SFMDfqKOrPVzu7KysYt6Ut/MogqkNXTw:Mh0OjrykMZdcuRGku2Zkrk
- TLSH T1BAC17422D7A803BEFC7B0B31EE93B74215F1F5158BD3DA2A05811B4B7C267145922B64
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Metadata\obj\Release\DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1
- SHA256 4fb96f0a72c99d93593cc743e57d044f8804747c60d78d913440f7bb154a5518
- MD5 282dd1dbb2f8b658ec7259bd97322c96
- SHA1 fcae6107a9565f32208bf8b0c51ef277909471c3
- SHA512 9cafb47e592cc07edc92782d70a610f74f1e2f670a753038aebba1619d1997b92313048c93b994272d78b5489c2288501039c22afd80412db2ac06a352e31cc0
- SSDEEP 96:V8RTJeaLUnxycEOlqju3s2XiVtZKy/eI49QIbjre/O9VxyxA7l5:SRgaLIxycxl6u3s2XiBKy/eIYQwe/O9V
- TLSH T159A18523B754EAC0BBC3526A9687DD49BC99143700689D28F06CC3C66F56E14C7F36BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d83b3daa7fc17c7361c8c205a76f92e0d6a881c80375fa518662ceb386af1b4
- MD5 ae1d4372a93befe78284457a0e2d2c94
- SHA1 4f6097cf6a2cfbd1ec9257dc01ab6d34bbf8a4cc
- SHA512 d06e8395f4d077b9341d5210ea86ccef1eb4f9c7c7177de39dd8bd689f6d448b7cdf84d4a1abb6233c73864ea5658df55c69d08ad8903495bb8a3ddd24134e0c
- SSDEEP 768:9v3pyNQdgmg72Ger0Gb1xB1q2aEmPc4YSad5BKMi2jXHUttH:p34NQdgmPGNMLs2ePcYyd9rHUr
- TLSH T17F131A182785CEBEEDB90E74FC6056352731C386F826C71B5764B5AC64C238F66E2A48
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
17:2d:e7:d0:2d:52:fd:a6:20:2d:22:71:ee:22:7c:2b:29:66:27:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
42622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7761b1955c5a0822ddbb86dfed6801d952a6c65281e6d29c65265285096b01c5
- MD5 0015d9b1cfb6abc0bb8c59aa1849abb7
- SHA1 eea52f295115c4b2152f5f4635477fd0a1e6e336
- SHA512 739b5adb8bcf577ee95a5a45f2a92df24de71ae0452c4b434b17f5646a6925344d9d718b4149a124ed7cad29c78cf9347d780196d080a99c80e06b7dd0363fd0
- SSDEEP 1536:jcXfve+YEEYBqqTU6qNScWXqS7ScM6Nnqj+R8KEOv1hL6THlZ0Nj7BTWWYKVN+RH:w3e+YEEYBqqTU6qsXasScMry+KEOv1hm
- TLSH T1E193D70563FC0229FEB71BB5BDB541190B77FA966923C75E1000125E0B72B5B8AB2B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
99:6b:ca:86:0b:d2:4f:9e:29:f0:66:22:58:b3:7d:6c:db:82:07:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
90162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbec9a910488cadbad860c850ceae521a2a346619c5a9da579e5051e270f114c
- MD5 3998804194188c25df75f505ac5c531a
- SHA1 6b15b2d779e7c46e31fcc864fc1ef326fb3d2b50
- SHA512 d7cd7457c753190fd1ae5386a62dffbe5907ace02227ef873f4c890f4a4e987914fb94ab1ec8318f48a76fc55cfe8e7de83b75cfcbec0bb8ff0e18d2d956abdc
- SSDEEP 768:droEzop6gC66+666M66666+vvvvvvvvvvvvvF66666K66n6666666666ZpkLEyXD:nNLEyXCL
- TLSH T1D9F2E8C24341D52ECDEB92BAF0D512E02339F34D67539B0BA718A01EA95FBAD7307A45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4dfe61f79efe3a8e686a2f045f372476c5fec704ce3015c24608c84270b408cd
- MD5 dd97f2c3467656a5eaccb0ab679dbbb3
- SHA1 b11b247f96054fa0d2eaf52f080b0c759e0b6ce6
- SHA512 162a403dea6cca3381d4b8854057814178c858ad7a2a4c9ad0bdd8bd77cc25497c286832b7aab804a708fa927c2347ca925afcb3cb08fb870c711e080d72a4fb
- SSDEEP 6144:9F7O4dMG5Q4RMYAkUSHzqu4OJDW4i8BO:7OvG5Q17VOJ28B
- TLSH T195447C1627AC5ABFD7CE8B3BE0409A1AC2F8C05E724FDB419CD8D5F92C277959910263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\net_4_0_Release\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/NSBin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c39024083771329805ee9e30c3529397e39eb98174cd4dcdfab62442bbcc7ef6
- MD5 0a3ed8a4f354f7516c91f68cfb1e4ece
- SHA1 5a569a08427b66237b20ba90d12efcaa7fca9e80
- SHA512 21293b72bcda196ebcda5430e04f67948c5a99b19d1126f495d1f352c47f02d1aeeb7944f61b96e3765b999774266df209494649f856e68426a4bd1e1ac60f3e
- SSDEEP 384:ZqY1VhOF+5avamTEDbrXSS8yAF1KWNftgpl:RDUF+gvamniU1KUtIl
- TLSH T1E462F6002BF8832ACBBF0B3978F3565106F1EA05AA33C75F1964F4571817B5906B177A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\NSBin\obj\Release\NSBin.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/NSBin.pdb
- SHA256 540e4b28a65346f82a2a4e699d09475e6d7fd6bd603e483675c2ab0243f7e210
- MD5 1c3ef4be1c1a17390a655d328e40f363
- SHA1 30ad53e3259a36b144b21a74752c978b94661764
- SHA512 763dbc54b82de4831c3fc173dce084b8d8d50553afab4c4632d901b3266826b210d0a05adf874fb850103dacdb80e42a43ef6c653db55e9472573e5d4f30993a
