86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d

resource
86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/gafn.exe
unpack001/windows/bin/service/GafnVpnService.dll
unpack001/windows/bin/service/GafnVpnService.exe
unpack001/windows/bin/service/YamlDotNet.dll

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 86e76349651c2008e4fa59b6d8411be833cf3b56923f5525eeb24b3eff760d2d
MD5 0525a8c7da934bfd281219f13232e1b7
SHA1 44dd95d1fd5475870e812d265b00a9cfbd387f30
SHA512 0ff9b988f04ccd217a0bccecbb32b52a68d56c593cfd81fe204c88b4e2f9d82e39f068cd27e5b91968e8ccff97f073da56712e4bc9ec466ad528d6867d03bbe3
SSDEEP 49152:toAMRFjec63fslZDP0O0Gdk0BQzGaIDao0DAnkTqFvw/cjRAVlXe/6D2LxR:t5ql63+Zzwl0BaGVeAvvwMU46Di/
TLSH
T1AEE5339080E051E3E7ED0A362F6AC0721B46166E47978B09E7357C1FEC23256DFBB295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

gafn.exe

IMPHASH 9d9933e13174f652af3223cf9dacce47
SHA256 f0721f9f746fc3812bcac94490792153547ead8584cf9b7f3ff717bf8b1ba72e
MD5 b8ce796e78f4b383de45b4c25aad4657
SHA1 ee05bc0ed4bde9edab64862f7f6a8612a590ed62
SHA512 f6508def1be7a6c22120422ac6b19f4411ddd31c30723886d02d4d1dddf62635f37bb3c75621448ebaf40d97e7d61a354ca082a58e293ede2fc1e86c6ae307ac
SSDEEP 49152:TmmdXV07evBdA+hzBTo1qfYacrta4QWJB2e+SYhdhGLKsu2Fwa6pXbtroIlwrXtD:bqQyYxsB2e+SnC+g6/X+LlaUJr8hxSC
TLSH
T10B8618057F8A6C99D0CDCC70C24B8BA30E1130DB1A36F9AF89D616192F7E6B55F29358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5366816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gafn.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtCreateFile NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion NtDeviceIoControlFile

kernel32

RtlPcToFileHeader RaiseException SwitchToThread FlsGetValue EncodePointer GetFullPathNameW SetLastError InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx lstrlenW GetCommandLineW FreeEnvironmentStringsW GetSystemTimeAsFileTime SleepConditionVariableSRW GetEnvironmentStringsW LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW WakeAllConditionVariable LoadLibraryW RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber SleepEx SetHandleInformation SetFileTime GetFileInformationByHandle FlushFileBuffers GetSystemTimePreciseAsFileTime AcquireSRWLockExclusive CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW MoveFileExW GetSystemInfo SetWaitableTimer GetFileType FindNextFileW AddVectoredExceptionHandler HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee GetUserDefaultUILanguage CreateWaitableTimerExW CreateProcessW CancelIo CreateDirectoryW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP CreateMutexA LCIDToLocaleName ReleaseSRWLockExclusive FindFirstFileExW FindClose ReleaseMutex CreateFileW GetModuleHandleW WaitForMultipleObjects SetFileCompletionNotificationModes GetFinalPathNameByHandleW WaitForSingleObject CancelIoEx WriteFile CreateIoCompletionPort ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateEventW GetModuleHandleA Sleep GetExitCodeProcess GetProcAddress CloseHandle GetLastError CopyFileExW GetOverlappedResult CreateMutexW DeviceIoControl DeleteCriticalSection SetConsoleTextAttribute GetStdHandle GetCurrentProcessId GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetUserPreferredUILanguages GetFileInformationByHandleEx InitializeCriticalSectionEx FreeLibrary LoadLibraryExW SetFileInformationByHandle OutputDebugStringW OutputDebugStringA GetCurrentThreadId LoadLibraryExA SetFilePointerEx ExitProcess

advapi32

CloseServiceHandle OpenSCManagerW QueryServiceStatusEx StartServiceW RegGetValueW RegOpenKeyExW RegNotifyChangeKeyValue RegQueryValueExW RegDeleteValueW OpenServiceW RegSetValueExW RegCloseKey EventUnregister EventSetInformation EventRegister EventWriteTransfer

shell32

ILCreateFromPathW ShellExecuteW SHAppBarMessage ILFree DragFinish SHGetKnownFolderPath DragQueryFileW Shell_NotifyIconW ShellExecuteExW Shell_NotifyIconGetRect SHOpenFolderAndSelectItems

ole32

CoCreateFreeThreadedMarshaler RevokeDragDrop CoUninitialize OleInitialize CoCreateInstance CoTaskMemAlloc CoInitializeEx RegisterDragDrop CoInitialize CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

SetPropW MonitorFromRect SetWindowTextW SetCapture GetWindowTextLengthW GetWindowTextW EnumDisplayMonitors MonitorFromPoint ShowCursor IsWindowVisible InvalidateRect UpdateWindow EnableWindow IsWindowEnabled GetForegroundWindow ClipCursor GetSystemMetrics GetClipCursor SetCursorPos IsWindow RegisterTouchWindow GetAsyncKeyState AdjustWindowRect RedrawWindow GetWindowLongPtrW SystemParametersInfoW RegisterClassExW RegisterRawInputDevices SetWindowDisplayAffinity ReleaseCapture TrackMouseEvent GetKeyState ToUnicodeEx ScreenToClient GetKeyboardLayout SetParent MapVirtualKeyExW GetKeyboardState SetCursor GetTouchInputInfo CloseTouchInputHandle GetWindowPlacement SetWindowPos GetMessageA GetMonitorInfoW LoadCursorW FlashWindowEx SetWindowPlacement ChangeDisplaySettingsExW FindWindowExW TranslateMessage DispatchMessageA EnumChildWindows AdjustWindowRectEx SetFocus GetWindow GetMenu GetWindowLongW SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC SetWindowRgn OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo SystemParametersInfoA ShowWindow PostQuitMessage GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu TranslateAcceleratorW ChangeWindowMessageFilterEx RegisterClassW GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW SetTimer KillTimer DefWindowProcW SendMessageW SetWindowLongPtrW FindWindowW DestroyWindow CreateWindowExW PostMessageW GetParent IsIconic

comctl32

SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect DefSubclassProc

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

gdi32

CreateDIBSection CreateCompatibleDC SelectObject CreateRectRgn DeleteDC BitBlt GetDeviceCaps CreateSolidBrush DeleteObject SetTextColor SetBkMode CombineRgn

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertOpenStore

ws2_32

freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt getsockopt connect ioctlsocket WSASocketW send shutdown recv WSAIoctl getpeername listen bind WSAGetLastError closesocket getsockname WSASend

secur32

AcquireCredentialsHandleA QueryContextAttributesW DeleteSecurityContext DecryptMessage ApplyControlToken FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp strcpy_s strlen wcslen

api-ms-win-crt-math-l1-1-0

roundf floor trunc __setusermatherr round pow

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment exit _initialize_narrow_environment _configure_narrow_argv abort _initterm_e _register_onexit_function _initialize_onexit_table __p___argc terminate __p___argv _set_app_type _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc free _set_new_mode

tray/menu.bolt.dark.png

SHA256 23941c46da58ed2b4bf3c3a0986597214a5ee96771a2292f8ca1ee29c3bf65fa
MD5 d407cc6d530163641d26c0b7bee9b1b1
SHA1 8054704a770fefbfa67df67660861cb0614b8d28
SHA512 8ffbada0f619ac8292c9e54e5c1d4efd7802041db9d3a9779b4d35dc3aa6ab59ef77cf81c649839c76e1aa5876b4ab8ceaf22e70f7ed681e7af2cfcd2483de6f
TLSH
T1AC3174100CA044B2C5CB86314CD90605A9B38843A9CBE54BF3CDDE2B2F40AD661EF286
MD5 SHA1 SHA512 TLSH

tray/menu.bolt.png

SHA256 2eaeb1792be22505069f8816513000f471ff8ee6be054e5edd6f7a04a281971c
MD5 c61713b8aab5d81d3abc055c6264130f
SHA1 a05682510596c009d89988c2d6b2486f30f62969
SHA512 4b737bb4913fc04e5a0c25441b035fa750f54f780c3ea2cb18a7b86e9ff5f6dfe5af21117aea6e3703ada1913f54f5dfada488e606324a44a380680e6750e954
TLSH
T1DC3174118A5010F1C1DA56314CFA4609A67B8C4256DAFBCBB28D4DB19F08BC519DF68C
MD5 SHA1 SHA512 TLSH

tray/menu.close.dark.png

SHA256 44e15a2d3e3b09f6124a2573ec8a57d9ca2f6618580783f96b39328b27638b74
MD5 bd1c46c6b4d209aa4d556f0a3d51d245
SHA1 08c6636e5e091eee0f152806a353e53800f89c74
SHA512 e9dcde82ea40faa04ca53bf0ee004057f49b6970a55225f38ddb2a42aa5669ac581d285ddfb038819e927b5026d366c02d3d5d416fc8a4493ab650feddb67d4c
TLSH
T19831A3514E9010B2C3CE19759CCA0B057737CD42A4DA9A4AF78E5D620F82A4865DF3C9
MD5 SHA1 SHA512 TLSH

tray/menu.close.png

SHA256 f06872288161b5df028c4eddee7bbc40f07c46d89f90a62b44135f38cfc7e9a6
MD5 744dfac8d16f2f13bd4ea9fcdc655109
SHA1 cffbc9eadb3a653f684750b2a3c03049f7729c43
SHA512 381277666e103c8dbf9176eac541ce5eadfca57547e6a7ff7510efe33da75e4a319e66002ba5fa000fb2d7aa42e6f7fb53264347e2022bb703b190b27550f928
TLSH
T17931B7420D6550F1C6C256324CD28B05EA7A88529EDD868BF35C9D271F00EC895DF2CF
MD5 SHA1 SHA512 TLSH

