SalleBrowser-win-Portable.zip
- SHA256 85b2a1b25802e85b2ea98746362df55de1eef30b713a5c6992b38c11cc6051cb
Overview
overview
7Static
static
3SalleBrowser.exe
windows10-2004-x64
6SalleBrowser.exe
windows11-ltsc_2024-x64
6Update.exe
windows10-2004-x64
3Update.exe
windows11-ltsc_2024-x64
3current/Mi...re.dll
windows10-2004-x64
1current/Mi...re.dll
windows11-ltsc_2024-x64
1current/Mi...ms.dll
windows10-2004-x64
1current/Mi...ms.dll
windows11-ltsc_2024-x64
1current/Sa...er.exe
windows10-2004-x64
1current/Sa...er.exe
windows11-ltsc_2024-x64
1current/Sa...er.exe
windows10-2004-x64
7current/Sa...er.exe
windows11-ltsc_2024-x64
6current/Velopack.dll
windows10-2004-x64
1current/Velopack.dll
windows11-ltsc_2024-x64
1current/We...er.dll
windows10-2004-x64
1current/ru...er.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SalleBrowser.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SalleBrowser.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Update.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Update.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
current/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
current/Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
current/Microsoft.Web.WebView2.WinForms.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
current/Microsoft.Web.WebView2.WinForms.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
current/SalleBrowser.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
current/SalleBrowser.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
current/SalleBrowser.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
current/SalleBrowser.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral13
Sample
current/Velopack.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
current/Velopack.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
current/WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
current/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target SalleBrowser-win-Portable.zip
- Size 2.7MB
- Sample261011-rh95baba47
- SHA256 85b2a1b25802e85b2ea98746362df55de1eef30b713a5c6992b38c11cc6051cb
- MD5 e25335c06141915039587490c0bf7999
- SHA1 5a89c110450e76f8e06ade91b41d2c43100aee35
- SHA512 3f7585e4f7c7388930545e935515e5ec0912ba9a7fa810ff8aad4eb528299a85b4ae2d5f838a8b94b08773deeeb6ea5294663d17c90a1001d95a133e149e59e6
- SSDEEP 49152:7IYbvh7bBq/Ze6cmCm/27RXB91XtaPReCEPOtQU6NJaXI4ZwgzcYqE0tKt9+b7vy:7IYt/Byki27RX1daPRR6Q4jMcYqE0091
- TLSH T116D533185D4985BE2E427E74C0E88E7E0AD4F72D8B811B06D377B2EB9F4B3561212F64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/SalleBrowser.exe unpack001/Update.exe unpack001/current/SalleBrowser.dll unpack001/current/SalleBrowser.exe unpack001/current/Velopack.dll
File Explorer
-
SalleBrowser-win-Portable.zip.zip 2.7MB
-
SalleBrowser.exe.exe 414KB
-
Update.exe.exe 3.7MB
-
current/Microsoft.Web.WebView2.Core.dll.dll 681KB
-
current/Microsoft.Web.WebView2.Core.xml.xml 597KB
-
current/Microsoft.Web.WebView2.WinForms.dll.dll 38KB
-
current/Microsoft.Web.WebView2.WinForms.xml.xml 40KB
-
current/SalleBrowser.deps.json2KB
-
current/SalleBrowser.dll.exe 142KB
-
current/SalleBrowser.exe.exe 179KB
-
current/SalleBrowser.runtimeconfig.json429B
-
current/Velopack.dll.dll 261KB
-
current/WebView2Loader.dll.dll 160KB
-