- SSDEEP 192:DAoA0AsLATAwAhAqAodOgR1kjxs8Pg2cl64LIkJWw9wd66sn/lGfREhSbPy8eCsL:NDBcx4HYmihy8zV5AjZnZ
- TLSH T179032017FF40DA32E46981347AEB8F2D47B5EC8C9B81975F6345B1683CB23A92D82354
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39faf6e347ac0c31c572193dcfb2d61b7a3eb184b29e8b1b82f90917aec599ef
- MD5 2dad575e994c4ec82023c903c8f89404
- SHA1 14eef09004f1e0c5d726a25a3b74887b3098ef42
- SHA512 c54f0c1b67dab869507b7918df69032af6b3f7186ef38b07603effb67c4a991fefcf9890cd26c071589f1f0399ab2b8db54c5983f0a9ac66a1a491fbdd5f0f01
- SSDEEP 768:TMaXJ/C/iKATxUnlFL5JL3vv1FfmQ91hv/nDE/TV0ZXwtr84ZJ+LZkKZjk6ZH4tC:TMzbAT6lFXZBmQ91hvg/ReX8lZT8/
- TLSH T1F7431904BBE80534F3BB2E7BB07154944F35F787AD12EF5E6891A49E0E527011AA13AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport.MSBuild\obj\Release\RGiesecke.DllExport.MSBuild.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb
- SHA256 929d7c913329c6705f2be9d8d65abf522a38c5f3852c2674709936bd94baba8f
- MD5 610b0b6619fba7cf145e0e83aa889638
- SHA1 638dc3fbd365267f941f10b3196baaeaafe2edf0
- SHA512 81cd6c71abc35ee9a09f1824bc0d9304f0810298accad75063b52a811d7df9148ab9764114153649b8a70e539ea49b56fc0fc547b2d3d1603533a784702aa869
- SSDEEP 768:uTIHnYYZOT/pVRFk12TfPD1fY/lo0R8A8HEQq5q:uTIpZOPRk6BfMlFj2EQq5q
- TLSH T1AFC38257BF14CA72D81985386EEF4B1E0638EACD4B43979F9706B0683EF23761C86254
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04fffee97413dd15c7150fce8c2ec4eb6ba668a919e2aec7be8b44da3cbe19dd
- MD5 76f1a829fe3a0e01490bf68c9a0e96ba
- SHA1 780653b5edccdfb13707673f9b73e8addac4ca01
- SHA512 ebe62260807c58fe1691095ad7745ae6b021818feb963bafa722f09522df33a4576e7eea18d55950248df7c8e0378fbb61007097471b0d3442d8705cccadeeb5
- SSDEEP 1536:AJdpmcyf4uxDoNj8RrewhfVI/j12m6fz9w37vPRnUwoLSE+jHgAUqn:AJfmjguxgQreayH6fzs7vZnUwpEFPqn
- TLSH T159935D2527EC4A69F7AB0E39B8B560120FB5FAC62403EB5D4E44789E1D233418E72777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport\obj\Release\RGiesecke.DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb
- SHA256 3380f7127b016409a0b73aa5c333df308abff9b01d51761e881fba4c04e2f1e8
- MD5 1667a09c0b87fb46b0fc8a3176d6e88c
- SHA1 519b62a38104345d05efa0e8f2ea5c01537be5f2
- SHA512 39f784f84a6ca8111dd4839f7bd2fbed9e9670c5b6cd1fd617aa884b9cc8bab54a198f60a43ff10a09156890bc800f70d72c747e92224497b564e56dd67594b2
- SSDEEP 1536:DlZJBMr/6JOw8NvX22Of2TqGcHdgXZguegKxmuRnUNLEAIc+787uughTF+422z7D:DFBMr/vtYfrWyufaUNw78arTZ2UD
- TLSH T156348417BF44CAB2E46A85392BDF8F0D4B34E6884F42572FA785B12C3DE23551D872A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c
- MD5 835e9ede7e7c774e7a2d56cfdf6e9b17
- SHA1 a43ed886b68c6ee913da85df9ad2064f1d81c470
- SHA512 74284fd44497beb74326d11a0f63d96aff20aa44cfa8385f6b63b7e6743403c36e2ea4fb0d991767117a97d320e04d2b21f0a4730916244af4ffdaf51e834a26
- SSDEEP 3072:d/SDqTIE+QQVVBCTmAG17iT+Lt8D/1L2iLZdrs81sDotEKjRmarzRm+5gSBZqoEJ:d/PXS6WK2iLZdgotEKj9rzRmkgSBAot
- TLSH T1377408253764DBAFC8AFA276F96544304637DB183922C72359182D2C59CF76BBF12382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
359678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT
- SHA256 0547df54abc9cb02475fce35c4e4544222eb86308dac26a4b8529feb6f232c38
- MD5 ff80286dabb97a39584a14a3edd91cf2
- SHA1 90ac6304f655547f1254afa5b5d9e8d7753286b5
- SHA512 582ad4066300f2428a19d41fc21b674ca4351751045dec04555d1c54ccde4dd21251f7fd0c5bd97040113484994a70e38c09e73a86022c56d562cac1b25728e0
- TLSH T1BA11861E735507621CAA136055786CD4F13B725F7D5F1D85146DF345132A06CC6FB844
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT
- SHA256 a3c4def44780016aa837d8263fca5828aea365a5d56302fdf4341ca81ce1f848
- MD5 9b38b9b15fed812c4f20e450ee34282f
- SHA1 8ef06f28fb5e23eb586465df962016d8c836cf35
- SHA512 d0b1e314b15c0adc263d399caedb4d68a400426707748fd9852e778bb6b473544b65e0b9c47ee6cd0477cae787b94754b39dc4833d3f3eab7c37093d04732d64
- TLSH T1B55163AAAB0D17238FE142A3512638C5772DF46D3F79984010AD412C72777B9537BB1D
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/README.md
- SHA256 1c3bac7976a74b7a0946c0f0c7713be185559b2127631fac36f3faeab5f7e3ec
- MD5 afdeef5d6a86fe32540dc800204b16e6
- SHA1 9c8d903a6e323487c81f3d66c0c28a9a50d1eac1