tray/menu.plane.dark.png

SHA256 6b13673a9584b2bcbc0d62a0525b8704fbe281a67dccc38cf75f5a011ccd8a6e
MD5 921fb2a6940336edb4cdee8eca789e1d
SHA1 8550150ef8d1a2eff5b93edecd9f315f2d9a64bf
SHA512 c2ddf37a96a83c87a3e4692c2deddf52d036bfbe404102a54f25a7d8e8db4a63a7a9181d378ec4ddd62bb881c2494b722a54ec8edb3a7ac5cbb534d9c8e5b632
TLSH
T12D317471261050B2C1CE56328CDA4B0AA9B78C43A6DAD986F78D4E5F5F09AC5618F3C9
MD5 SHA1 SHA512 TLSH

tray/menu.plane.png

SHA256 71efe003973ed18f22a58eea01b192c2dda62671adc2ec87ecf1237f86d93172
MD5 7ef3b4f45a2c5a3ebd3cf01da27b6821
SHA1 c640d13e1b742af097e47b4a77411ab2b3da28cd
SHA512 09d14b4d5ee4cab4a7ec49ab9d3629d5344284eb3764e1de8d7693d508acf27610656c20770c30005717cec79899a7159943dadab8a9c05de4ceaa2421e1157e
TLSH
T1B63144720A6020F3C5CA56318ED50E09DABACC0295D9DACBF68D5D271F04ED4249F68E
MD5 SHA1 SHA512 TLSH

tray/menu.power-off.dark.png

SHA256 d656308abbfce13a41f0647b64bee21112b6df8b08c087b0a4ce0fafc3e2c1e8
MD5 79c63b17129aa7a33c6be2d013b10f65
SHA1 f7b9ea509931264e6846159dd8210bbdf437e26f
SHA512 356c4d52fcf34af7d3e3fa38cbc7d04c8634eaa5e3c6c2374636bb2b28d5be28e841470e1c7a0cd878f0fe8baecb132848eaa4fb2e1fd184cc76357aa3b256aa
TLSH
T13341D9528E9014F2C6CFA7314CD80506FA6A5043C9CEDA4AFACD4D762F0458813DF28E
MD5 SHA1 SHA512 TLSH

tray/menu.power-off.png

SHA256 0a89a53b5caf5a91f8f81486cd33b73a72ccd9ae92a2f33b976bce2a6cfb96a7
MD5 e842d5c6463121990d5fcfd1ed191855
SHA1 0a6387986deba9d28911407f97bbdf78a1df4738
SHA512 a8ec13eab93df831e9764813a3364d4dcce1b51765dc82f3b8964474ea5c9e2e9f796a603dcf1a231a35712403062ef686f2c46c169814272cf0554910da3fb5
TLSH
T16F31B8109DA160B1D6C7D172DCD60A00EDB289028995A98FF38C4E5B7F086C519DF3CA
MD5 SHA1 SHA512 TLSH

tray/menu.window.dark.png

SHA256 eab66ddcb45fc63aad1a6860e642c4be63e8ab40373cb8e7f78750c7d4e8db75
MD5 a19503cd4077ca2b0a19d592138f6aa1
SHA1 bb200caaa1a67c769b46f66f562db61747b4059b
SHA512 efbd62e82cb9fde4eed4f30f3aac0ebe8a3b1c79a5865400794272eb1e190d793d846b2f666f6139d81c214064cf72ef91439848b2ca9a658a4e654bb1a7926b
TLSH
T1EC2165410E6020F1C2CE42314CD60A0EA9B6C852594DED4FF74D8E2B1F819C429DF78E
MD5 SHA1 SHA512 TLSH

tray/menu.window.png

SHA256 a4347a83a7407a9235b351e49517106cea93b1193bae16ad07368ecc7342d649
MD5 de14fcf77dbc169f20c839141759fc57
SHA1 7ccafb3628961e31404788e97cd4cb169f6cf5f1
SHA512 50901fd661a47c0e0b7ba2bbc9592706e6b5febc17b31bf4760c9496b57fd93e6362744c975193790a975a0723ee6f7136208592942ca6d16c4c0bb646ab2559
TLSH
T14C2165A109B400B1D1CE6A350CE30A06EE76884265DE994BF79C4FD95F44A8974EF3C9
MD5 SHA1 SHA512 TLSH

tray/mode.global.off.png

SHA256 5e106f1d8a9e02a55eb6f8b09d6a510c06a8e04f5e28b2737be1b5bd21aca79b
MD5 b726a1de3df3cc438d42c236eec3a3e4
SHA1 f1787c405feb5f1469286f58824677578017efbc
SHA512 5c0aa5d0ab6ae5dda279121b3f8bd6fb155f023c63560b382b2779bbc834faa3eedf4d8a530cc1270d5ffd50f5b477d8266f9f784f50f654a604a32bebaa00b0
TLSH
T1211163D6CABC2B3896A8EA2395C8A2AB0A5F1257510B4BC295B53DDD43E66A814002B0
MD5 SHA1 SHA512 TLSH

tray/mode.global.off.win.dark.png

SHA256 4003db58784107a4ed64533385f79380634f81c2bdd96f026f510f4760fd3f8b
MD5 b2beaf3e2372042a4ecf43afa213db51
SHA1 8b28537fb364d60e11d29f7a4181b634ab2275cb
SHA512 870488aa12b97e2d7e5d8cb11b4a02609d56b2ac175525b2ebf15c53e10d59c84a198916c4f5a54dad178a243355853552d5269385d2567a503ac03411d93ec0
TLSH
T1FD1196E60D1C8F7BE85EF517F01E4770D921345BA216DF4C789DEE44D6025C21381257
MD5 SHA1 SHA512 TLSH

tray/mode.global.on.png

SHA256 32b18756f32d849b53966b813502a5d3088ed085876a2007e70662171c588cae
MD5 9e50266c687885579273a54d3c394556
SHA1 2b767bc0c2ff6ae4362c493aea5bc6c4531ddcdc
SHA512 6f9142c874dfdde90d8f1d8a65e3b38b9a92e88440e767272b2e5ebab28ca08a27a42961feb28770d6c00ca0018a536d5de59e529ac9bd338f3c64a9442f25fd
TLSH
T1DD11D8C3321EBFCCAD97B411F987741A1D59705165B2F5C87C106F1AC44AB5EF880A96
MD5 SHA1 SHA512 TLSH

tray/mode.global.on.win.png

SHA256 aab61550aa93395b35077401bcde4068f382614eb68d31e9b40031f8bff4f6bb
MD5 38aba29e4f7293c5feb16e668384da7f
SHA1 b49829fb358e13b179500d76a4aa0de9fe6e2ae6
SHA512 83acd73bd2baf622ef972b88b82ace3e85e40b531e745a4930aae2ac0b802de6b8ecab59e77eae8226c54f1cec77a202fb124023f85acca43a11b6843ac24416
TLSH
T1D3210A439208ABDC46C863B16E9E4D38EABB387C353DA329553B3D348339176483D163
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.error.dark.png

SHA256 a951ee0b56c7bdf8005d03638277398c755841cb9798dbb379dd38714a12109b
MD5 3c85fc71dcfd6dca09137e2b1704e646
SHA1 ecff0e120733d5452af8d26c6657d900e35c35b0
SHA512 5bea7b62b2bc82bb842ff94c60268d821ce4eaadff0bebf717329d7dc30f87126fe8407d2ac7093d8d1f57868d758de0063131565e819be0f594d942465f5295
TLSH
T13F21EA1942707DB42D8B359749D3E191ED7D52748F9B5D08DA009EB09CA3E4EA000B32
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.error.png

SHA256 f34921480aa3f915a175bf946026586ef4d92050f8c619c2a03697f4e2b3c9d5
MD5 113b930b7211fd450a70faaaad9c2194
SHA1 054da8349eb68560bc1cb120ba470633c55641ee
SHA512 a5fc7d6f29aee2b784f0d595a9bb732c62de45e959ee5f7ab24e83c16924d5c09af9b23cd1a3f14f7de7c8a7c295ef22020ea421b2ed8909f1a28bd50ecbdcfc
TLSH
T1D221E483E3C43AE4BEC96403C93E0A259608ECC1E0C3D6A180BEF0F3A099A529965035
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.off.dark.png

SHA256 f854a6c88beaf7f25457ee5d4a01040fa4d765bc44d8e6f93ebf9f5decc844a3
MD5 85c868576023a378c9d4877d1befdc33
SHA1 b6dd19ffd0eb358daa41c167da31aa3d30d28e2a
SHA512 b3656676b0db7e7c04b820fc4f489898350d1904dbc4ddc57c7af93b6bca1d94753cec44a68dcac2b53ef81400e17f7e3dfbfa5cacb3fd49f818246d28d6320e
TLSH
T18C11A52360844E71D381B03FAEBA7851DE36D205C86A58318CA1AF9CC79CA9C5260276
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.off.png

SHA256 160aafb49ac776f92b0e9c0be49a92aba2876ad84205bafb8014143421dd0ce9
MD5 06e075809da2f4d00412f078b5a4b139
SHA1 94f563ed9bb8913bc65a1bd263b77eb95ec3ea10
SHA512 99483ac4e4581779ffca21e900055bdd8cb85cbfc41ddae5183eec47c79310e3f490554ae7dda7743ae6c28bc4f24af1bf3fa7c4020e377d35c4a93257fe486a
TLSH
T1DE11CCEBD07B328DD816E5F427517A52301137FE7719C34D84547C736E4D54B2200C66
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.on.dark.png

SHA256 40c427050e9062f04f8ef6f2b79dcf281c539faa9eb2d78d57a82db60a960a0d
MD5 f799b5170d28c6eba9473500b4fdf0d7
SHA1 501d2e2649ab89166cb0be8f45971877331bc947
SHA512 424cb62559351e9f9d270850169157c59ce9224587ea27d390c44ba5b2a052818eae9b9491179ed9dd1461a1b87ea7907ff1032dcfc95a43d9b1e994265ce5f5
TLSH
T1EC21E7ED1B2DD277C5808E3313142EA66C6352C93CB423AD87BE737D18B86264E56362
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.on.png

SHA256 6ae9888984ec17c2f601841190e03b5230f1358fc27b8fa475aeebba35c4246d
MD5 490e1e44687b38efd96c4913a46e2cec
SHA1 257159410aac42923a65936b78742e35bb1ea51d
SHA512 0799d941ed06d6ead1da22bfd0054adaaf6fda374adbfa9fd6e1fc30c565c45817eabfd6012e111c8d9741d0953158c989b37dd359eeac6c0a8b7b3b90784452
TLSH
T17921B7DD32007F475FE0AB06C1F065A43AB16B048B22987A049AE118C2364DAAC58A73
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.pending.dark.png