current/runtimes/win-x64/native/WebView2Loader.dll.dll 160KB
-
current/sq.version.xml 558B
SalleBrowser.exe
- IMPHASH 78c016150ecdff5dc7a78e74bd2b3d20
- SHA256 2c5681a9bfd76c7e5f37df1488fea54c2e035050bc34613b58f407be4d886376
- MD5 7c18982e92380bc6d276db78c0d71aa3
- SHA1 a36415c0832f46f1b2b42fff56e9c19de6a11fdc
- SHA512 f39e9d4c994e71c0c0ed1b5e7f697975f43752a87affdfa91d2ee8112d6defe2b9a268c02830100c4b47ed7517a69798f6d1d5681c745f6534f7527c8ca2aee9
- SSDEEP 12288:6SJJkYLauS67aQ2UWIgXgCtgLz1uXe+OuhKDxiKgMZB8eSr:BuuS6eeQXe+XTMs
- TLSH T17594AE52BF40C0B7D04740719D3DE73ECB3BA1161B119EE7B3E509989E35BA04E366AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
229617
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
ReleaseSRWLockExclusive
GetConsoleMode
GetStdHandle
WriteConsoleW
WaitForSingleObject
TlsSetValue
GetCurrentProcess
GetCurrentThread
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetProcAddress
GetCurrentThreadId
GetModuleHandleA
SetThreadStackGuarantee
SleepEx
GetModuleHandleW
FormatMessageW
CreateFileW
SetFileTime
SetFileInformationByHandle
GetFullPathNameW
FindFirstFileExW
FindClose
GetFileInformationByHandle
TlsGetValue
TryAcquireSRWLockExclusive
GetSystemTimeAsFileTime
DuplicateHandle
CreateDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
CreateThread
GetTempPathW
CopyFileExW
MoveFileExW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
LoadLibraryExA
AcquireSRWLockExclusive
SystemTimeToFileTime
GetCommandLineW
MultiByteToWideChar
GetCurrentDirectoryW
lstrlenW
WideCharToMultiByte
GetEnvironmentVariableW
ReadFileEx
WriteFileEx
CompareStringOrdinal
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapFree
HeapAlloc
GetProcessId
SystemTimeToTzSpecificLocalTime
GetCurrentProcessId
GetLastError
SetLastError
GetFileInformationByHandleEx
LCMapStringW
CompareStringW
RaiseException
GetSystemInfo
FreeLibrary
IsDebuggerPresent
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EncodePointer
LoadLibraryExW
ExitProcess
GetModuleHandleExW
FindNextFileW
SetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
DecodePointer
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WriteFile
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetStringTypeW
InitializeCriticalSectionEx
CloseHandle
HeapSize
QueryPerformanceCounter
QueryPerformanceFrequency
RtlCaptureContext
HeapReAlloc
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
VirtualProtect
VirtualQuery
UnhandledExceptionFilter
user32
AllowSetForegroundWindow
ntdll
NtWriteFile
RtlNtStatusToDosError
NtOpenFile
NtReadFile
NtCreateNamedPipeFile
Name
.text
Size
287KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=141, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=17, id=260, version=35207,
count=43, id=261, version=35207,
count=3, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=10, productName=Unmarked objects (old),
count=1, id=258, version=35220,
Update.exe
- IMPHASH c06cf0cb9719d4659ab380800e751381
- SHA256 2e5571843da85979547ff6f501a9011f7c8c9a9e0b4e6b03d813291f26990541
- MD5 9fd7fb1f91b5d3cc103d590f8b76b1e3
- SHA1 2c05aba4998bc6884ae0f8cb3215ec89dce02f08
- SHA512 40330229f92bf90cb87103ab30455a55a85db8a148ab50432d67cbc355621be6217813c6636fd9362daae71e71866cdad8756f1842d9e0b97ca27d97977895a3
- SSDEEP 49152:E0z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZ5:/+v0ntHsOnaH