- SHA512 676457766d0475e0a42830aa43bc3074024d5c8e0365440ef670ab6b30123a4859f634cceb4089327eb5cd147cc9cb51e706e9c05884350c48b586179834bf51
- TLSH T15E0102214D6C99A12BF1E1F2109C69BDCF09E44926F604A13CAD001C63103C656EF311
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/_Version.txt
- SHA256 e713a2482110687e58d186ef1eac10b2e37917eb7c51be7aa5c5eb723198b93a
- MD5 40d4377250b9dc5b79e1ce47b41d90be
- SHA1 b03dcc5c4c70249ebb05f11f8a56f4ba827d5675
- SHA512 9ea62e845dd66961fc8a06f81583781aedcd4682370dd20ea4e78019c45eb119b2a35c9afcb35bd029aa7513b058d883327e40f71b34c555e2adf0eaf2867423
- TLSH T1F2F0E28F2C361689C6F2D241A59A0629FEA8421C8B51D84A345C1424BB67A97255EA46
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/changelog.txt
- SHA256 9dc26fe0dffd6c3c4f769f710e6a9aee33b63eb67dc8121661c5d4daa06b5e3b
- MD5 a5dbbb16e03ce7153ce2deb29cc7adb8
- SHA1 eca2d2e1789d4c2cc99d09a5d4c39ab61b1446c6
- SHA512 a83ea43a81f101e89a176c71575bcd50173487d7fd733d77f14bba85a6982ff053e81c984f4c9c7aa81d8ce0e374366179d073f1f76a3e6836dd5d13f6145114
- TLSH T160117A874C1520299A61D29356CD7706E925020FEA573C8C786C133CAF18F851ACFB00
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll
- IMPHASH 4ec23ad5e3f71ff3322a6bac0917b9bd
- SHA256 611784b6c322814f1a1cc5dc29bf966d31146d277c9b115ad208b221071fc0d9
- MD5 cedc881566715873534c5d8fec3ca48d
- SHA1 e4808ec9da3aff012331997a5c5c1661d5399d00
- SHA512 693003053b6f8d5a8db6f0bd7bb3ec780fffbfcb870130642e8c2bc6ee5c0908a0e6a839c23715aef8ba38a27d517140e73c54fe22caf0e1bc4894ebc24306ec
- SSDEEP 98304:wNi1VdVSf5bm7Nz0XOlWJHxINuN0jI5aTpV8Ymg:wNi1VdVi6Jz8OlWJR6uNuI5r
- TLSH T178069F31BAA5803AEA5F1231593FA64E94E972704B3100CBB2F49B1E3EF54D33639657
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb
kernel32
GetSystemTimeAsFileTime
RaiseException
FreeLibrary
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
TerminateProcess
GetCurrentProcess
GetSystemDefaultLocaleName
GetUserPreferredUILanguages
GetUserDefaultLocaleName
GetLocaleInfoEx
CompareStringEx
CompareStringOrdinal
LCMapStringEx
FindNLSStringEx
GetCalendarInfoEx
LCIDToLocaleName
LocaleNameToLCID
EnumTimeFormatsEx
EnumCalendarInfoExEx
ResolveLocaleName
GetThreadPreferredUILanguages
EnumSystemLocalesEx
GetSystemInfo
GetModuleHandleW
SwitchToThread
GetProcessAffinityMask
FlushInstructionCache
VerSetConditionMask
VerifyVersionInfoW
IsWow64Process
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
CloseHandle
CreateProcessW
GetCurrentThread
WriteFile
GetStdHandle
GetConsoleOutputCP
GetLogicalProcessorInformation
SetThreadLocale
MapViewOfFileEx
UnmapViewOfFile
GetTickCount
QueryPerformanceCounter
GetStringTypeExW
WaitForSingleObject
GetTickCount64
CreateFileMappingW
GetFileSize
GlobalMemoryStatusEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateSemaphoreExW
OpenProcess
SetConsoleCtrlHandler
GetCurrentThreadId
GetVersionExW
InterlockedPushEntrySList
GetThreadContext
SuspendThread
ResumeThread
SetThreadContext
Sleep
FlushProcessWriteBuffers
QueueUserAPC
VirtualQuery
QueryPerformanceFrequency
InitializeSListHead
InterlockedPopEntrySList
GetCommandLineW
RaiseFailFastException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
DuplicateHandle
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
SetThreadStackGuarantee
GetThreadTimes
VirtualAlloc
VirtualFree
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SleepEx
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetThreadLocale
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ExitProcess
SetFilePointer
ReadFile
GetProcessTimes
InterlockedFlushSList
GetDriveTypeW
CreateMemoryResourceNotification
RtlUnwind
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcessorNumber
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReadProcessMemory
lstrlenW
OutputDebugStringA
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualUnlock
ResetWriteWatch
GetWriteWatch
SetThreadAffinityMask
MapViewOfFile
FlushFileBuffers
GetLocalTime
GetTimeFormatW
GetDateFormatW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
FindStringOrdinal
GetSystemDefaultUILanguage
GetLocaleInfoW
IsValidLocaleName
LocalFree
FormatMessageW
WideCharToMultiByte
IsDBCSLeadByte
GetCPInfo
GetACP
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetLongPathNameW
GetLastError
EncodePointer
GetFileAttributesExW
GetFileAttributesW
CreateFileW
LoadLibraryExW
SetLastError
MultiByteToWideChar
CreateThread
ExitThread
OpenEventW
LoadLibraryW
LoadLibraryExA
advapi32
SetKernelObjectSecurity
ImpersonateLoggedOnUser
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
EventRegister
GetTokenInformation
EventWrite
SetThreadToken
OpenProcessToken
RevertToSelf
OpenThreadToken
RegEnumValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateGuid
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CLSIDFromProgID
CoReleaseMarshalData
StringFromGUID2
CoRevokeInitializeSpy
CoUninitialize
CoWaitForMultipleHandles
CoRegisterInitializeSpy
CoInitializeEx
IIDFromString
CoGetObjectContext
CoGetContextToken
CoGetMarshalSizeMax
CoMarshalInterface
CoUnmarshalInterface
CoGetClassObject
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SafeArraySetRecordInfo
VarDecMul
SetErrorInfo
CreateErrorInfo
SysFreeString
LoadRegTypeLi
SysAllocString
SysStringLen
GetErrorInfo
SafeArrayGetVartype
VariantChangeType
VariantChangeTypeEx
SysAllocStringLen
VarDecCmp
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
VariantClear
VariantInit
VarDecFromCy
VarCyFromDec
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
VarDecRound
SafeArrayAllocData
SafeArrayGetElemsize
SafeArrayGetRecordInfo
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetDim
SafeArrayGetLBound
VarDecFromR4
VarDecFromR8
VarR8FromDec
VarDecFix
VarDecInt
VarR4FromDec
user32
LoadStringW
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
shlwapi
PathFindFileNameW
bcrypt
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
api-ms-win-crt-string-l1-1-0
towlower
wcsnlen
_wcsicmp
towupper
_strnicmp
isdigit
isalpha
iswascii
_stricmp
strnlen
iswspace
iswupper
strcat_s
strcmp
strncat_s
strlen
wcsncat_s
wcscat_s
strncmp
wcsncmp
strncpy_s
strcpy_s
wcsncpy_s
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
fputs
fclose
_putws
__stdio_common_vfwprintf
_flushall
fflush
fwrite
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vsnwprintf_s
_wfopen_s
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_invalid_parameter_noinfo
_errno
_configure_narrow_argv
_controlfp_s
_initialize_narrow_environment
abort
terminate
_initialize_onexit_table
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initterm
api-ms-win-crt-convert-l1-1-0
wcstoul
atol
_itow_s
atoi
_ltow_s
api-ms-win-crt-utility-l1-1-0
ldiv
qsort
bsearch
api-ms-win-crt-math-l1-1-0
__libm_sse2_asin
_isnan
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_copysign
__libm_sse2_atan
ceil
floor
__libm_sse2_acos
_CItanh
_CIsinh
_CIfmod
_CIcosh
__libm_sse2_atan2
_except1
__libm_sse2_cos
__libm_sse2_pow
__libm_sse2_sin
__libm_sse2_tan
modf
_libm_sse2_exp_precise
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-heap-l1-1-0
_free_base
_calloc_base
malloc
free
GetCLRRuntimeHost
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
g_CLREngineMetrics
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
91B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
650KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=206, version=65501,
count=17, id=203, version=65501,
count=422, id=1, productName=Unmarked objects,
count=23, id=259, version=24123,
count=33, id=261, version=24123,
count=18, id=260, version=24123,
count=6, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=385, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe
- IMPHASH ced05e986d6b96987cf3863cf7e57f3d
- SHA256 cc7593007ab383579584b2cb9f3104a316e8f75b9b4b7daa334daf8bf4aaa401
- MD5 755781ba89b1841c7a542ba09c6b359d
- SHA1 0b1a7051ffc05617cb2572e90b1deb60ca8d84a3
- SHA512 4a96bc40c42a89e056594b528ee0dd5ca7596333156a9b4cb06733917d5789366b3eaae5dcf4db98f7668967a52a195b4832fb2666d1cce14eac77c30569e0ea
- SSDEEP 6144:p9gIO4gkniw89wTXb8Jy6nudUunD2mRYZD6zsw2kGfjqoAu:TLOX5wrTXb8Jy9b2mRs6zVoA
- TLSH T154749E217F47403ACE7303364A96A73562BF50215F6503CB33DCDA5CAA742E2A67D2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
198528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ilasm\Release\ilasm.pdb
coreclr
MetaDataGetDispenser
ole32
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
IIDFromString