SHA256 2cda0fbdaf8d552b243c31541e80b9fcee35864d4ed315b7a0eb26c3fcc84216
MD5 b3c736421192058859949f9ce604572b
SHA1 94e6931d1fc0cb2ba4a53fac2057e2e88ab4c4b7
SHA512 72040a3c7c1d5a61ad0a315612e054201326535640fafb89124454821b51b96877456feec73002465e3cfc53f8c4bf3daa83a4d2498221a01ccb5fabf4fd2656
TLSH
T1B221F80B80B8ADB19C0CD5E2102D29B0F69B97B534C117F8328A959524DA038BA6C3C3
MD5 SHA1 SHA512 TLSH

tray/mode.global.win.pending.png

SHA256 7f7c235b0da008f068859efb7e2876fa2de03fe1364654168cc9826bd47208fd
MD5 efcd6258fd2f15bcc89a3b1837fd187e
SHA1 cdf6e0c1d5ac4a50f51b9369f3eefa02c7fc54b1
SHA512 71458f5da0f8e7d6429e01e4389c7454ff677a248f7dd1de757bf18518219bd7ff89e0d63d788092dc4c7508d23d5d4c78d1293a5f160af84ea15149f2551070
TLSH
T1D821B7B247C6E4EAC1D13828A585437A43EE4ED1B152B37D1DCC0D6D5E1B01481ACC62
MD5 SHA1 SHA512 TLSH

tray/mode.smart.off.png

SHA256 0e3834636b0afd9e746942cd44e5a694cd97e0c954231fa4bff70d907c53995a
MD5 8a7c7b58344779f979be449b080fcc2f
SHA1 9ec40f1a363e349f3b20bdd882d100cee15435de
SHA512 e9bb617e941236fa8ae039fb1c9147adad03ceac8a2cc2f5d417d304607a66dfae164a836448aa9f320ac7b796dbacddcd5150bbd9c02fb945b6ca6ce4a8a1ec
TLSH
T1480183C6A2BE755DD044821679E6BF364C5524F46326800636FF6EAED68314C7208349
MD5 SHA1 SHA512 TLSH

tray/mode.smart.off.win.dark.png

SHA256 30b50840f5c31f4721f679816a38cb9eb48c66ec2c041a418310d8e81f0fb63a
MD5 e80984b7eef11e1c4fd5e3d75fe8d059
SHA1 d67b5bf369d57d38855323fbc3f34307565dce54
SHA512 42154d10d6557df93f6bddf7cfcefd20012c3c8bbbb612c3c5252f0cc2a50a59f41bc8f374184fdcf9c5fdcfec23720f85963bf728fd9d0f46d09dcdf7237831
TLSH
T18E01D8DA732108CAC2CD85061DC15DFD94AFE60C298348030245BBB81C0D0058C819AE
MD5 SHA1 SHA512 TLSH

tray/mode.smart.on.png

SHA256 71f1d56e88f8e5ba8a4afbc81fa92444b09629f3301b46e7a2fc7d87ec187c2f
MD5 2fe301c2c4c62db674367955b74e8339
SHA1 cb98206d93d4e16c0998fbc963fa96521b5bf209
SHA512 6cfb2cf31bf4f69d6e95f5bfea41b95369d975fef0865a20c6c312a826539c152520460a7496ba23004b936f459733f677f97417f06ff5fa34e4d48f273715f8
TLSH
T126011EF357C9F2A0A6ED4FB2DDFE158085290795650F334887066BA67DBB44808FCA86
MD5 SHA1 SHA512 TLSH

tray/mode.smart.on.win.png

SHA256 faa133315b5df6bb2c44ac7207645c90e75cb1978527aaa6e7deabbaf3977526
MD5 7c96bd2c538614acef940a0da7827c69
SHA1 efe559e4a275665beca221ad8b261b98c2999a02
SHA512 8e13b99bd7cf0c8bcc12358ef9fdbccb2f4f92ff8c36b3ce61366ece1a786678cf5b98058008d1230bbd54f1f99f5d6a881add5439f5a7dfb3b20fdfa90a2dd0
TLSH
T1D41156D3FB8C74B7C75D251154F69F14889F1221C3AF51957628C20654F84A81CFD872
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.error.dark.png

SHA256 56ce4e802894c7dc4d0cdfb55dd9cb3288e8aca774703a0c53221188f12e1190
MD5 65c365cb5793e5983961d14091779cd6
SHA1 fffc7a0900e2c2e13bddb1cc33810ec16adc6e56
SHA512 46244187b7719e1335ca07ef9541110e86373ca8966eba16e6826ed2dc3438d8c3fc7846acf9ee9e128adb512dd400f70b85d844808407385af4b6d8127a82b5
TLSH
T1A911D893C409B9A9CFDA0130FC8DE2B26ABADE67623F3F1C12455D4844936A8C89C759
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.error.png

SHA256 d6e2303a7ebcc8439fb6f3e6707cf456709dae5ff63014046e753a3dc01d4799
MD5 04cfccfc1c1061bf7787e9077b107d2f
SHA1 3f417cf544ca68dd7d9e78f2811e87c545866ca9
SHA512 9daee58cb8eaa94197c10082fcd5801b8d38bbe669dcd2c9934d32c096a2d6ed7179df851e75f0d06303be1936346f1d71a89646e1a086c37f0a869ba5e78249
TLSH
T11B11B9B586445F3668F9D622762D085759D183FD182128D1741FEE764077AC0B1A1531
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.off.dark.png

SHA256 4c15326e492b44aff8fd91bb7811e60fc9553c682d430afc85bab1b3a10ab19e
MD5 2b43294079581ed7bfe9dbd6db52705d
SHA1 8a80340b7a4a206adb1188d6089b4a8e02c49e18
SHA512 7724f300b49d4e3ba37a5cf0390d20ee6b4299e93d8e6da2f41d827c9f0a4f53a73e038a6fd7dea978f2efe012edbba8c4669f0a5b72f42781bfdccb683762f4
TLSH
T13C11DAE22120D730C9500235FDC677E84459677A785FCFAD0163371344EFCC6AE05049
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.off.png

SHA256 7e430d4937598b52af7bc59e36fd281b19e4eeb338de0e87b7820d459a6b0782
MD5 fcbedeb2767c7751ce9819d611ad1e95
SHA1 8360d1e7aadfc87542727eb29149cef3c9570c2e
SHA512 61ec801f171bf7339e0a961ef2662ae8b67da36ffdff68ebe5f3c5595fe87bc3ff2589a718181436479b31eeba5c1272b93bd619e4d36f27bc517fb0440332a0
TLSH
T1FA010AAB232D4C37F870F00C673C4B1029201010B885F04D690BC710B23C3CCA10BE18
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.on.dark.png

SHA256 9f2eb9d4313cca3694cc40c61b235e47bff4a0a95ab9bbbe0e052888befb2325
MD5 167c267badc7d72a246b9eed3d412fe2
SHA1 19c5d688fdc7285b54cfbfa7a5f690d45dbba0c1
SHA512 c66920966e3b156fa5d7c71d3ce7749491565362e47833a7631de9b94de1d7ba35448688f2c5fa1fe04c105c6dbca4fc2f7d31668be3dd7beb287646cde733d7
TLSH
T11F11D8E693C21D7DCC281610C64C6D04CA7A484351249B1EBC8D8B3A2B17D06BE32B4D
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.on.png

SHA256 b0e87973c6c7acd8cf8a78e60f9bb29c3d16cf50704cf15921d8413d803ff89c
MD5 8cbfaf4fa51b22a275e77b98ddad939e
SHA1 42cd6be568d04864a7b2709d27be87f03b3ab80f
SHA512 6dfa725c9c4ab0b21823be3f82764119efa5c4359af345b38bb004da0eac234f027fc0d3c0ee72f6ec8cfe6ad08049b4aa0fd950b4868d689122cf61a393ddce
TLSH
T1F611840ECC8A6CB4E1848044E2FC4A29C29689F361C28301D42AAE26FA1A82A2D6D053
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.pending.dark.png

SHA256 ab8935cb4e89a4e8e2efa42c602b5f2736128b24531162ebfa92a98d16f48d1d
MD5 161a9ceabadcdc93ab6d593f12afcf50
SHA1 2f770e212dd6fbb4ab6404363fc66a428261be93
SHA512 11c8a69702e413df4f2e45f15005f01ec531fa125fae9ef8b2430fb9f3316bdf1236214f9da30194b9ce9633493329da564be17699efb481ea839098d5490e5a
TLSH
T1B11172C658E4B1C67118AA2332D546AA0DA3DE7046DC032F2D6EE3000E42DABBD735A6
MD5 SHA1 SHA512 TLSH

tray/mode.smart.win.pending.png

SHA256 99e54e5d2674910f120074cc9511841f3b0c11ed0ce410feecb93ae9673024db
MD5 a1959c60248d2ffc7d4bf5896edb1fb3
SHA1 2a2e8d37169c504b032968b037b090e5e8d8e0f2
SHA512 fa0a213cc6d006e844b602ae326ecb1ce279b2c8c61427d3b4e3c0c8ea0406c6897f44769e02899226ee35721e036bfeefebfaa1d28cd72fb69357629433ae3e
TLSH
T1AE1148BFC0484A76417BF030E14595AEB5E65682470660BC5D57F0141D97BCD8CDC565
MD5 SHA1 SHA512 TLSH

tray/mode.split.off.png

SHA256 a9a85bc23d48ac75d63ce8ef01558f0dd7c49d258dc202850995b95cb579498b
MD5 c81c1b85fc1dac10547167c3ce0a9823
SHA1 2fc6e9f260d3ec775de88af1c930d5508d5be008
SHA512 ed9ddfc869e29f30dcee7d379c63e1f013672a86ad460788daa254a4fbfde8f0b11830ce6edfa57f0d19ec7e26500e772a66cbbec61fc4ea7428e8082ac1c4de
TLSH
T184F047CEC1FB00A8DF0573199D7620A686553605722254B3186637D5536B29231C79BB
MD5 SHA1 SHA512 TLSH