- TLSH T14306AE62FF42D0FBC48A01B5E42DF37D9636A2558B6A85C392A94C4C6CE13B09C5739F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2221449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
update.pdb
kernel32
GetModuleFileNameW
SetThreadErrorMode
LoadLibraryExW
SetUnhandledExceptionFilter
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformationForYear
CloseHandle
GetCommandLineW
TlsSetValue
UnhandledExceptionFilter
GetFileInformationByHandleEx
SetFileInformationByHandle
FindClose
GetFullPathNameW
TlsGetValue
GetSystemInfo
WakeAllConditionVariable
WakeConditionVariable
SwitchToThread
SleepConditionVariableSRW
GetCurrentProcess
DuplicateHandle
AcquireSRWLockExclusive
GetFileInformationByHandle
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
ReleaseSRWLockExclusive
MultiByteToWideChar
WaitForSingleObject
GetCurrentThread
ReleaseMutex
SetLastError
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
GetCurrentProcessId
CreateMutexA
WideCharToMultiByte
GetCurrentThreadId
GetEnvironmentVariableW
GetModuleHandleA
CreateThread
GetProcAddress
ReadFileEx
SleepEx
WriteFileEx
CompareStringOrdinal
GetModuleHandleW
CreateFileW
SetFileTime
FindFirstFileExW
SetFilePointerEx
TryAcquireSRWLockExclusive
SetHandleInformation
GetSystemTimeAsFileTime
CreateDirectoryW
ExitProcess
GetExitCodeProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetTempPathW
RemoveDirectoryW
DeleteFileW
CopyFileExW
MoveFileExW
CreateSymbolicLinkW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetCurrentDirectoryW
FindNextFileW
GetFileSizeEx
OpenProcess
GetProcessTimes
ExpandEnvironmentStringsW
GetLongPathNameW
HeapSize
TerminateProcess
QueryFullProcessImageNameW
VirtualQuery
GetLastError
IsWow64Process
GetProcessId
GetUserPreferredUILanguages
LoadLibraryExA
VirtualProtect
SetThreadStackGuarantee
GetConsoleOutputCP
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
GetConsoleMode
GetStdHandle
WriteConsoleW
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
OutputDebugStringA
OutputDebugStringW
AddVectoredExceptionHandler
HeapReAlloc
SetStdHandle
DecodePointer
RtlUnwind
RtlCaptureContext
IsDebuggerPresent
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
EncodePointer
GetModuleHandleExW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WriteFile
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
CompareStringW
LCMapStringW
FlushFileBuffers
ntdll
NtReadFile
NtWriteFile
NtCreateFile
RtlInitUnicodeString
NtOpenFile
NtCreateNamedPipeFile
RtlNtStatusToDosError
NtQueryInformationProcess
user32
EndDialog
AllowSetForegroundWindow
SendMessageW
combase
CoTaskMemFree
CoTaskMemAlloc
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=33145,
count=145, id=261, version=33145,
count=25, id=260, version=33145,
count=21, id=259, version=35207,
count=18, id=260, version=35207,
count=50, id=261, version=35207,
count=27, id=260, version=35220,
count=215, id=1, productName=Unmarked objects,
count=24, productName=Unmarked objects (old),
count=1, id=255, version=35220,
count=1, id=258, version=35220,
current/Microsoft.Web.WebView2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24b1a6be3a7956e00d0509d4eaebf08e418fc219e964b6c269d2e04439333685
- MD5 ae915341870f891f090228905277064c
- SHA1 749ebcdf4be274d7777124bd081f093403941cce