CoTaskMemAlloc
oleaut32
SetErrorInfo
SysFreeString
SysAllocString
CreateErrorInfo
kernel32
GetLastError
CloseHandle
GetFileSize
GetFullPathNameW
GetConsoleOutputCP
SetEnvironmentVariableW
UnmapViewOfFile
GetBinaryTypeA
DeleteFileW
HeapSetInformation
CreateFileMappingW
MapViewOfFile
GetStdHandle
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryExW
CreateFileW
SearchPathW
GetModuleFileNameW
GetTempFileNameW
GetTempPathW
GetEnvironmentVariableW
FindFirstFileExW
GetACP
GetCPInfo
FormatMessageW
LocalFree
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FlushInstructionCache
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
SetLastError
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
IsDebuggerPresent
CreateProcessW
GetCurrentThread
lstrlenW
WaitForSingleObject
ReadFile
GetExitCodeProcess
WriteFile
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
CreateSemaphoreExW
advapi32
SetThreadToken
RevertToSelf
OpenThreadToken
IsTextUnicode
user32
LoadStringW
shlwapi
PathFindExtensionW
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fopen_s
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
fread
__stdio_common_vsnprintf_s
__acrt_iob_func
_wfopen_s
__stdio_common_vswprintf
__stdio_common_vswscanf
fwrite
fclose
api-ms-win-crt-string-l1-1-0
isdigit
wcscpy_s
_wcsicmp
strcat_s
strcpy_s
strncmp
wcsncmp
strncpy_s
isspace
wcscat_s
wcsncpy_s
_stricmp
api-ms-win-crt-convert-l1-1-0
wcstod
atoi
strtod
api-ms-win-crt-runtime-l1-1-0
_set_app_type
exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_controlfp_s
_errno
terminate
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_c_exit
__p___wargv
__p___argc
_get_initial_wide_environment
_exit
_initterm_e
_initterm
_configure_wide_argv
api-ms-win-crt-multibyte-l1-1-0
_mbsinc
api-ms-win-crt-heap-l1-1-0
_free_base
_set_new_mode
free
_calloc_base
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
227KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=206, version=65501,
count=16, id=259, version=24123,
count=39, id=261, version=24123,
count=20, id=260, version=24123,
count=12, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=240, id=1, productName=Unmarked objects,
count=51, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe
- IMPHASH 04376759df9b9515a9f9fabe4dd97d99
- SHA256 1847a66b7a7ae14269589e7648a063fbe741bf172ca73b484ac6d72c1e72287b
- MD5 c80200ca7ee6db914ee94994ad4e7867
- SHA1 75e69c145b2a1b9f61710a4fdb44f2f4cea00c5e
- SHA512 a6124dda96de3792de50df82c7b7148955793a6789276db7ad8272c895203316236e242db16830a12129c186d513efa18249f8a15f227c3ffa063c0abf6d06a6
- SSDEEP 6144:kZhtoA8d2CkbjmqcqOovby/Q2cxBRuaybMpjk2xc:MHPs2vbjFOS2UBUa3c
- TLSH T147748E15FB20F436C89201B3874AA256E4BE69707F434287739C5BDCAB753D2A62C71B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
220720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\exe\Release\ildasm.pdb
coreclr
MetaDataGetDispenser
GetMetaDataPublicInterfaceFromInternal
GetMetaDataInternalInterfaceFromPublic
GetMetaDataInternalInterface
ole32
StringFromGUID2
oleaut32
SetErrorInfo
VariantInit
SysFreeString
GetErrorInfo
SysAllocString
SysAllocStringLen
VariantChangeType
VariantClear
kernel32
UnmapViewOfFile
CloseHandle
GetFileSize
CreateFileMappingW
MapViewOfFile
SetLastError
WriteFile
MultiByteToWideChar
GetLastError
WideCharToMultiByte
CreateFileMappingA
GetCommandLineW
GetFullPathNameW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
LoadLibraryExW
CreateFileW
GetFileAttributesW
GetModuleFileNameW
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
HeapFree
GetACP
GetCPInfo
FormatMessageW
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetLocaleInfoW
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
EncodePointer
IsDebuggerPresent
GetEnvironmentVariableA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
user32
LoadStringW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
_set_fmode
fopen_s
fgets
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf_s
__p__commode
fwrite
__stdio_common_vsprintf_s
fclose
_wfopen_s
api-ms-win-crt-string-l1-1-0
wcsncmp
wcsncpy_s
_wcsnicmp
iswprint
isprint
strcat_s
_wcsicmp
_stricmp
strncmp
strcpy_s
wcscat_s
wcscpy_s
strncpy_s
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
_itow_s
atoi
_gcvt_s
atof
strtod
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
exit
_register_onexit_function
_controlfp_s
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
__p___argc
_errno
_cexit
_get_initial_narrow_environment
_exit
_initterm_e
abort
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initterm
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
852KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=206, version=65501,
count=15, id=259, version=24123,
count=39, id=261, version=24123,
count=18, id=260, version=24123,
count=10, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=234, id=1, productName=Unmarked objects,
count=45, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll
- IMPHASH d792987269cb06308dbf75f94f5169c6
- SHA256 29b9b70111cdbfc46bafe00a1429f01cc6f9251afca7700c4a7d0e9b17cd5bdf
- MD5 c4dfeecb6877c1370201851ba638d04d
- SHA1 8570424e3f7d39dd8037d891dbb734d30f722aca
- SHA512 f649f0512fe62a678a70c7c71aa06b57efc3bfe20a5218c13010c4a7750d672f7b49a7be967573db8f777c0202532f0b0a0e878cd8c992808466c75c50dd7565
- SSDEEP 384:JWU23lTkOLvg/YtHvdEfEbZj8gW34OWyWbYe3jKESkYqgzPk/:JWH3lTk+LNEEDvKESk
- TLSH T161D21C1067F91614F5F77A70ADB595624A3B7D90AA71C70E074C428E0FA7A81CEB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\rcdll\Release\ildasmrc.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_cexit
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
kernel32
GetSystemTimeAsFileTime
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcess
SetLastError
IsProcessorFeaturePresent
GetLastError
TerminateProcess
RtlUnwind
InterlockedFlushSList
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=203, version=65501,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=49, id=1, productName=Unmarked objects,
count=5, id=259, version=24123,
count=21, id=261, version=24123,
count=13, id=260, version=24123,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll
- IMPHASH 7a08a43df1dd263450c1a5425087d37d
- SHA256 f87d4d6910c92ab8495d0b4dbf2331d45fca86fa5c6ef5fa9efe5658c6b01343
- MD5 1f7e9db6d2abf2c8ef8e57652728d291
- SHA1 a51717409e8c6f1738da6d495447ef2c2198aee7
- SHA512 27f1285214879c8d6258034cf172dd9f5d2da34a19f0e61ff13a10245a8f0da31423b4b9a3ac3cfab74a55bd3a6d0eb973e73a2ff93e4f84c73168d7940529c5
- SSDEEP 24576:C+yfe57XLtwfvxkHM3i3ABlY/59Yjnlx2Zo/Wi1gHYcS9vvqKuO:4w7hwHxkf3+lY/59YnlxCohKYcCvyKuO
- TLSH T1E3457D2235858836D55E02B08D3EB58F96ADB1314B7001CF32B4AE8D6E75DD2B635AF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
857888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb
kernel32
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
RaiseException
HeapFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
ReadProcessMemory
SwitchToThread
GetProcessAffinityMask
GetEnvironmentVariableW
GetFullPathNameW
DebugBreak
TerminateProcess
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
LCMapStringEx
OutputDebugStringW
IsDebuggerPresent
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateFreeThreadedMarshaler
CoTaskMemFree
IIDFromString
CoCreateGuid
oleaut32
CreateErrorInfo
SetErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncpy_s
wcsncat_s
strcmp
strncat_s
strlen
strncmp
wcsncmp
wcscpy_s
_wcslwr_s
strcpy_s
wcscat_s
strcat_s
strnlen
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
abort
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
_flushall
_putws
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
_calloc_base
_free_base
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
934KB
Virtual Size
933KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=211, id=1, productName=Unmarked objects,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=200, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll
- IMPHASH d7f1402eeabd14c4f5992750bb791f74
- SHA256 0b962100fb006469b74609e66ab182b3044519ec8be6d4792cfae6e5d2421567
- MD5 339d8f882bb7fa33ec7d73c9bcad982f
- SHA1 ebf63e40d54aac542769d3418e72bde371e6d5b9
- SHA512 7f37dbd93f2c3bb13892e2298a8da4b8858b6df15b617132cf2da87d3b584af7418dd458aec35c0405dcbdfbb3a2d464bd2d01028ff5d523f30200af2530f5b1
- SSDEEP 24576:zjKo2UQBxpa768zGFxPXwc3zq4tHTI1diI:/aUexpae8zoPjRTI1diI
- TLSH T18A256C723E4CC83ADB9F16719D1D625AA07D63314B6104C723B4BA5E2BB01D39E3CD9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
667056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb
kernel32
ResumeThread
FreeLibrary
DuplicateHandle
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
ContinueDebugEvent
OpenProcess
TerminateProcess
GetCurrentProcessId
IsWow64Process
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
GetEnvironmentVariableW
GetFullPathNameW
CreateThread
GetSystemInfo
MultiByteToWideChar
SwitchToThread
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
CreateProcessW
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
LCMapStringEx
WriteFile
SetFilePointer
FlushFileBuffers
ReadFile
OpenThread
FlushInstructionCache
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetProcAddress
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoCreateGuid
CoTaskMemAlloc
IIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SetErrorInfo
VariantInit
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncmp
strcpy_s
wcsncmp
wcsnlen
strncpy_s
wcsncat_s
wcscat_s
_wcsicmp
wcscpy_s
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_cexit
abort
_register_onexit_function
_initialize_onexit_table
_errno
_invalid_parameter_noinfo
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsnprintf_s
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-heap-l1-1-0
_free_base
free
malloc
_calloc_base
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-math-l1-1-0
_except1
CoreCLRCreateCordbObject
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
Name
.text
Size
748KB
Virtual Size
747KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=259, version=24123,
count=28, id=261, version=24123,
count=16, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=225, id=1, productName=Unmarked objects,
count=123, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/gnt.bat
- SHA256 5c9df045f7e17fa5ea221072cf191f434b14258b3c3ce7ca99b0fff7325ac488
- MD5 ad91401a2386f7cfd38473140a964c4b
- SHA1 9a070596d3da0b60deb3b2274bbdca37a861d28d
- SHA512 514b2890d8f2fb2cb62ca7c7a6c438767a48a9daa3626a631e7b4425d31178b892d071773d12abbfebbaca0ce0fbbea4e3835c17eb73fb0cfaf98f63e4d6bf4a
- SSDEEP 192:Z/FXKnVO6nVBLZiuiYGPLLUBkhPGqvinrdQAuUX2eP7x:Z/dMO8VBLZb/GPLLDhPGqmrj9GeP1
- TLSH T16D22C720764957ED0AD22B90A964725017386FF32B288C94FDCCEE06D2769885537FDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/init.ps1
- SHA256 4f6ac591108090daa99b6fdd9c0af94adaf39bc0ed9e1a2e95941c6341c4ab61
- MD5 85d6382c928ab100ed2654c798f51ada
- SHA1 f958c9b8cb5b2181473a43029a0dc6d5218b7790
- SHA512 cbc8ec8a6b9e8d783b8094134cfb3ffdfbc91fa327ce1d04fdeb61c861de11ec37d1339bd767a64cf162f23d48a04c3c1adf809df444cc52385e84042a6b2a76
- TLSH T1DBE0E751F3709B067CD59BC774C7CCC4189F7D0A52447000D05F861858DE5405B4B02E
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/install.ps1
- SHA256 e3dcded836a0181851524bc662c3374517f6aef61e3612389317a9de228e0b01
- MD5 e6a39d25b2796e4026cf70629deecc55
- SHA1 76908a1832989080a6b22614007781ef7dca009b
- SHA512 5e0132cc98ebc1e04187cb05d867739b853e3eaef233dedfb6d8b0f4726cbf6c70d98b3eadcfd5acda57d546b6597c14c7b0f605ce2f61b9994b68c93bbd8e67
- TLSH T170416515664197F1BBC31383CD41FEDABECE2A4E514E9F34F0ADD2843B0980592570AB
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/msbuild.bat
- SHA256 d49cb8c38256bf648ef28cb213b4c29ab5f817de97b8b7477810b6434768e700
- MD5 f60e619614521f618267fd5338a90e41
- SHA1 94336a59976955c2e4bc2774d08f3c3c5e11f342
- SHA512 bab200ab86bba36320a46a8cb79a4cc8912c5c466514df8bb8b36161c1d7930b5548aa50ac48540a9db96a8d57a834ec0872b60bf4d6d8c893b462ef77da2803
- TLSH T128212136014015E62E4B9FF60E70BAF1F33EC07761419E1EB86C4AE48F4744949F65E6
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51cbdb2203775f1f578b53939c843bc6a469e798fea7954daccabd45ec0cece1
- MD5 dc0914413399f9c29cda5637ee1f4c16
- SHA1 0012f717ec62b136419282e4abaf62605f2e45b1
- SHA512 c66ae88d304b205973372b5f106696a90e1aa242a9b9d6c31d6119da31067ef4bd6c2f19ca342f7fa6a1ec7c511fda6a479b413f01f581adc499afd1cef3d96f
- SSDEEP 768:WO9yZtvT62StYtXYHr3tiCB6iosctkYtNb+DGtIYtNtPXH5t0gtYfv6ct69w4e7V:vyZxaYer3BNYGGKY7vxGHP7dNaWBe3Q
- TLSH T1C7E2C51137ADA933E7FE8BF52D31A14447B6B512A862DBCD1DC5A19A40E3F804782F93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Configurator\obj\Release\net.r_eg.DllExport.Configurator.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb
- SHA256 c661ac05d38bce60a65a050b48604f9113d2e833037fa2616453b52f692bb134
- MD5 0f82fefb9b67a8912c616d367c98ca78
- SHA1 7738041a0a17f703294eca3aebf8b744f5f5cb92
- SHA512 6eba882ddf627ab458e29d448a9651860e60a2d2b51e911e0da53827a6de18bc8da255ebe4850f1499110ca966c506def0602d2e9afa0e720884903d110f54fb
- SSDEEP 384:2rPxPpRN92oMQ3NNk2ZoDA//VnVO7T4RbFd8/YL:2rlNBMs+A/lVOARbL8
- TLSH T16F332003FF40CE32E46A867562D78F3D9AB5ED848B42579F538AB15C3DF13551E82260
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets
- SHA256 93da07781b9757a0c83b3d9b6ab280281e234f0638da452b21ab7521031a1bbe
- MD5 6689a21b41f77a8ef8e645ece59b23aa
- SHA1 95d6ff3742a31453f4428ca58b2082d0250d38f0
- SHA512 94124e81c8a5f73953d12df691be08093f9a35e7f876735dc32c677cce166714c8a420997e5a03256931bef2fe7d2bf3d38b77e30a64ce681c91fd0908036ce4
- SSDEEP 96:tviQpOEiqfqUozkCCFPdZFxMWwZNwScfotWyKdnzzsEZQ:4QpOEiqfqU8c9vMWwjwScfotcdnzzsEQ
- TLSH T140B1CA27DF59B5D7398B431617A1C0852C7062B735A120D8B9AE97A07FB762001DFBE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/nsbin.bat
- SHA256 cc136ac6177b1e8ce7f1f2296a7fbd2c15d1d258d5005ec724577de2ee990cdd
- MD5 9ecd72f22fde72d884bfa628e026fc74
- SHA1 6a41f9139e1fc3924d95aa3fdad0eb15b8059bfd
- SHA512 1a891843d04d3825b75d576d276a0e83f4a05956c058b143a5a1aef049872a10a6bda1a66b68c7f7bc57d14de60e5bcca3ab62aa46fd51a2b7bb410663b15475
- TLSH T137D023C385EDD07D2523CC15E4FD74742E01F2AC021544DFF49C66AD964C72C10928CB
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/powershell.bat
- SHA256 cf597895e7d5f652ec9def99417b80c63ffb1d2a085066a3e96ffe014bee1265
- MD5 5d85a201b35b04a7a45640620ba1276e
- SHA1 c0c7dd15ae91ef356b3f00bf7e05eebdc59dcaec
- SHA512 f92339cb3e0b1d76c27e23252a7edaaa8bfc65fc443383a92670b97ec13b74cbd2dfd9a6dbde33be79739cb5bd46e921580f0ad2cfd61ec8b575a44f7c601fda
- TLSH T165F0557250280A8E29DFE27E8A4488E1B51D40838225AFE3B34EED5A5F44C49C4BA6DC
- MD5 SHA1 SHA512 TLSH
Releases/Tools/Stub/packages/DllExport.1.5.2/tools/uninstall.ps1
- SHA256 610cfd6a6f731a8e8bc1fe557418763d6f5ef6e208fbb6ee97083cc31d895933
- MD5 eeba0f996035e7a0897a1902b81bd583
- SHA1 8f34f54ac206a9a0bfe11a9f92a098f9fcb6f206
- SHA512 88da0c68bbd9e62e020a0b41c596fc9d8ce60ed612cc2eec7994a9696e4f822016162b44fe45f6ef409babec76353fff689aed88e12ef9a34b18403d3a21bbb9
- TLSH T1A111CC40A150A6A6FBC35307C984FC86BDDA2E0E2189E534F0BED1C85B89111A2A30A7
- MD5 SHA1 SHA512 TLSH
Releases/Tools/System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3fb4f972deff1db79dba1c36fac443933401aba05cdce43b163534151854c9d
- MD5 f6351347b6fe56df76804c34c9ddae10
- SHA1 a98ead0714cae67e5ef46dac8df0f7fb78c63802
- SHA512 5284550616f59a11862e9cb2447df8525883fc863e0d5e2486a339e9d9b26ae5ae7c95d32c4986a6dea3087111cf531b04efad5047577df8b510efd48d56a455
- SSDEEP 384:KVaz4VsDvLcTPWi3h8241EEtYG0u+BxehzsCtZ7U6rtk2uYycvW0uWR7wnHRN7q+:AK27TjaveEtYChzZK0+XqajQZs49zs
- TLSH T16FD23B6293F84ABBEFBB0B3075BB91D10FF5B2D22425D61E1544B4091AE2BE04632776
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3d:46:f4:51:d3:33:29:ec:66:4f:60:f6:81:fe:a5:c0:33:d9:b9:48:de:99:a1:b5:e2:89:1e:e4:0d:50:b4:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
25542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net462/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Releases/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8bc7a627149386cb3cf714ae0101f69440f72cf2e7468a677b727b32aaed755
- MD5 9ed69fbbfdec5d95ea229da3969dd77b
- SHA1 7972339f0a1b6a28a2f335c84cdfc5d9beee72b6
- SHA512 61bfaa00736487ed736a27c1a9e45ce14b578452471866d195ce1a4736e72bd4bec98938b8cbb83ffbf09cbf188e9b8760452cc95ee30565414882aadd0171a6
- SSDEEP 24576:+9itfCdSZYeP0jsLpPl44znxuhv7fBTu1Z:W5QF6
- TLSH T103355B0177E8DB37C19F977B9422082847F1D896A7A7FB5F5A14ABA92C87740CC412B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1162638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net35\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