tray/mode.split.off.win.dark.png

SHA256 df43c2ec8479c900dd219cd6f202b4dd8f6a445ea658e0a2cb1a83e7b833a5cd
MD5 29f610ea19c93c65c990dd3b438b2750
SHA1 86f8bb15347ccb3acbf5d85d286cde4c388b238e
SHA512 09083f7a4424bc5024928afd7238dd574b2dc32d39f7651924bfade48b00e4101766e2a25e8adb3e5f3cca005635eda8db3dfb4cd4757d61d37c9b331c0c216d
TLSH
T1ADF047477D8424BCE535843F34102A66266109D410A156AC42E35524B8AAB0E2842972
MD5 SHA1 SHA512 TLSH

tray/mode.split.on.png

SHA256 a66f5b8e069ab12444b8e0e48f7ce0f86d41850a9110ae3489b2d9bc827bd093
MD5 ce58008df53b8379b3048de295ef040a
SHA1 c9fe18456051cb3d99cbfb6abe2bef2c2400d97d
SHA512 d0ce4bc6213127bb3332d596b17e3d0929e81fe5f9aa01be48cae249dcd9e0f0c9ba8b2d7684586b4a0a0f3f95f14a7eb19ae95ba76a7ee10f94f94b2c87d3a1
TLSH
T1100175C301F999009E3D9FA198EB5282086721FE0166260174034D001BDF4E486987BB
MD5 SHA1 SHA512 TLSH

tray/mode.split.on.win.png

SHA256 bb8321cd382e8142b424ffdc6c57e888fb5306508d1369764b2add518430fbf0
MD5 dbfc0e65f58e98dc7fb4cc241f0e5acc
SHA1 d109991595232dca2df94a2f3e6a954f7f7a5e83
SHA512 b6bcb3db467faf1ccc369ef9c514c764dda5cb46eae8d2af18ee305a4281184c36ac536378bf0886312134ce82aab872f18d455118b8244c64ca6135aa091aed
TLSH
T1CA01C5B63B6D9DA8C5088A6CB2E1C9A83C2B0A104983E20D0A2ED23829100D97C4D4C5
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.error.dark.png

SHA256 289c509c36b7e46199e52580e0ec02a3c56ecb961fa65fdcb4543c3ff4728751
MD5 0af10f5dd9abe4dc934a9a30b22c0855
SHA1 c480b54a8e09dadd3592edda1e958bae51bbff16
SHA512 ad3e108e29d3bd7292bba4be0c49d131280ff40cbbc1e20891329c833ff92f257cb72f26f5d3d6e95eaef9f76533c056469ae54de6438d0191e35fe81337618d
TLSH
T1CD11A88F403333E2D4AB056331B4AC363D87ED2C5055C72EB2D9E9F8210CE1942C4203
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.error.png

SHA256 21d0b51e957ae47037fd2b5e14bf6c9b9e097856bda4a99258553daa7fe7c8e4
MD5 be153bcc5965dea9aef2b7d3c3e36eb5
SHA1 def164e00010011a6aeeeb3b8f8b30ea2f5730e2
SHA512 130e1bf27bfac874be8723c685603b81ff0261cad81f7cc52cf2f80742acc565dee2fb7e2f058467f5dcac8ce5e38ce1eff0c825f50669c860dbbca4cc48bc37
TLSH
T10011C8554F4AFC90C47F4A227DE91661B2C26668D534C107B9468BC61A21795C82FB00
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.off.dark.png

SHA256 d11596b9f0cc55cde30ad47fd62c07095ef41779110b402b523a505f8ba736bf
MD5 3766dc273b3bd52021cc3cde9ab9a63f
SHA1 15b8259afbe016fa6bbc45b1f55ba030f805c284
SHA512 78b1d0dad5c5c5eb02a4fc114c22acb4c5e3fdad75365793e599f6574011c02c1d354310ee9fde807612310a2b454a3b194d0c8ac30e5fdbcccfff047efb3218
TLSH
T16401BAF13E31D1F95651C4916B071BB1D55DC27D14A65B03C4EDF326FA7424841FD209
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.off.png

SHA256 c8ec13bca82db22dbff2723dd30ab643748ba6152a3a300a30305f6c43553f03
MD5 5616ba6e5696682659c6616bd690eb46
SHA1 21725bfd92f0bd15ddbd9e51ccd8ec25ac851033
SHA512 528889c36669589bfb9ea7e7401fd58d8cf3c573309ee3aec02e68b21a3307070218e131570bb01996f8303c94d235d3158fbccf0ff7aa127fb720a3e2add911
TLSH
T1410115A61DE0EB36499F8F9313105448BAF06114835BDA9185F87FAB50B3F38F5523B2
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.on.dark.png

SHA256 e7abcb366e94bfe0dcd06c383bc7672e14f38326a0f5a8a22ee2bf25a90a9997
MD5 dbce06233dee50d79ac1ddac72718723
SHA1 c4942137b3520911278c35f08153cd83bb5812ec
SHA512 9eea97d40ef1abbbd26a19254d45fabdb140bd7a036389f888fe1f5d4354b2e71e94bb2dd1642a1b8ec0752ed12f748815b96264b503c875e425ede48627fe12
TLSH
T19511B5D742B46236C220FBE49ED52FD7A0EA419E5B209C447C78EAE40B661504CFDA12
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.on.png

SHA256 f69564473fdc563f1f35382b5fe43a60c703a289792cc3c9d639d7bbfef85ae7
MD5 a7c1ad1eb37943421647b076082e738a
SHA1 10ae5e8b6ddc81462d5796de0b34005ba1aa7b59
SHA512 47ee342ed536519cb0f0257566cd069a775a460767d4dc4f416b22315c35d4fabf3d8228e7cb61990594cee43ab10823d48a63f37278d0644eb69092ea4d08da
TLSH
T1F6116F63B222C9DFC0E51A32983E9BD2241729BBC20644B9C72DDEA3C6E564994846C3
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.pending.dark.png

SHA256 4f98c408386466f4f171b58d25d679863c0b2b1602eb05ff1ce522f0bc5f032d
MD5 fb9873f47a01721da6f7f8d3597d87af
SHA1 f27655af4ea80faa66282cee83040bfc3ace04d5
SHA512 99fe9892f304c5d04fa424b6fa745eeed215deb39c5b4a8da1e931737b4f7c0c69829b3a6deb44cb1ff04d972c4b464910e7715302f267ff4c37ac8d66f36219
TLSH
T1A011B593B5C4AE786259743105BE2F0B846B1F8E4E41FC8C4ED06936110403E2696497
MD5 SHA1 SHA512 TLSH

tray/mode.split.win.pending.png

SHA256 60a223daf70db4f21e1f5d48265e6d9462f2a27d4f36a16db1944216a6d37e16
MD5 25d2202e80baa2bcfdfe383f979ce371
SHA1 6da631729bbed8bdc859d890e9f3c5bae8d0b49c
SHA512 06f72e82eb507b3d218d769abe6e6ee7f9b12493b282e302a0f2911a5f74c03b52501647915e095ab9ca60bc919941bc63a0c1ab4cad795171a4e0af057060cc
TLSH
T1EE11670F22F7071A47C0793DD8BA13FB39B1495E06E81FC2A1644952228295554CB8C6
MD5 SHA1 SHA512 TLSH

windows/bin/service/GafnVpnService.deps.json

SHA256 e57a5fa14206654ef5668388eb41fb9b14c7740f6d6251482b863cd513b6cdbb
MD5 1fadba2d1a12b7545fe6b800defa1b52
SHA1 a2aaab4c266b901a79685554cf23277d0d937ada
SHA512 6528a6593593ab315eafdc5dd777d9683c1ac704da25c374a674f5d38a2d231c4b1848ae79fe7308ce3fc53d167102c5ce635ea1106dd52b12e8b125258787ea
SSDEEP 192:QA6JVc7uV1vLVwaLLV0eBElPzCcTH6oU1z4DlGX0Yeg3FUbXNNWU9I:QA6EWFBBElPzCcTaal1hIUC
TLSH
T17DD20425E8485F634076FB99EDB94942F63943BB2104654A7CFD240C8F76BAAD093F38
MD5 SHA1 SHA512 SSDEEP TLSH

windows/bin/service/GafnVpnService.dll

SHA256 ddb46b9c892450b7b1711ed14d0a8c802a7aab21bc71a4d633f8b22d7a69df8e
MD5 1a540eb68da2a51b27b0e42d24141d2d
SHA1 cf92a1c850afe31efd6a6ed519271c5dc6980bf5
SHA512 705e0f0b39bf8928405eac61743d1a9dc10c6cfddfa1093b1841768cbf8cd84bfdf48fe816d6e3ca46c5c0707b1b64b60d2b33b187e91b8a7286b312f50661fc
SSDEEP 1536:FWdnrM3ZW3b6w4GLcZljmuafED99IX2AK8W2TQrftx3dmmzPEu534yQttRA+iutN:FqkkcXPLbmmzPEm34NttRA+jnlki/dL
TLSH
T13683184467FC0A1BE2FE2BBCA87056104B76F5566573D3AE0E88709A98B7BC08D11773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\HosanZoeng\Desktop\GaFN-Tauri\native\windows\GafnVpnService\obj\Release\net8.0-windows\win-x64\GafnVpnService.pdb

windows/bin/service/GafnVpnService.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 9466af979e9143424fc8632e6e9db6118b94aba2233c4e03b83484188d981088
MD5 e9ef1143f3769edac9fc1500089a65e0
SHA1 1604d3e7f00d9ddb2cc4f1d422cf6489d9ec7f86
SHA512 19fc71a3a6869bad472a7096b2a25de26c2d36387b468b756b4fc671683706f5130ad6d03d3436769107c92ee402d9e1d4f5e6fac4e1057f1a4f1a0dfa96905c
SSDEEP 3072:mqeXA/4yIbHkNPN+6H6xCYOiVUE265PJj:mvdHkNFdaxmVEvJ
TLSH
T1A8E33B07E2A851BDE1B7D679CD924D41FB7278598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

windows/bin/service/GafnVpnService.pdb

SHA256 a24a0d43da01f2daa628bcf246993660f9fc587cbfd05c28b7e27451fbfc39b0
MD5 e0e2ca2546eb780a1664a40c250f44ca
SHA1 4e6d920a6ef98027b7840a8bde78f9fb7d36717c
SHA512 d8698aacac7c45dfb9aee5744a5b0388364150c064768b88c24e028905c6702a34017c806abbef1d39cabfdc9914ff27d16e1e8895e876994c3c168e7f891e4c
SSDEEP 768:1CanW/hWCRSqLZmS98HPxVbnTFp1HWVtDsxj9:n6hDRjNH0jTF32mR
TLSH
T18FD2E72B9789CE12CC27567698A3C048B634C2116706DF73F6DC75B9D8AF7C842B72A4
MD5 SHA1 SHA512 SSDEEP TLSH

windows/bin/service/GafnVpnService.runtimeconfig.json

SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
MD5 253333997e82f7d44ea8072dfae6db39
SHA1 03b9744e89327431a619505a7c72fd497783d884
SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
TLSH
T114E02664CE006CA701FA727FC531C183EB30632700101891B4FC080C2F775B50112F5A
MD5 SHA1 SHA512 TLSH

windows/bin/service/Microsoft.Extensions.Configuration.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
MD5 e1f852e450395bd9cad83625ca41afab
SHA1 8a5c6332c4208e319e648c8850ab709c82efe48d
SHA512 54fd5acaa24c426b42aee7b855b6614c9c1e2676d0f54683d4a2b059db7c9bda70988c6ceb43f488abc34759f575cbdb75c3f0649cf932cf5fa2f53a66cf2881
SSDEEP 384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
TLSH
T1C1C26C6953AC9327CCAB1F71F5F1D4412E36E7E27811DA2E589EF1090867B805B32729
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