- SHA512 aa3f2efed0a7e91dbfae414f344f41ca8a5ea5ab05d93436526c6360676e962969e1f29c3e05d428de07571bc5e774cd091af05d5fd3826f564ffcdb4f56f0bb
- SSDEEP 12288:GJ4dCXzRKX4EcJupbSRi461R1VDrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNI/:GJ4dCXzRKX4EcJAD1RvQy
- TLSH T1F9E4301223FD8619F5F27FB9997412609BBABC97BD78C34D0698642D0D72B819DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
71:ae:24:6a:34:9c:85:3f:fc:49:ae:88:50:38:db:57:dd:2e:e6:b2:22:6c:38:db:65:ff:5a:fc:ea:02:57:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
694098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
670KB
Virtual Size
669KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/Microsoft.Web.WebView2.Core.xml
- SHA256 8684cd74000c77533e563785208308ada63808da85825206856cab11a9eeffce
- MD5 7dd42e989d935808c75959bd93f04429
- SHA1 2183623bbd7425551b98814e4a2991b3742e2f22
- SHA512 8caaadcc1cdefe5d152c13097dc1bd345b7cffafdf5108f099791e45d9b6384af2a4d680f96f6d2a9e594fa6138894c080273022a99ad270f53a4297d90b8282
- SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+ju:iNTkqUCnCsi
- TLSH T1EDD43001668CD6310DF50BCA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1AF591
- MD5 SHA1 SHA512 SSDEEP TLSH
current/Microsoft.Web.WebView2.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa6b956e42cbc9368d57e062e819d1dc65bdea5f67f3bbf2c004c3e88a3c222b
- MD5 67d687e9756f000f5fd4a70928d1495a
- SHA1 5263bdf3260fe95ad71a5cdaff3bb2b85e287669
- SHA512 475fb6a0bd25e597b21abbf3f42f8d698fec2f1804550d0e6ffa472c4d42b2d5b5824fdac131d8548e1f9a1030c3c4c9c3aca5ae9025c555991f13764834e22c
- SSDEEP 768:JcaNb2/itGt3JrbYbSQzZDgcEST3p4Jjrjh2je+SG2au8vxJKia5/Zi/wGQSxKFH:Hb2/D8mQzZDgcEST3p4Jjrjae+SG2auD
- TLSH T110033D4083ECC527F6EF1E78A9B486A2077ABEC37DA1D7990DC5F0990C7379056213A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d2:00:50:39:a4:36:15:99:01:fb:88:9e:8a:13:fc:01:03:34:0a:cd:1c:57:28:39:5c:ee:7c:3f:c0:2d:7c:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
34394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/Microsoft.Web.WebView2.WinForms.xml
- SHA256 6a8ec199373824fdebceda7b3d780d0b31c82edceae04d92391027c971dea6c2
- MD5 2d0b324efe8342a0897839ce920b06e2
- SHA1 bd6d049a42e9ca3612c2bf050ae3384d543adb0e
- SHA512 a038256a72ceaa5ea63ad5192598330f478a3cce56db89608f5e90779e8583ab97b151a0ffbd7035768e5a1f8f2d03358c17740bca769e4f63a1f1d5e535564d
- SSDEEP 768:3OsdyK4aSPgPxW3uyCG4yCGdryCG/L+GZiyCGRL+P1xb9zU4QPgcRJFXCfPgKehh:3OsdyTaSPg5W3uyf4yfdryf/LzZiyfRP
- TLSH T1B9130C01A28DC72249E21ACE19B0E4D4FF2D677775D6EE11384C4B560F73EB0E2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
current/SalleBrowser.deps.json
- SHA256 1d48f6b3ed5b4fc41f1c7951b1067edb928a4c9f5a8b93f0c13eea23ed0df185
- MD5 26cc7a0c53c6c6d2be7061de895476c7
- SHA1 91156b611a437eb0e7b344d317f946f56f7ea601
- SHA512 e93026d0f3a62d65f5d07e4a123331bebc978edc55794fc72c5123b89d06ccb3306780295999a4c2ca4928a3b6c9fe285f09b78ef3dc9b3b6e070a93f66e0b23
- TLSH T16C515616E4648C2704716BEA94334AC1FA2A237B10412E9675FC555CCFB3FA7A084F3A
- MD5 SHA1 SHA512 TLSH
current/SalleBrowser.dll
- SHA256 acc0dff436b244547d612653b74754c5f5e944b57ec168af04f51ce00ce4bedf
- MD5 d70b8d4b29bcdf245a2b486811628597
- SHA1 991834d895ef6e47c9c4fa04c742fb1ce0fe58ad
- SHA512 49d011236a486fae0456f32d5037e5687a015dfdab4163e0d8d6e9eed9bce3ff63f3bd861b1da4e119b15e0189e12b8d8931bf34343721241431664f6d02f6d1
- SSDEEP 3072:RnxCrbScVCZTf1KJPAr77m7ea5ceA6j3DsjFf6Tydx7/n/Kdydx7/na:BcyXD1KJPO77m7ea5ceA6j3Dsjp6er/1
- TLSH T1FAE3AE6133BCC92FC6BF95FD513541510BF29693A222EBE54D8930FD29A33A0A5423DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Repos\SalleBrowser\obj\Release\net8.0-windows\win-x64\SalleBrowser.pdb
Name
.text
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
current/SalleBrowser.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 a6b11b2a8030fe67366727d0ac66073e30581a65da9cba2e32cb1dfd9099b2a7
- MD5 83d8c5240118abfb4259ae758898567e
- SHA1 e87bb9fdd11e355013e9b8b9dd0b578f6631213d
- SHA512 646a967403c61c3dd98f22ec2b9bf7e531e248057f38cffc499b0763a7173e4a33350861aa00c2ad63c0dfb156e62f4c706419b780a7d02be79fe3b65f91bd74
- SSDEEP 3072:8qeXA/4yIg9vkNPNu6H6xCYOiEUE265tJ/eHydx7/nB:8vgvkNFNaxm0ENJ/eSr
- TLSH T1DC045C07E6A850BDE1B6C679CDA24D41FB7378598B71A6CF03504AB61E73BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
current/SalleBrowser.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
current/Velopack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
- MD5 2c29bf1bcfe53f779a9f7d785601dc8a
- SHA1 21d134bb5661ebbb4819500aaf829ccfa024a9b4
- SHA512 3acfa65169390a7f9af8ac66dfa9684405bcfcc4e61fc04df80ee3bfa25bea4bc8a41defd7fb9290890285172a97f663d95774a59e274fbcd1f8b5f44d533692
- SSDEEP 6144:qo0g6Hxg1smn4oGalxcB+KQwCyknZylyZ8Sru:qLgAiWHoq9CykclyZz
- TLSH T17A445B0037F48716E2FF6F79FCB0600686B5FA07B8AAE75D0A8458ED1D633509950BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
272690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/build/obj/Velopack/Release/net8.0/Velopack.pdb
mscoree
_CorDllMain
Name
.text
Size
258KB
Virtual Size
258KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
current/WebView2Loader.dll
- IMPHASH c0d801d5bafc25e481c3643ad4c50c86
- SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
- MD5 cce1332e0af440bc54fdf04eb543d4a0
- SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
- SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
- SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
- TLSH T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f7:6a:56:32:d8:b3:54:15:87:4b:a3:e9:77:16:02:e4:c4:2a:3e:ac:50:c8:9e:bb:f4:b3:6a:c0:77:fb:1a:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
current/runtimes/win-x64/native/WebView2Loader.dll
- IMPHASH c0d801d5bafc25e481c3643ad4c50c86
- SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
- MD5 cce1332e0af440bc54fdf04eb543d4a0
- SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
- SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
- SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
- TLSH T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f7:6a:56:32:d8:b3:54:15:87:4b:a3:e9:77:16:02:e4:c4:2a:3e:ac:50:c8:9e:bb:f4:b3:6a:c0:77:fb:1a:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
current/sq.version
- SHA256 133c0ef40d6fad53b4d830db19bc5192127574c4b36437f440424967e2a2cf18
- MD5 ad59851cbacacbc26595c9d17090de0c
- SHA1 4a1ae202442d6024f81a449b11c8aa300f2a0500
- SHA512 44ddcef3bf5a124cd4a2abab55f11f72b6110b0616edb9103b0cdd687a430cd3a1be50016bf45928fb11cc1fb583594a34c6f687afb414e4477bc663c1a41328
- TLSH T172F0E185E804FA0681B1138490D18124B3AF7A6F24CB4650D9C58C5E218A1CBCC1E979
- MD5 SHA1 SHA512 TLSH