10:09:ab:e1:b5:83:4c:99:94:8c:ac:96:f2:50:8a:14:09:22:55:a6:a8:83:92:e4:51:da:f8:96:a1:8e:b3:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.Abstractions/Release/net8.0/Microsoft.Extensions.Configuration.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.Configuration.Binder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 beac12f7bba4e22cda2acd9ddfe944a4ed56abec414e084edd147bd5dad3c032
MD5 1900efbf41f8bb57151cc942ef2a1222
SHA1 8afa01360292efb640900a6cbcfad40b7f815776
SHA512 eeccb907965099846c684fe1584dab1cbf74f0810ac89806827d85f0f456221fd42f0ec27197e9314a76e3980f3e2ad441d889a6d7af042ac8258207bfec46c4
SSDEEP 768:JrGlacqrCJ6PTbIQG0mVdrxzMBnW+e9z2:Jrf3CJ6fIQG0kxzMFW+az
TLSH
T1E2134B1657E8C326F9FF0BB069B0E4954F76FAA26426D61C5C8D605D0C777808B223BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a4:72:a5:36:28:95:8b:81:4b:40:f0:a8:6f:f2:31:05:7c:d3:44:97:fd:33:c6:75:5f:f5:48:dc:9c:7b:50:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 13, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

36634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.Binder/Release/net8.0/Microsoft.Extensions.Configuration.Binder.pdb

windows/bin/service/Microsoft.Extensions.Configuration.CommandLine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 688ef791d4bb2e84839cfb28ec83772d561d958f6d0b20ca28be1c6efc9ea5f7
MD5 2ebdc0b72eafb372036911dbf7ea1a9e
SHA1 b4ce3f14ddbb8c0188c2f0b2f735512f3789df8d
SHA512 82ae8f62c6ea58eeb54e116e8258db90db55f6c376ef572f52b580194d5974ad66cf1c62b329a322d681a937a4214b67f9b4e273335a90db662f3d7c55bd0517
SSDEEP 384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
TLSH
T10FB25B5697FC4217FDB70EB0A5B0E5452E39AB93AC21E62A185EB10C09B37804F7173E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a7:44:d2:95:7d:c8:35:37:5a:02:00:a7:2e:20:b1:e9:fb:48:df:ac:c9:f5:f5:ed:70:3e:1a:30:7e:6b:63:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

19206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.CommandLine/Release/net8.0/Microsoft.Extensions.Configuration.CommandLine.pdb

windows/bin/service/Microsoft.Extensions.Configuration.EnvironmentVariables.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 797b3034fd173caff0850cd580428a5f4aeb7da27bf03369ad7f2b0996019399
MD5 5636d243d19d4d7506cb8844458c3bdf
SHA1 4575623dc6fc5c43718657e9c775cc2b48830155
SHA512 b2176fa42bb1f20477102a1119adcf7b11c7e85dab1b5e6c937c5dd94d9e3068d8bbed7326d5c7c78a81f4705d3916a9d807e2522db75ea8114c05d52e55fd09
SSDEEP 384:gSz0UpsW+K0ihWQS9WUPeWVC5kHRN7/NNPR9zbKmhBP:gc0ULPUrVD99zbhBP
TLSH
T14AA23B8593BC8202F8BB2B70D6F9D5622C39FBD26811892E155DF10E1C67B94CB61B3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

10:d1:49:61:a3:94:22:a2:b3:01:e9:f2:6e:33:e9:64:0c:2c:f7:f4:c5:ac:d3:76:43:78:eb:13:64:a8:cf:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.EnvironmentVariables/Release/net8.0/Microsoft.Extensions.Configuration.EnvironmentVariables.pdb

windows/bin/service/Microsoft.Extensions.Configuration.FileExtensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 acf5896d0f34fa1a43295797584b3805c24743ce25ee87538eeec83b012bbf4f
MD5 286b788d46e6b5379db22454b505bb7c
SHA1 43ccaf65099f28cb93716dd9d16f0ed4043b35c9
SHA512 430b62f8d74bd28b0eb1e80a6f956c82a1e57abde6995152cb745a619bdc872aaa2b5fcc0f4b2b5bba35d3b871604f911eeacd21f97d478cbb5cb8542be8ebbb
SSDEEP 384:U1LlqiKysfF+LY9PLIMXABPJqWqH6WIdX6HRN7G2MR9zFTY:kUiTQnwxsstWGn9zF
TLSH
T1A7C25C1287FC8213C8BF1B30F9B4D5465A35A7D76811E56E599DE00819B33C09F72BB9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ae:78:59:dd:a2:33:04:1e:6a:d4:e9:d6:4c:24:3a:4f:f4:e7:fa:11:76:d3:b7:e2:6e:01:4f:d1:dd:1b:df:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 13, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.FileExtensions/Release/net8.0/Microsoft.Extensions.Configuration.FileExtensions.pdb

windows/bin/service/Microsoft.Extensions.Configuration.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 15e1262880f263806a2808d750688739662323b20ccd9835222fff8c30899a4a
MD5 38eeb1691c133b414ea2061720c574e6
SHA1 263001a6a631974cf87c908a058941af79f5711c
SHA512 550404cd20978d8607efd5ccfda035f77b48e40a272f95323fe60a39c029d71efdf63999770ad221cadcf1ed5d9630762164533d66b9bd5e9f4146eac35331ee
SSDEEP 384:z6J1o5QgFMvUo0e1l6QUWkWJ2WFYA6VFHRN7aU9WR9zGZzP:k1sFMYhudFClA9zqzP
TLSH
T18BC26C5593ECC327E9BF1F3095B4D9452D39A7C26912EA1E099EE14A08773C08F3271A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

b7:8b:94:72:b1:ce:48:a2:99:f3:b8:46:8f:6f:4d:63:0e:0b:40:de:9e:72:ae:82:01:a8:f1:96:35:9e:cf:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.Json/Release/net8.0/Microsoft.Extensions.Configuration.Json.pdb

windows/bin/service/Microsoft.Extensions.Configuration.UserSecrets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 206cad6a76676e1fe74e12cea23d92aa7ae3eb06217315617f6f267af1383e58
MD5 a01648a8751dd427461fa3fbd8096441
SHA1 f34c91eb09ecd37f35145defbdd6d10a88699919
SHA512 fc1cc0e36ca0b8364c5e06a8433a67ba219e2f52edfea74d104a39de9ab5d50a2864ffeebc53ee2803d799766314d05ac29dfebe7e32a5db030cf1b2e658f362
SSDEEP 384:R/sfDn/NGfzRxL1iF0gzE1L/W9yVCWVYA6VFHRN76l9WR9zGt:8lGlxc8NhFCl6y9zi
TLSH
T145B25B8AA3FC4322F97F0E32E579E4455E39BF969C12A62D049DA00D1877BC4DB31729
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c8:03:ea:2c:40:f0:42:05:c3:e8:80:10:d0:c8:cd:64:91:66:b0:b9:06:4f:12:c8:18:47:5f:29:b6:10:b8:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

19906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration.UserSecrets/Release/net8.0/Microsoft.Extensions.Configuration.UserSecrets.pdb

windows/bin/service/Microsoft.Extensions.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5cd9da2c3364a5b201cecb0c80e25227d27ba44d96343d2894ff8ef3fd81550
MD5 ebf181ef6f8cbfdd9149d9d609059051
SHA1 05cd721a76c1afb00df1b6417e6b8b1a7f344e67
SHA512 fa2f59833721fb50500d89ae5a3c8c7474e247a684440c01bd30d46a8962cbcbe8f216d41bba9ebc075ac2e1ee19c37a46d0e1db922db23a3e261b5c68155877
SSDEEP 768:MLJOZTEW1WTsTeVnrI/yqCtHUafO+ukucyOgn9zT8B:MLJOpEQzTp/AX2+uMyOg9zTc
TLSH
T1D8135D5A63AC8B2BC67E0B76F5F0A9451F39D2477912E71E4C9EB09609273C04B1273B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c4:3a:b3:d3:0e:d5:ad:dc:9d:49:6e:3b:dd:11:58:29:b9:d1:52:56:a2:4c:27:11:4b:4c:b1:c6:4c:24:ba:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

38762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Configuration/Release/net8.0/Microsoft.Extensions.Configuration.pdb

windows/bin/service/Microsoft.Extensions.DependencyInjection.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
MD5 e61d0a82bb0deab84b3c1e75df6f5b0b
SHA1 f1b7207ffc54183e96ad1da76401f896a030dea1
SHA512 0f3cf57fd108ef397f510e6635dcc16568560c6d40600d80e27d2976d172b3ad8f43bc1970c771ca772090169333139be9ea00118958e1fbd47db395088b28bd
SSDEEP 1536:+DHW/pHp2Dp9edpX0Pnaw2oR7uhQDt8TIg6dKdQ1W6azK:qakQWDqTZ6dEQ1em
TLSH
T185533A6473F8677BCBEF4A70267650204B74BE471043F7163A6AC0B519A3BC84961EBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

aa:df:2f:2b:17:a3:42:1d:5e:18:c3:34:5e:02:09:6c:6a:9a:88:9b:4f:c4:3c:61:8c:7a:07:fd:2a:fd:1d:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

58106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net8.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.DependencyInjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 158761ce778e799949f3a3060c461b1055bb35f1f5a65eff0e42397849f09ecd
MD5 ec9754049bb1b696f4fdda765e55dc73
SHA1 8a06f022eb13670a06138811aa406177867253ed
SHA512 ef8f997221049a3c8faec3cfe3ae62fd689e60b3c675da2b7eb2f9740519a2984ff199e882931bc05ee9c8c884dce09c624e6f3684c7e456172cc7c0f1b78dd7
SSDEEP 1536:HikoH+bvkw5ZSHZrt1xDtSN6A3vMZ+t5TvZdGpNeCWWo/Ep4zB:CHH+bkwU5rW3vJtvZdG6CWx/Xd
TLSH
T151935C25A3EC4B26EAEF1574687440004FB5EA9B3103D74D6E94E4AD1EA3FC14B712B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a7:73:07:21:ab:c8:10:e3:f9:bf:c7:ee:54:1e:f4:6f:23:f3:b4:bf:6e:b8:04:be:d6:fb:97:b8:09:41:c4:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

87694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net8.0/Microsoft.Extensions.DependencyInjection.pdb

windows/bin/service/Microsoft.Extensions.Diagnostics.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9864dbcfdbfe395bbd64deec7568fdaf0cbc3850f0cd8f53e7359189bd158082
MD5 8c79f5fbf8ce8eb2dd851dea54735d1f
SHA1 5ad81d2a8e2e0fa8d44a5438edf9d834ec0517ec
SHA512 d4bb78fe5e191a9fbf42b1259d1267e205e5e59c3e6493ec18270dbfeea30e0c617447ef67c2df93e48beca85f995c20a093deb3a52dbcd4ee112001a708c069
SSDEEP 384:tzVZvGPhQTlrYouEsdS+YlOjqm6t4BWOXURWNYA6VFHRN7wsjR9zDmEf:tP+5QqnHNfG8FClwsF9zTf
TLSH
T16ED25C91DBBC9326EDBB1D31A6B4C4411A36C3976800E76E4DC8D40C1A33BE49A71B79
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e6:3f:db:e4:c9:40:70:14:8b:75:75:24:7c:56:9e:ab:b3:60:ec:d2:71:ef:c8:b9:b4:af:d1:ba:db:6e:a3:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

24190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Diagnostics.Abstractions/Release/net8.0/Microsoft.Extensions.Diagnostics.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.Diagnostics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 31e08b4e0018ee136d65dfcca8f655a1a74cf8841e6029044c99b2e75d5f59f0
MD5 85093d346f4610957b61ede039e2b51f
SHA1 870bf5320c82e509721f20b1ac541165a4a460ed
SHA512 ab445d141e79d710a2598562217c1a9964404f765eaee7d4788431ba96a24e772f25523ff3f6dd659119fee4ed4b39fa5a7da1d7980436bff5a56c9f109738be
SSDEEP 768:BCuMWVBZb1mpK3/uTYBmJf4zFClZF9z8u:BC6Ip0XWwhiJzX
TLSH
T1FCF24C5AB7AC432AC8BB2EB4FAF0C5422B39C6D36801F7595DDCD0990C677D44622379
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e9:b1:77:98:0e:f0:41:00:0f:7a:9d:51:cc:08:3e:e2:6e:98:6f:14:c2:6d:24:d6:dd:77:35:32:33:e4:ad:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

30418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Diagnostics/Release/net8.0/Microsoft.Extensions.Diagnostics.pdb

windows/bin/service/Microsoft.Extensions.FileProviders.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f08b1f597abb3647ab6e844282ded763e6078dbef6dd54b9d956ca419fac42fe
MD5 504acfd4f683b6f4859d240c1f6cd749
SHA1 ae54915150997136f132bf61bdd9e7859f56d9bb
SHA512 a05f8507a8830ac33c45942bae06c49a23242f35b4c01b3d677f8fef0199c8cdbd956967bb73374bc52956d3bbfc82d422885800006c644d4c4aea4717287239
SSDEEP 384:ggH8Tv2So+MVV1CMHWs/hWuTb2HRN7TI+R9zJKhJ:ggcTvlGFtr/iMi9zEhJ
TLSH
T178A25C66DFA88362CCFA0E7064A4CD473D3DD7E75801E92E0999E1091EF3B849631B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ca:62:a0:28:57:c1:57:55:ab:fb:19:cf:e7:b5:7b:82:0c:c6:99:c9:ba:3d:d8:af:3d:92:2a:2b:f8:f5:ca:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

16714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.FileProviders.Abstractions/Release/net8.0/Microsoft.Extensions.FileProviders.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.FileProviders.Physical.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f67076c79a953f5068c0792114f9722527cfa17ed7414c73fd14833bfe59918
MD5 08ac1d14ad47498891953e40909fe293
SHA1 996492040743ce3af3734e07ed1610a6ab4ff375
SHA512 0a108f138dd52bb47892d836f0d54eeeac00e9218abc02964316e3bbfad25d54b095e4c7d7d676922246ad42998cb37745c7ce9cf4a7e0c30f7742d37d89cb08
SSDEEP 768:/0uMdRozKWWyAWxcnuHeHopdtU6LCxZF+dD/ic9zxz:/PMSeWWyZcnuHeIpdtUxZF+dTiUzR
TLSH
T13D138D22A3EC4317CAFE5BB029B0F5460735F3DB6102FB5E1D59B18A389378457606BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

51:3a:7e:3e:84:b0:9c:3e:37:12:e7:e2:42:8a:d0:6c:13:0a:81:9d:50:68:ea:91:47:4b:3e:66:36:cc:18:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

39594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.FileProviders.Physical/Release/net8.0/Microsoft.Extensions.FileProviders.Physical.pdb

windows/bin/service/Microsoft.Extensions.FileSystemGlobbing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed0855b522f09b5a9ddbb85de62042c25e07d10044086da8620c845de41e473c
MD5 470ad714b6cb486c3a64a918e72497a7
SHA1 13583e2627ff47fa64c192d8f91e06c4472e6cda
SHA512 6237af61b1f592fd10692906024fc970cd41f3db971c2a869aed392ad686a904edb19dae81cc247b691a26a7e5e554affdf0853b1e29938d6cea799e20343c77
SSDEEP 768:m0PO7gRE3x5o7UP04wqgYtqPRw02KO7I9Yfwbhgv5NFcEn9zT8n3:m02GE3xOwP04wqgYtm2nQY4Ngv5NFT96
TLSH
T1CC236C55E7AC8327CABE4B78B0F4A0400A39D667B422F34E4E8CF6895C737809661777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c6:c0:04:e8:b8:38:31:86:d7:d4:7c:ec:98:d3:30:16:4f:e3:80:1e:c0:6b:06:10:42:91:c4:af:d5:cc:61:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

40634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.FileSystemGlobbing/Release/net8.0/Microsoft.Extensions.FileSystemGlobbing.pdb

windows/bin/service/Microsoft.Extensions.Hosting.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27f074952005f74ba37fc62756690255e5f743ff3f7426fcdeb65a0d6ec9ff77
MD5 4ae388e85a11208237ac6bafe218a321
SHA1 3bf99d2f7efa643bb4cd3b4e2d132539060b4878
SHA512 4b998257efb7689090806f1741adb8fd986e1be424b91e8c9370fbd9586e234449b8f01b634813c083c50b342079c79f050f1183470e45cabf2bd42b182fd902
SSDEEP 768:75xwFYTqU7GjPb6viCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt164yCmi3FbQY9zn:AFmqU7GjPb6axWFvTbQY9hiwzN
TLSH
T11833C64163F85225FAFB3F34B8F891658A39BD56BD34E62D058861DD09B3B80897073B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

6b:a8:2a:13:71:4e:7d:56:82:08:24:b3:d8:f9:bc:bd:74:10:da:b8:c6:8c:d0:4e:a5:56:35:8b:a4:1b:57:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

46374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Hosting.Abstractions/Release/net8.0/Microsoft.Extensions.Hosting.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.Hosting.WindowsServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff86f44f29d91df5a23ced211f19d20833e689eae30b2cfe023dad191494fba2
MD5 4526216f1669bb5baa83cb88822d9f63
SHA1 8414f35d5dfb034c8a07b479a258f7e6f3e75e63
SHA512 e45075ddfb15095aa2c7758784eb29d96661d55edd8589a0c6aa77bdec76c596b497e091ef70097d51c1f2b3bec36a1a7df0c1e8dec3d709b12324f72b807c1c
SSDEEP 384:Ib+w5ay/tkWwsiIYktF3rqaJ1eeRl9I0W7B+HWvX6HRN7vrBmo8R9zrvpa4P:qNuXYeXknloWv9moQ9zFP
TLSH
T1F8D22A4487B84353EEBF2E70EDB5D6451D39A7865801FF3A0AC8E0491C9B7C9DA3027A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

5c:10:ad:91:03:73:12:a6:ef:5e:25:80:7b:19:f5:27:71:e1:b5:06:9b:0d:5a:59:df:86:ac:db:be:fe:1b:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

24998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Hosting.WindowsServices/Release/net8.0/Microsoft.Extensions.Hosting.WindowsServices.pdb

windows/bin/service/Microsoft.Extensions.Hosting.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22ce5576adec386f12cc92de15b38c85405995b4b0e6f610a00c918a72433f62
MD5 801c62d44095eafb0243ae19a57ffe91
SHA1 d6978dc2b7a3b4628d1d703cb9b365674ddcf0ab
SHA512 273697f7b18cdf1ffe6786a381ff99043657055bd58fb9c971802ee3fcb4059985d2eb10b8bfc8dffa223e5d43d16f9c63258a006bd191f17134ffa694312b86
SSDEEP 1536:Xxfx+lXPSWgC1Rp32bv6bbP75Sjhi09zS:BZ+p6AHlbbPcjh9m
TLSH
T1B2637C5253BC0713DBAF5AFAE8B4555A0A32974BA415F70D1DDDF0A808E77C00B2236B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

b3:76:e0:e9:67:df:83:86:d2:9c:d5:b8:85:89:10:b1:e4:58:bc:42:b2:de:d5:71:e6:46:f0:ff:f2:22:e8:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

67434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Hosting/Release/net8.0/Microsoft.Extensions.Hosting.pdb

windows/bin/service/Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 45c22524218541717e4a0ade36847c1cda4921f5945b4975a1c78ddfe023d0b1
MD5 ecebc7bc0237ef9ed6c12b9c6a38d757
SHA1 fcb5492a4880763e727b5a5ba0156db023bdb2b9
SHA512 ca7392ce00dc5bc4a7b16022324a53ffab30cbf62ec73bfba8387667371e6a8f097379b454aa2a308d5b294ea85c8b90e447844c250c19e1863cff0faec17d0d
SSDEEP 768:mz7ouUrbVozuvO53ReiJdelmwSroV4RJJq5OkGkJJQiY2hsUBaIFClG9zu:1uOVozuMRhhq57QeBaUiSzu
TLSH
T133537D159BDC5377CBBE4C75E821D5834BB8D367A402D35B3CCCA428681BBC84A613BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

03:db:7d:09:08:1b:6a:73:a7:e8:64:11:fb:a7:a6:99:24:51:e5:ec:b9:14:51:d1:35:1c:8e:f6:9f:56:33:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

59538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdb

windows/bin/service/Microsoft.Extensions.Logging.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 372dcb44f6f9243346cb82db99bb01f27a0f3c8019902481bd45d65c311a732d
MD5 01a8c2ab486e995ee7ca23d4f786c9f7
SHA1 e6a68e5dc64c327efaaf95c88e1c8bc60fc487cb
SHA512 9e6a6da4342fc1ab34ac748ad349a5a6a9f0e87c9a0246321e788ca69d9b4d0d29ee4397c998f66d6dee60eaeeab30e1e95eb02037a4127466b5abc6daba3b4b
SSDEEP 768:2ZiSrZ7HGMjbJbvAcU7dFClJrVXC4dC9zVj3:2pt7HGelzQviTC4dezF3
TLSH
T183C23A965798536BECBB0E72F9F495416E39E7926410F62E1C9DF00908B73C09B3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c0:26:8b:9a:61:05:ea:3e:df:b1:a9:82:f4:96:6d:2b:a0:e2:59:fa:74:05:09:2e:a8:09:5a:78:79:7d:7b:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Configuration/Release/net8.0/Microsoft.Extensions.Logging.Configuration.pdb

windows/bin/service/Microsoft.Extensions.Logging.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d42da097bb5ef92a3eb9889726e5c231bb5d0d4ca7ca7132ed944514d52bec01
MD5 743b9ad9c66c2e44454b71e026ca50d7
SHA1 fb2c2c366bb5c72e1b1e8ce2ffe8f7ab0b21f21e
SHA512 6b548f9d68fb049bfef406fc252c282dde1aafe2110ca829bf8eaf400fe50c998d3cc57dd913e02028c157d4340d1600792754d6c0b8785d5534aeb3a4c4ab62
SSDEEP 768:kwj0b9108ypuuQwXi+uYTql2csO55555+VfF4MMv0nrtrGvAo92h9Hxsk5hIvT2n:kk05uO2csr4UJGyh9Rth9RMiiqzh
TLSH
T114636C161BDC8316DDBF4A74FCB085159F78FB93A902E7A71D84F098087BB848522B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

af:6b:02:a5:ef:e5:3b:25:4d:5e:e8:8d:58:9d:48:dc:2d:28:f6:3b:4e:b1:a4:4d:43:81:d9:42:4c:34:e6:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

66462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Console/Release/net8.0/Microsoft.Extensions.Logging.Console.pdb

windows/bin/service/Microsoft.Extensions.Logging.Debug.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b1dc1ada5bfeb19fe4ba5225db9c9950dca250fb2daaac259b537c5d0894a65
MD5 7d6d6d756235e4047ed6056a74ea8247
SHA1 75ee676251ddf351e5923198949b277e551f8d09
SHA512 2ded804c113765fe67f4bb161c52908349bed96e0e96ab228e0642e5bbeaaf4048d4814756d1dde400c2baca75c53345a486e47317b94912eabbc69add2f4d54
SSDEEP 384:zVfk5CuC8P4mjWJIpVMWc/X6HRN7QNbZR9zdVR+2:zJECmg8AWQFT9zQ2
TLSH
T1AA925D919FAC5296ECBB1E70EBF4DA423D3DD7C25811AA1A058CD5080CA77C0DB3536E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e7:6f:00:26:53:c3:04:d9:cd:7b:ad:25:5f:ef:bb:ce:f5:b5:22:b2:c2:9e:6b:f0:2c:04:fa:d4:f9:5d:d2:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Debug/Release/net8.0/Microsoft.Extensions.Logging.Debug.pdb

windows/bin/service/Microsoft.Extensions.Logging.EventLog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4913c4d4d3837176bcb830a8a76402873ada8c35050a3a93b29be092efddb335
MD5 dac813e8221d059d060e9927798fe6e8
SHA1 aac2bbb9b00f2e3acdaec8e4d6aef2e682add68f
SHA512 87492ed57bc730c27ac4baff9b36a434043440122e8f9077b559d7af23992fadfd52d448038b5bdf87914d1fa3369a5d3481f668dab92134a7fa150cb9afe7d6
SSDEEP 384:sK39j3mWjszWdsJdOBBgCV2VpUW2r4FWnYA6VFHRN7ic6R9zcLHHg/:s290Wd2EBQlKFCl929zb
TLSH
T17BC26C56ABAC631BDD6E0A30EBB5E5413D3DDBCB6800EA36098CFA091C537D45A2176C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

4d:2a:e0:f7:72:ba:f3:bc:73:c6:91:eb:57:bc:f7:b5:ea:49:c5:42:25:a8:42:94:c6:30:0a:39:73:11:34:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

20754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.EventLog/Release/net8.0/Microsoft.Extensions.Logging.EventLog.pdb

windows/bin/service/Microsoft.Extensions.Logging.EventSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2c043ea968ecaefd7b935255a8db84d5666fb28a791c67d3555a611bc0c8b83c
MD5 88cccaf8c1882c21963f5d4cbcf69a63
SHA1 4234e32312441278653c2fbe28ac1c605e59dd88
SHA512 086b091cb88ed4144fcc5d48849246e26ee7d2713d84056b771d733bd96758e5b634478ab6609a07b51966115f57680c8d2d63f5f5ec7b2de02f704916906a4e
SSDEEP 384:pSupZ5W3lFhrJo6mz8z0TVHprQiWAIczKeG2bhjXK2701rXRNpvAW3gzUWFYA6VW:pSupZ5W1rFRoZXWNQdjOSzFClzUl9zL/
TLSH
T1AEF25D21E79C830BCCEA1D74F674E981053ADBC73421EB5E5A88A5880D737D5972273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8b:86:74:4e:7b:f1:7d:9c:ae:ba:e3:0e:6f:93:43:53:9a:56:ca:ee:d1:12:bb:43:07:8b:fa:12:4a:85:ca:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

29478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.EventSource/Release/net8.0/Microsoft.Extensions.Logging.EventSource.pdb

windows/bin/service/Microsoft.Extensions.Logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b2cfba2e05ee89a91e9bc9cf112468a5f4fa05d1a77ea81c131ea656f3d133c2
MD5 973cbb386eeeac6ec135977655f69d44
SHA1 51edce77394f087e71abb47fe86c6092488d13ee
SHA512 14b6cfed2082bd7184118ea4b519fd31b192a6d1b0bbf2d9796b7cf47d56cc9b4a4129e0d1cb15306f244352906a6dc14ffb748d1e745ac471e8d782c9b41515
SSDEEP 768:c4byNvwqX2LvG84aSBWZNSYv6VmTygGPSikiw64yw64pbdez7+Ts7XTfl3l37WqX:ctd2C9aC+EYYbgGB4pmOYlVLWqKzg
TLSH
T1A9336C4053AC6327DEAE1E34F9F8A4450E39D7566402EB6B5FCDB0950CB37D486212BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

52:8a:8b:1d:99:b7:92:ee:35:1e:18:a2:08:98:d7:a7:d1:2f:1d:58:f7:e4:f0:10:c8:93:1a:f0:bc:ae:df:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

45918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging/Release/net8.0/Microsoft.Extensions.Logging.pdb

windows/bin/service/Microsoft.Extensions.Options.ConfigurationExtensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b9ea7bb70bfecf5c649f2559300fce232729257cfdb4221dc96f1ea778227353
MD5 7614fb667570cefa80663bed67a296c0
SHA1 6bc007ef8b70222ff136a7ec4d0b96741ff0a9c8
SHA512 fe26b2af3abff2f966f163899a669d58b916cf983faf9add5d4a1626acb5eedce6d167725c679bdf7068a95e7f9e1f70e8bdff916ff711fb45deebd192de5739
SSDEEP 384:wvKGKA3a66KxTfdzWzP0W6Tb2HRN7A6aR9zrLJ:iKG/L1c8/iA6W9zXJ
TLSH
T1F4A25C559B988313EDBB1E70EAB1D4427D3AD7966810E52B09CEF1480C67788DB3233E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

3a:6c:96:dd:26:cf:63:be:09:e9:e5:6b:e5:a3:74:4b:c5:44:6e:e5:58:ec:6d:55:93:52:6f:93:30:9a:a7:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Options.ConfigurationExtensions/Release/net8.0/Microsoft.Extensions.Options.ConfigurationExtensions.pdb

windows/bin/service/Microsoft.Extensions.Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5e01894cbc0661bacb8ca8f485a40d5ee4e02f28fef58007668a0276431b4693
MD5 18638600345307f00b51037bdf4374a1
SHA1 e8fca245a2b9a21589bfe18526c97c22939abf1b
SHA512 6a15b951c71d03ea49677ef3bc4f0095cb78cf2180e2199422da4497e3e3bc7004272e10ad4b2dfad27948f4c94e843f9617bfe6ddd3fa5bca4cd10bf1618b09
SSDEEP 1536:UahqHoZX+NmzYUGrCUidKHPhwMEbBolCixzZr:UYXfFGrCLQvhwME+l7tr
TLSH
T1C1536C05E7888712DEFF8931B4ACB6620F30C35BF507B76745EDE95429233908E6563A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

4c:e8:01:dd:12:b7:be:df:04:8e:a1:3a:72:eb:b2:33:56:f0:36:99:5b:6c:58:02:b1:9f:c8:9f:c3:79:9f:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 18, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

59738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdb

windows/bin/service/Microsoft.Extensions.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 446ff16e903e7479558816e213a3adee9a1c1adad65a56d853801b10933e29d7
MD5 f45226e320f41097397b1ba7468c2d1c
SHA1 1181845c7d16ac4c525eec67ec3a6dcfaa78a433
SHA512 417466f57fa8c6d942be5d86b14da5915d507dfbd7aa8d2700b4dd79a9668897a6a6abaab225be45076bdb8d86ccf4777bb3c699b4002a081e4407604f4e2f87
SSDEEP 768:CKEGbmbB0QERF7v6EtkKS+1ke97a1O33ttBOP7yW5yfyqTuia+15OFyx/iCL9zRv:CpGe0QERFhkKSM7ag33ttBOP7yVfHTuu
TLSH
T132135B52B79C8333CEFE9E34A4A4D1442A38939A7923EB5E5488E4651C737C4873227F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

96:13:f0:a3:e1:76:51:a3:6d:91:37:e3:d1:c9:06:82:45:30:a6:53:c9:a4:65:9b:c8:77:66:81:ac:08:47:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

38034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net8.0/Microsoft.Extensions.Primitives.pdb

windows/bin/service/System.Diagnostics.EventLog.Messages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dbfb7c81fb62a0bd3f77da92496640f179e96dd0c1a41a0d3c5d2a2445a3be46
MD5 dcccb11f247d3fe5477527ae58d04a78
SHA1 d9531bdf50e01ef6e282917e89c5ac2518733b2e
SHA512 bd4db6293507b579311506e00c6bf378b8c4930b1483e37eac7c516667f8b66844528c3207ed786307cffe8568485f86f65621a8ef43b70688e97dd7fa89b905
SSDEEP 192:yKir7PFWxNzx95jmHnhWgN7awWrhlXefqg7i1X01k9z3AkZVlb7:yhrKX6HRN7ueR7i1R9z7Zrn
TLSH
T1AB05F6A18F748346CF661870BE99FBF22B3D43C70941942616CAE9543C533B8AE252FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

d3:67:33:1a:72:2c:ac:66:2d:e8:50:01:1d:7f:d8:5d:7d:2f:30:36:99:db:77:a4:d2:6d:96:85:75:c2:94:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.EventLog.Messages/Release/netstandard2.0/System.Diagnostics.EventLog.Messages.pdb

windows/bin/service/System.Diagnostics.EventLog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8343020e3752dc8fae7598816570aa30b041f835412a76dac7f65b229ed9532b
MD5 12b57a03b46b41b6b2b77d5be09e25f9
SHA1 7f566ec6906f1c93ed70a6bc906839b2fc4fc6d8
SHA512 4ac42946774dbe7b49614cf060322729c97e57161719437a18c23a8343d0cd67a64c8b19c37b7894a37f90d76d20d9ba0318aea6031616a895a9ec0d2e5c9016
SSDEEP 3072:QrhmwRaA+Z/TIW5mFQOWWka+EjaVF2QRTI+baf6I:QwNhMPm/Wka+tpbct
TLSH
T19AF37E6473EC4B0EE7FF2B34F9B060558776B996AD32E71D498058AD0A63BC09A11373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

57:48:7d:e1:2e:12:0e:54:37:a5:e9:9d:aa:4c:14:e0:cf:8f:48:3a:59:5e:28:06:d5:7a:4f:6f:d9:03:b4:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

167638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.EventLog/Release/net8.0-windows/System.Diagnostics.EventLog.pdb

windows/bin/service/System.ServiceProcess.ServiceController.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 46328ad334942a6f2b0fd331ee632f06c51eefb2a7ba18ffe264513847e9c3bd
MD5 f6a8a2b0312cc5561f5a571db5871046
SHA1 c24d774d45cfb471730e08a3cd3956963e63d89e
SHA512 10dbc58f11944ddb25ba9906dcdee869ef6b7d8b036b6ee26a6cd4e8c611e3c8a393c5859d653fdacdd674a6836ff24dc412ad713cc37ea44ec8407e3459be0d
SSDEEP 1536:F7PttVwhUdeeIzkSmM7AuFvTb6wsN0pSFWlCz1:FlBe/ISmM7AgCwsNKSFOCh
TLSH
T18483190063F8036AFAFB1F747CB2952209397F56AA35E72D1A84519D09F2BC48A31777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ea:56:17:e5:09:19:7f:d4:52:60:a6:27:e1:04:ed:79:36:54:81:23:14:5c:e1:44:93:9f:72:0f:d1:6d:ce:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

82394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net8.0-windows/System.ServiceProcess.ServiceController.pdb

windows/bin/service/YamlDotNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4fa072043bf289f0cbea622ac72c825991c924ad26537c0414699f4fec9a6cd1
MD5 9a4f7e574592e4630287909d508a865c
SHA1 a92bab56f53ea25de1eb3618d64c5186389211d8
SHA512 5676b34b3d68e9a0089eb5a68000a1807c95ee271242ab92083723b2ec65733b36bad49a47fb72de5053d0e72d6f9dc8754505c1459e0c39339f5ae82342990d
SSDEEP 3072:GA/atOZpgZ0DsLsEgfXvbvOVsoiMF/RZdtX6y8V7gFUbybQJQbIqyY9b35EVX4r1:GA/HZpgZdsEsAFHsIU2UVcJES+2N3wC
TLSH
T137543D0373AD432AEBEF67F9F8B0129547B9FC26A0B9E78D1D8594E51C527904A007B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

305378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/YamlDotNet/obj/Release/net8.0/YamlDotNet.pdb

windows/bin/service/framework-dependent.flag

SHA256 2e61c33c4194e3b0927bd34aa0b087174c57cf7c7b262822a077cb554fa2ca3b
MD5 5b7fa415f69a387c3c8716063adf57f6
SHA1 557c70aa8be235494ae74e2bdc0103e44331fb44
SHA512 197a3574aeebcbfe1ca8411bec288332a0ddb1f32e207f0b372031cbf310a43e078059aedffb8decc71ba415afb90fae8f259490070157f4198ee980f5487a8b
MD5 SHA1 SHA512

windows/bin/service/service-manifest.json

SHA256 b64850f3a975552676d56828bc95a2ccd2453ab495cabcf59177fc2920436c95
MD5 eafbb6404bf7faa83ecc13f710aba882
SHA1 8371e32200143264254f619b57a17d46f2507800
SHA512 0d262d886cf00f9b0bffabccfd68b74cbb56b0464b2e0fb9bdb7a9559d980b457973b12ac84514847e672be6b2ca923d2496b9a26a64120f564c0e03271b16ab
SSDEEP 96:lRQ9URquh/J/7B1/avkp+Gi1XAKhfUwcYpqcdVG8ljRsHxxppTNmsZQD5JCjsEYr:lRQ2RTxeUys3Qlv5Ve3H4l7zt5
TLSH
T1F1915674ED485A63403AD2C2EEC44CC89A3F43736904B9582EAD254C4EFE7BE51B7A64
MD5 SHA1 SHA512 SSDEEP TLSH

windows/scripts/dotnet-runtime.ps1

SHA256 bbc3add4c9f1c6e1e228a6567a32ee1273a6ea345400aefe1ee3ea6da5d3387c
MD5 d924c172b483399e9417eb2459432741
SHA1 a46c5cc78737607e64f0f8e7895d37c070206ec2
SHA512 65476a2a3e859e4fc31417f11f29ba4e4240d3ddccb5c0bc535c3c811d51995a6ddc560cd62b556a04ab12867d9c010ae99f8be02121073e4a9f9a7ce5b2b7c5
TLSH
T18631521DA88490332ED3725D0B4E188023AF954B1D0A575CB3CD51B8EF62FBA42BC6F9
MD5 SHA1 SHA512 TLSH

windows/scripts/ensure-dotnet-runtime.ps1

SHA256 3d5b3426cdec949d448de5f7e07bc653c023543ad9a2abc62f32153ba499a995
MD5 6a62077d3dc98f3a2a46fa394d54d391
SHA1 43e08da286647f020b70658a009b140c72036f84
SHA512 b82197b49abeff8a19715dadf9347118bb11b64b784d1be973a55eb937ee457653062cca94dc8ff11e73e4a155fc5e8a473f87960bf183eb8e8fd8d8db7d2a3e
TLSH
T15851850EDAD021727D53238F09E901C6F759806F85185A98749D628DFFD247E82E93DB
MD5 SHA1 SHA512 TLSH

windows/scripts/install-windows-vpn-service.ps1

SHA256 269decee154e471c1305bc1503a0837fde8ad0d93940cef93a7b0f74fa341437
MD5 ede119b484162f68534c7905ee0036ef
SHA1 18e8a22fc7aadf8eb86e69054a9c509192a79a6e
SHA512 74ca1fbb1c71dc3230cc01f7209348fd6d7e5a40b73d01f88c0edc9c86209c9d071f98382810cfbc1c5e136a7eccb439f2e3b029edf6c560d507f788f11c7a6c
SSDEEP 384:94WFiOaPut9vmDRwxFojVFFIxAe6zYiaGXZleqoXsT/:mWAwt9veRwxiV7eMXaGXWqv
TLSH
T18E82D710B7D155F10A83029AED8B911A7A2E405F511D2B10BBEFD2C5BFE1C3E43B62D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows/service-contract.json

SHA256 74380d2891330e23fdb7b224d1c8c66deaf7dffe45a99c2acde3fb8375073d51
MD5 c8524adac6a502103d032b7d5e712b37
SHA1 92c38f1d2f916c3a52172239d2f43db2a482a6ab
SHA512 a994a02530ab8a3fdcd173c50663e046228903f46b05007fd07636b6e824fbd312924f716bd661e40908692b07066ba9acfea6ff75277ea1d41439c825b7730c
TLSH
T167C04C7C85A182F602E142892D1355219014F9199199313A5FD31D4921DD96B106291C
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer