FrameGlass.zip
- SHA256 d1e2cd72f529b711750e1bbe135194d4b6de895809ac235d64b244117f0ad353
Overview
overview
8Static
static
3FrameGlass...ib.dll
windows10-2004-x64
1FrameGlass...ib.dll
windows11-ltsc_2024-x64
1FrameGlass...ss.exe
windows10-2004-x64
1FrameGlass...ss.exe
windows11-ltsc_2024-x64
1FrameGlass...ss.exe
windows10-2004-x64
8FrameGlass...ss.exe
windows11-ltsc_2024-x64
8FrameGlass...on.dll
windows10-2004-x64
1FrameGlass...on.dll
windows11-ltsc_2024-x64
1FrameGlass...nt.dll
windows10-2004-x64
1FrameGlass...nt.dll
windows11-ltsc_2024-x64
1FrameGlass...nt.dll
windows10-2004-x64
1FrameGlass...nt.dll
windows11-ltsc_2024-x64
1FrameGlass...ns.dll
windows10-2004-x64
1FrameGlass...ns.dll
windows11-ltsc_2024-x64
1FrameGlass...on.dll
windows10-2004-x64
1FrameGlass...on.dll
windows11-ltsc_2024-x64
1FrameGlass...ns.dll
windows10-2004-x64
1FrameGlass...ns.dll
windows11-ltsc_2024-x64
1FrameGlass...ng.dll
windows10-2004-x64
1FrameGlass...ng.dll
windows11-ltsc_2024-x64
1FrameGlass...ns.dll
windows10-2004-x64
1FrameGlass...ns.dll
windows11-ltsc_2024-x64
1FrameGlass...es.dll
windows10-2004-x64
1FrameGlass...es.dll
windows11-ltsc_2024-x64
1FrameGlass...on.exe
windows10-2004-x64
1FrameGlass...on.exe
windows11-ltsc_2024-x64
1FrameGlass...ib.dll
windows10-2004-x64
1FrameGlass...ib.dll
windows11-ltsc_2024-x64
1FrameGlass...ol.dll
windows10-2004-x64
1FrameGlass...40.dll
windows10-2004-x64
5FrameGlass...40.dll
windows11-ltsc_2024-x64
5FrameGlass...ol.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
FrameGlass/Dia2Lib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
FrameGlass/Dia2Lib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
FrameGlass/FrameGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
FrameGlass/FrameGlass.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
FrameGlass/FrameGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
FrameGlass/FrameGlass.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
FrameGlass/Microsoft.Diagnostics.FastSerialization.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
FrameGlass/Microsoft.Diagnostics.FastSerialization.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
FrameGlass/Microsoft.Diagnostics.NETCore.Client.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
FrameGlass/Microsoft.Diagnostics.NETCore.Client.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
FrameGlass/Microsoft.Diagnostics.Tracing.TraceEvent.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
FrameGlass/Microsoft.Diagnostics.Tracing.TraceEvent.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
FrameGlass/Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
FrameGlass/Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
FrameGlass/Microsoft.Extensions.DependencyInjection.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
FrameGlass/Microsoft.Extensions.DependencyInjection.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
FrameGlass/Microsoft.Extensions.Logging.Abstractions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
FrameGlass/Microsoft.Extensions.Logging.Abstractions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
FrameGlass/Microsoft.Extensions.Logging.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
FrameGlass/Microsoft.Extensions.Logging.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
FrameGlass/Microsoft.Extensions.Options.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
FrameGlass/Microsoft.Extensions.Options.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
FrameGlass/Microsoft.Extensions.Primitives.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
FrameGlass/Microsoft.Extensions.Primitives.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
FrameGlass/PresentMon.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
FrameGlass/PresentMon.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
FrameGlass/TraceReloggerLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
FrameGlass/TraceReloggerLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
FrameGlass/amd64/KernelTraceControl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
FrameGlass/amd64/msdia140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
FrameGlass/amd64/msdia140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
FrameGlass/arm64/KernelTraceControl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target FrameGlass.zip
- Size 5.7MB
- Sample261017-am7rbatsdv
- SHA256 d1e2cd72f529b711750e1bbe135194d4b6de895809ac235d64b244117f0ad353
- MD5 a9a036688523aa048b7255acd4f3d113
- SHA1 366ea05298a37360b9573b971683008ea70e9a7d
- SHA512 907b866141afdbe05ba5287a52abea75df992a2af4b3e16de254c8c5fd684935f8cfe9481f656f704a10104f9bed41264bf9b62af307eb4be782dbe16e97ea40
- SSDEEP 98304:uJ6Op4VncwmZIBZnpGwkwOpQerIEAz57bpKwmZHfrlg2xvUms70iTrvzwFoWhns:uJBwmZIBfKwU8rdKDlpWmmTrvzQ5s
- TLSH T106563374DAE5883A0E47693A64F38BEC99505876023CDBB5FC6CCC100F96B55AB4C9CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/FrameGlass/PresentMon.exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/FrameGlass/FrameGlass.dll unpack001/FrameGlass/FrameGlass.exe
File Explorer
-
FrameGlass.zip.zip 5.7MB
-
FrameGlass/Dia2Lib.dll.dll 57KB
-
FrameGlass/FrameGlass.deps.json6KB
-
FrameGlass/FrameGlass.dll.exe 105KB
-
FrameGlass/FrameGlass.exe.exe 182KB
-
FrameGlass/FrameGlass.runtimeconfig.json519B
-
FrameGlass/Microsoft.Diagnostics.FastSerialization.dll.dll 74KB
-
FrameGlass/Microsoft.Diagnostics.NETCore.Client.dll.dll 142KB
-
FrameGlass/Microsoft.Diagnostics.Tracing.TraceEvent.dll.dll 3.1MB
-
FrameGlass/Microsoft.Extensions.DependencyInjection.Abstractions.dll.dll 42KB
-
FrameGlass/Microsoft.Extensions.DependencyInjection.dll.dll 79KB
-
FrameGlass/Microsoft.Extensions.Logging.Abstractions.dll.dll 60KB
-
FrameGlass/Microsoft.Extensions.Logging.dll.dll 43KB
-
FrameGlass/Microsoft.Extensions.Options.dll.dll 57KB
-
FrameGlass/Microsoft.Extensions.Primitives.dll.dll 39KB
-
FrameGlass/PresentMon-LICENSE.txt1KB
-
FrameGlass/PresentMon.exe.exe 411KB
-
FrameGlass/README.txt1KB
-
FrameGlass/TraceReloggerLib.dll.dll 22KB
-
FrameGlass/amd64/KernelTraceControl.dll.dll 260KB
-
FrameGlass/amd64/msdia140.dll.dll 2.2MB
-
FrameGlass/arm64/KernelTraceControl.dll252KB
-
FrameGlass/arm64/msdia140.dll4.9MB
-
FrameGlass/x86/KernelTraceControl.Win61.dll.dll 156KB
-
FrameGlass/x86/KernelTraceControl.dll.dll 181KB
-
FrameGlass/x86/msdia140.dll.dll 2.1MB
FrameGlass/Dia2Lib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c4cac68010fe032218efe5e9fcf46eef9f77bfaa5f3bd33f03c5ff77d5a8fac
- MD5 be6474b726207994decdc22e84936a3c
- SHA1 ea1d16f16de16b29a576a1b5cc4baa31bc5db9bb
- SHA512 d204240213a0b509101ae3c9b691e9f6a141946cf3284244f56314183c84d24c1cdaa28661444fb8e1dc018e24f8aae4505c35f9994e368032a9913c9de8ff59
- SSDEEP 768:MQMT4Q3O9ymyKJcy3Xs3y4rV50sds8SzUwHhvoVi+CLr0:dQCye14oGs8SNhgVVAA
- TLSH T154431827761CF40DC5A26ABE91CDDEA22770D7417B03CF02499CB36A9F437496B62239
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b1:87:c9:a8:dc:47:2d:5b:f4:36:e8:78:4b:99:ac:cc:96:51:03:f7:11:5e:f3:d9:ff:03:31:59:44:4e:23:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bc:06:1b:46:f0:10:86:a3:f4:99:39:6e:86:cf:36:e8:fe:1b:b7:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:96FF-4BC5-A7DC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d7:78:5e:7e:ac:3f:2a:41:8b:00:00:00:00:00:d7
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 2, 2017 - Jan 2, 2019
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
48798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/FrameGlass.deps.json
- SHA256 129665107a58b79680a107adccb906a5d2a33079a19cfde672e5541abbe370a8
- MD5 6f878ead06f7748e6e37793af77a0e58
- SHA1 5ec9f632da1344653ea9b5e8161d930465b7ca31
- SHA512 eccd053527a60a129ebddecd8889f9040324f2d59a6cdba0eacdcb408447a53bb11dbf675ca69d499c80e05b33203f9300a83d6d0c3085766e8a795ed0431b5b
- SSDEEP 96:tveSxRWJL0kWs2rh/RU9hs8jAGxP+IJjnsx8o89SBgBaZuPEQ7EHVvZMfD8zEAfr:twWkzxa/
- TLSH T150E15806F4945E734176FBD199B94580F679033B6000A88A78FC145C8FBABABA0A3F35
- MD5 SHA1 SHA512 SSDEEP TLSH
FrameGlass/FrameGlass.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85f04c7d200128ef572e010ebca73137ef726b0529bc86d0df53a5f814437b5e
- MD5 6164019cb214a5cddbb1c3b12d16b325
- SHA1 a06265ecc5f9dfc6e7c32e186bbe5d5a210694a4
- SHA512 1e93aef56ac26a9a604ac159456c35a46880dd690a954c67e8f56d22a943147421cbe8526e986f08e4a812bf412b0ab3cce0f6ac4027a547f4d7a178a449c303
- SSDEEP 3072:rb9kdLiFQoIbco5lQ/UQVNNjpZ4TLWZYV:0LisbcM6MWNjAeW
- TLSH T1CFB34B8173FC4725F6FF6F3624F111910736BAA6A632D78D098935EC1972BC05A21BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
88186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Documents\Codex\2026-10-14\new-chat-2\work\src\obj\Release\net10.0-windows\FrameGlass.pdb
mscoree
_CorExeMain
Name
.text
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/FrameGlass.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 10ca070c4671dc671be0ab04eb80d3215b4d724485dff07f2a97cc091cdd8114
- MD5 728df867a87ec8b1a0dd1bb5b23d297d
- SHA1 23f1cbd9307d88513525d2dfe9c8377ded23a5c3
- SHA512 735e1ca6d742d178377723b86257958fbd36024786a905934fc5184fa74773b270588ba02c49cf0718e1955c89c0316af92c1e76eabad7e5202d14d403e79e1f
- SSDEEP 3072:XVDxk88wN1BL+x7dL1Z9QnlX97E3swmozzaAT52ntp7WTLYZYX:Fhax7F1nQnJcBiFntowW
- TLSH T1A7045D13A76811BEE1B3D678C9924941FB7278598B71A7CF07504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=258, version=35228,
FrameGlass/FrameGlass.runtimeconfig.json
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
FrameGlass/Microsoft.Diagnostics.FastSerialization.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a216b032692e6b0effc7adac7b7591ed2c754e2c6764bb7127464b808d8bdfd5
- MD5 6295352702dfbaa24c02b94fae77bf33
- SHA1 dce10f2ecfb00dae6fad6ab9278bf3e55e462075
- SHA512 1f40ab85450527342d86c8fe8098b75d8085a5efe1bff1b9d9c623d9b7b7f80e4a02a7452d42c48c2386da385247851ad15a31989fd63a02c482d7728b371797
- SSDEEP 1536:lWjWJwH/lOtwQYi/IV/jG2/khuc+8gC/2QPZ2lcpHikiAcm0zQ11h0awb1l2byLp:lWaJGctwni/IV/jTlAcQ11qawb1losp
- TLSH T135734B1477EC8B63EEFF1BFBB4B081110B70BEA66536E78E5584A1A84C53B508E91317
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
84:6a:89:3e:c7:4f:b9:14:8c:fe:76:af:0f:06:4a:5f:9b:21:a3:81:e5:ce:03:96:37:1b:c6:d0:d9:36:dd:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 20, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
71278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\FastSerialization\obj\Release\netstandard2.0\Microsoft.Diagnostics.FastSerialization.pdb
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Diagnostics.NETCore.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 baed2d25ca5bc53a3447c237d5572c92eac1fd842807b3e72602a711749b1b22
- MD5 ae909868c35d7a0cfd75e0fb6b03cfb7
- SHA1 b48aad85eb1a67c160bf26ee2ea8822eeded3652
- SHA512 c1390e002de92feb3da884cb0996ae7d19dd867b63420975fd4e381a90418bdaf7ff283f6d5095ef34f82377e2a60e4a71a25f88c372e0da516b171d83cd764b
- SSDEEP 3072:MmQktakR06vEO14/o7q3hnQhYbbmiLg+RjUjbQ1DsSjNmsWsocB12EJo:1QkRHvH14/o7q3hnPRjUjbQ1Dskzb17q
- TLSH T1E8E33C50A3E88F66FADF6F78B4749260CB79A607A96BF74E444CA1FD18027E04D41723
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:e2:33:58:7d:20:5f:5b:aa:4b:75:11:06:7f:d4:b7:33:58:0c:11:83:1a:06:29:64:d4:92:54:d0:18:02:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 5, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 16, 2023 - Nov 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 12, 2023 - Jan 10, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
141598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/net6.0/Microsoft.Diagnostics.NETCore.Client.pdb
mscoree
_CorDllMain
Name
.text
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Diagnostics.Tracing.TraceEvent.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2150c5bd3a19358e9871159272f6548ff0d1c4184a687ded8ddf0ffcdd93c00b
- MD5 0a668cf0a047438aaaac7f2069d73518
- SHA1 e55d3c8d59876edfe4f8eac5eb53ed3943b1019c
- SHA512 93e8ec00c20f49eb1fd5f55a728cd6ee808ae8921169356f82f72a4a5615b50b48379336fe820403ffeebb5542d18818e60db13a4ac3441b1aabb7da5b211a95
- SSDEEP 24576:isXns8/YnaDiNiyvtMgKu9z3BhV1n1XE1d+bimRKqMyNzarpcud:RXnp/YxizPuguRPMyNCd
- TLSH T102E53C11EBBE4C6AD2DF037BF0108068E2B1FC946356E75A29C9B27C2D91BB74645633
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fc:31:ac:1c:60:e4:0c:09:07:ac:b5:b4:c8:94:b3:96:1a:a6:66:b3:a3:1c:9a:ea:09:93:7e:b8:16:cc:26:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 20, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
3230798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\TraceEvent\obj\Release\netstandard2.0\Microsoft.Diagnostics.Tracing.TraceEvent.pdb
mscoree
_CorDllMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ccd830351aa28bc683d4f8d1cefd9e724161f972d25bfb64eee5bf55c48c5e3
- MD5 d6cfda4e1c948aeb3e5d57376334375f
- SHA1 cb8c35306afd15358104ecfe70e724ad9c753e6f
- SHA512 93a7571c4d186243d78641630b8997fdb69d411df307d95c86aed556102369a98b9a13ca5c7ca8d593244cf0b0f039bc37d330b86194b07b2c9f0bcec3c06b2e
- SSDEEP 768:o8+cxuPn//hpz2XCkCkCdvAb4b4qox06OoV0F8l0HCTpw0wo0emDMtj:/+cxuPn/bvvE0Q0HCNfBsDMZ
- TLSH T170133C4577FC8366D5BE5AB065F191149D3BFAC72802E7062948D0AC1CA7FCC2A62FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:44:d2:12:a3:fa:19:78:e9:74:93:78:44:12:1b:43:4a:85:4e:bc:f7:e4:bf:1d:0e:c7:1a:32:18:49:6b:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:5c:86:d2:e3:ec:39:f6:8b:38:00:00:00:00:01:5c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
39418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/net6.0-Release/Microsoft.Extensions.DependencyInjection.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.DependencyInjection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2aa8182b5356a8cc5c35fc3641a87e814857d8d9be399ac78f260343754d09e0
- MD5 5db27bdd3d6a9a225b88b12293382f95
- SHA1 eb7d6d2250bf2509b89166bc22c07423ac9c2d91
- SHA512 4ed559768d1f1a405203f1e2d6a72dddc4c7b485461979a14d22566236e169f7e2652e9b3d85f0205c296bc4d705a30519a5f292aa6eda26137b7f2923660b3d
- SSDEEP 1536:iNLmvi666OjIX0h9zMPvHBWCaRweUG4DynjEZnBaMH:Q66fjLb8vH0CiUG4DyneBaQ
- TLSH T182834C25A7FC4722CAEF6AB4543595110F7EF9C67003FB481EC8A0691A97FC14B623B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b5:16:39:be:45:fb:96:ae:fe:b9:9e:33:db:fb:63:ba:02:90:9f:c5:a5:a8:e4:5c:83:d5:1a:b5:96:26:49:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:41:af:7f:52:97:5c:f2:dc:45:00:00:00:00:01:41
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 15, 2020 - Jan 12, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
77390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.DependencyInjection/net6.0-Release/Microsoft.Extensions.DependencyInjection.pdb
mscoree
_CorDllMain
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.Logging.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d575c9d1543ca726ce14dbdffd103e93ea527cd46bb28316da1f4122dbc55d56
- MD5 a2544f077d57c4ea44a4694efcbea30b
- SHA1 02ec010722bbd1740782b502df30d4475aebe5f2
- SHA512 ded82fdc0cbfd644a6368b9776eb9d5e0899c61373599d8c3485a47140850bba8b7b448ce4bf276fdf1d4b2ca24745a17ceabcbea793255e34d625fb3db68b0e
- SSDEEP 768:N+UfRQY8PGNWovMLJYBjtLgnuAAAAAknwd45FnrfMq1/yJuoiYblHJg6GOmDu3MN:N+tY8PIiq51wcFnDMsno7jRma3MN
- TLSH T1EB534B0067EC9323CB6E9DB9E0B1A6026775C2673403EB4B2DDCE2742557BCC6B52366
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:6e:d5:5f:03:20:1e:ee:f4:20:44:fe:b4:ad:62:0d:ef:4b:ff:32:91:52:80:45:6b:60:69:c3:36:41:25:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F7A6-E251-150A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:59:9f:fc:7e:5f:2c:ea:f2:43:00:00:00:00:01:59
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
57606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/net6.0-Release/Microsoft.Extensions.Logging.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.Logging.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 183650081b551dfad967a7cbf79946a229cb79458b8d04a12db7c44b03bb9ab7
- MD5 037fa19d37892f003cb18c3f4f070b66
- SHA1 7bea9201a90f69ff958f5bf64e959d1e4021f252
- SHA512 04dd786ae74827dc3e8c417e1da3cd2603618b4a57a8aa861eba2a96b4e1c795ac27b2aca9f9fb886ae4791af1b356e0243e11bc2b5a3158ecea2cbdfb449391
- SSDEEP 384:kX8pDPkAvn3sac7bhN6hym/DEdwe9Kc78uwAiWMTGLWIMM1uGxzHjzg2DfsZqQOG:kX8pDT8XP6hA+wMaLWCzAVLOPneM0I1W
- TLSH T146134A2283AC4367D97E09B4B4B8E5954F35C766B402FB466E8CF19A1CB3BC0162177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:6d:55:a8:1f:6e:04:66:89:85:84:b1:9a:4a:df:c0:8d:0a:16:37:bf:52:43:d1:c6:3e:02:4c:98:60:bb:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:58:70:5a:22:f7:be:96:e6:03:00:00:00:00:01:58
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
40470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Logging/netstandard2.1-Release/Microsoft.Extensions.Logging.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 786112cb2f6646ef1170219a8c0bb813c9f14a6781e67c6266414f55a679565d
- MD5 950440793a182cc76ffc7f7280e55daf
- SHA1 6ec0c1fe1332912086247080b55b06623c78326e
- SHA512 132280392e9c60cb764f6f5d9b24c01abd2bdfff4e66ab4ca8dbb7d52150954df02277d49083754df2f2bca82660622c39f75ff80eb4cf9a2bd52dc0292943a1
- SSDEEP 768:sCD3yk2B8+9PwwOxC8wZLq6J4q2r0qafouRVPvW3aMgi:DkB8+94xxBmm6mqaBafouRdiaMN
- TLSH T12F436C01A7BC9B92CEBF8B30E43490231A36D6073503A76F86ECE59C2C677646A75335
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:fd:d1:97:31:41:32:f7:b4:4b:51:55:f2:77:25:fd:c6:08:d3:5c:f1:13:f4:4c:ca:ec:2a:2c:f4:5e:53:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:41:af:7f:52:97:5c:f2:dc:45:00:00:00:00:01:41
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 15, 2020 - Jan 12, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
54862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Options/netstandard2.1-Release/Microsoft.Extensions.Options.pdb
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/Microsoft.Extensions.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8ce9a85927ec7507b11ffe90080e7a811d51304a9e8b1da20c350159ba403902
- MD5 a53d11973f75b15bef19c16a35ffb432
- SHA1 376636c20cee083da54d4146479032170ec7231b
- SHA512 99d6a73c8bcd4de86e877c0e5c37960f9bcc5bf40ce2f8fd5ed2ec37650c91d123c29bb254fe6e81fc5aa25749eabdbde9a64352d497eddd862ca10c154f43eb
- SSDEEP 768:slx+oQSHqk49NI0OP7NWEfDkkuiEk3LViOM+1zy:WVQSyI0OP7NxfAkuiEkbwOMX
- TLSH T1BF034B12A7DC4333DEEF1A3591A1D1605B38D7FA7822EB5A504CA17819A3BC48732777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:e9:96:61:4b:6b:02:03:d3:64:d9:b6:a9:92:0f:1e:d2:0f:c4:df:41:3f:43:b4:27:52:00:13:06:b4:f3:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:58:70:5a:22:f7:be:96:e6:03:00:00:00:00:01:58
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
35610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Primitives/net6.0-Release/Microsoft.Extensions.Primitives.pdb
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/PresentMon-LICENSE.txt
- SHA256 4c949341b1893c8c6ad82f7fb4eedf622cd1fd9c22a9af8f19b2dac19d1947b6
- MD5 2e2b7dda22082683dc14c60f627b5a5d
- SHA1 e9845dfa423846ffc462d9ee937160bc150948c8
- SHA512 64399062e221bf05b0d7fe3381dde66b07f5bc7b74cc58ff4fa2db1a202ffdd1de686be6b3838418497d16068cea29ec2026a35b8e561dc08e73c4bed28f1b9d
- TLSH T1B811821E725003A22C8B1361557D68C5B26BB24F79AF2784206DF380232A06DD1FBC44
- MD5 SHA1 SHA512 TLSH
FrameGlass/PresentMon.exe
- IMPHASH d59a940a3a699c745e66d2474a025233
- SHA256 364e5d98d4d134bd54dd25c22ed2ca2f4883f8bc3ed6502bee0c151e3436d30c
- MD5 a672b620860c9c192993b1b3f54ec464
- SHA1 6038e614c6663cc902126ce09ad81d355373748d
- SHA512 f8f96db9c5e125c61618994e0200cb430981e119927c0c7a112a5dfe0c0825d98c56afd61dac84297753579e577389075e94e2ed038565a15db9234b1c11e3ec
- SSDEEP 6144:SptJccAJb6f6NfEbp1b33iw4ei1GOJdllhWDDJ0K3/6340el4I57s9SORkKRVR:SYyri1GOJdlrqJ0tclYTksVR
- TLSH T139948D15F7E404E8F5B7A2788A729602EB767C590730D5DF13A442662F33AE09E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
f6:f5:19:14:dd:92:b1:c9:b9:6f:a7:ed:f8:65:33:a1:4c:38:5d:7a:87:1e:6b:51:94:bf:19:7e:fb:39:68:9e:77:37:71:a4:84:e0:30:8f:7c:46:cd:f9:10:0b:45:15
Digest Algorithm
sha384
PE Digests Matches
Trusted
Signing Certificate
CN=Intel Corporation,O=Intel Corporation,ST=California,C=US
Chains
Jun 6, 2025
CN=Intel Corporation,O=Intel Corporation,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Intel Corporation,O=Intel Corporation,ST=California,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Intel Corporation,O=Intel Corporation,ST=California,C=US
Serial Number
fa:46:9e:09:97:2c:f0:7b:97:a5:ca:9b:56:fd:63:a7
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 4, 2024 - Sep 4, 2025
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
177256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Files\Repos\PresentMon\build\Release\PresentMon-2.3.1-x64.pdb
kernel32
GetConsoleScreenBufferInfo
GetStdHandle
GetFileSizeEx
SetConsoleTextAttribute
WriteFile
SetConsoleWindowInfo
GetConsoleMode
FillConsoleOutputCharacterW
ReadConsoleOutputW
ScrollConsoleScreenBufferW
GetFileType
SetConsoleCursorPosition
WriteConsoleOutputCharacterW
SetThreadDescription
SetThreadPriority
GetCurrentThread
SetConsoleCtrlHandler
LoadLibraryExA
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OpenProcess
CloseHandle
DeleteCriticalSection
QueryFullProcessImageNameW
QueryPerformanceCounter
GetExitCodeProcess
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
GetLastError
GetProcAddress
FreeLibrary
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
CreateEventW
SetEvent
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SetEndOfFile
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
HeapReAlloc
HeapSize
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
ReadFile
ReadConsoleW
CreateFileW
WriteConsoleW
Name
.text
Size
287KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=159, id=261, version=29395,
count=11, id=260, version=29395,
count=1, productName=Unmarked objects (old),
count=3, id=257, version=29395,
count=16, id=260, version=33030,
count=17, id=259, version=33030,
count=62, id=261, version=33030,
count=184, id=1, productName=Unmarked objects,
count=13, id=265, version=33134,
count=1, id=255, version=33134,
count=1, id=258, version=33134,
FrameGlass/README.txt
- SHA256 55ec29bc2d2667ba13ef34e28f6b849c46ce68ec202b3e8641d353e7fb059f6f
- MD5 4f5aa1fc283574fca89abd977b76ffc2
- SHA1 5671a3519c437525a15d15452010f3a77cf86921
- SHA512 6c8844639283d8a13ca281e643b5ea3c2f1fcf44cc471be7d93ad5159cfa4efe8956ef108396bebd25ef28017ff77aa69a23fe346a11b17b88fc9146dcc0f575
- TLSH T12E112377B1803B7952B6E1B0020B77E5EF06A458A1550BD5607CD39D3258277F322AB5
- MD5 SHA1 SHA512 TLSH
FrameGlass/TraceReloggerLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6830c0f1d3f3c17719181e73dd5cfa8ccbb3f3c575329d2120576545103467b5
- MD5 63d53278de054ac54da51d94d2bc0c9f
- SHA1 66eefa94909b3d8e2ed0f1d366c27d9b261c1a7b
- SHA512 45aafdc6d20f6eb49f149e6c5fc3930d78d06169c95ab87f7b2aefb13cda1e9072ce7bf5d9d7a07483972ba9d87f7ee98fcf6cd543fa44c46fad49d0a9fd516f
- SSDEEP 384:PoMeAKyr1jSC6JW1m0GftpBjyMi5aQHRN7vzslD161Y7PW:PoMbKK1OBQVidi5LL10W
- TLSH T104A24C929BBC5443DCC2ADB067E8DE837E38D7C60D22C81B14AAF1951DC37D5AB28539
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
56:00:b2:38:0a:ef:70:6c:d8:ab:95:a2:68:72:1c:02:5c:bb:86:50:c8:0a:52:3e:0f:f0:10:a9:6c:fb:b1:90
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ef:93:44:cd:c7:c8:83:8d:b8:21:2e:7e:16:a1:0d:8f:6d:32:92:36
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
12830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
FrameGlass/amd64/KernelTraceControl.dll
- IMPHASH aa944b3ec27bb8a3ed9fe954af56b81b
- SHA256 98de2f1de4fb1711688c04e2cb0187bf8c47e627771e8f51329671f296bfc688
- MD5 b1c75bf2b5095ac3299403e34d462c4c
- SHA1 e558815bc2c91e67a7f416bb1baf85f82068ff1f
- SHA512 653fd18acb07962a5bc865e61a73ac0645a4b70ef2b31ebb0b4cf50e6ccfb1c22eb665db98e9d1b232de6feea3d7254b785ae58946ce1dae090ca1f71475951a
- SSDEEP 6144:/lPLikZqxz9Prt9e1bd6JcAMaLD0qjR0FC4YPHZN:/FmX9e1bd6JcAMq+FpGZ
- TLSH T1C3443A2AABAC9C62D527A07DC987C646F3B2B8125711D3CB11A0C37E1E2BFE47934751
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
52:c1:77:0a:cb:aa:62:3f:be:4f:00:69:91:4e:45:51:8e:5e:27:81:64:a9:65:cc:37:60:9b:42:5b:4d:a1:34
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 5, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:30:4b:5d:89:ac:e6:70:47:00:00:00:00:01:52
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
163584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
KernelTraceControl.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__memicmp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o_calloc
_o_ceilf
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
_o__crt_atexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__cexit
_o__callnewh
_o__errno
wcschr
wcsrchr
strrchr
wcsstr
_CxxThrowException
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__C_specific_handler
_o___std_type_info_destroy_list
__CxxFrameHandler3
_o___std_exception_destroy
_o___std_exception_copy
__C_specific_handler_noexcept
memchr
memcpy
api-ms-win-crt-string-l1-1-0
wcsspn
wcscmp
memset
wcsncmp
wcsnlen
wcscspn
ntdll
RtlCaptureContext
RtlGetVersion
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlImageRvaToVa
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlImageDirectoryEntryToData
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
api-ms-win-core-com-l1-1-0
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
CoCreateInstance
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetVersionExW
GetWindowsDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTraceEx
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-kernel32-legacy-l1-1-0
CopyFileW
FindResourceW
oleaut32
SysFreeString
SysAllocString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TerminateProcess
CreateProcessW
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-1-0
GetProcAddress
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExA
FindResourceExW
LoadResource
LockResource
SizeofResource
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
api-ms-win-eventing-consumer-l1-1-0
CloseTrace
ProcessTrace
OpenTraceW
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
QueryDosDeviceW
FindFirstVolumeW
CreateFileW
GetFinalPathNameByHandleW
CreateDirectoryW
ReadFile
SetFilePointerEx
SetFilePointer
WriteFile
FindVolumeClose
GetFileAttributesW
DeleteFileW
GetTempFileNameW
FindFirstFileW
GetFileSize
FindNextVolumeW
FindClose
FindNextFileW
api-ms-win-core-file-l1-2-0
GetVolumePathNamesForVolumeNameW
GetTempPathW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
IsWow64Process
Wow64DisableWow64FsRedirection
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapSize
HeapFree
GetProcessHeap
HeapAlloc
HeapDestroy
CreateMergedTraceFile
DllCanUnloadNow
StartHeapTrace
StartKernelTrace
UpdateHeapTrace
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1226, id=1, productName=Unmarked objects,
count=8, id=260, version=29395,
count=4, id=259, version=29395,
count=25, id=261, version=29395,
count=1, id=256, version=29395,
count=25, id=264, version=29395,
count=2, id=253, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
FrameGlass/amd64/msdia140.dll
- IMPHASH cbbe24cfaed1dd0936fb4ce38a1f0032
- SHA256 7341081feac7a2cebcc796c9c2bc5041a295df0673244f2595294e06a0bd7ee8
- MD5 971b779f3717591f52c38db367b71548
- SHA1 0791f1cf7522fe897e1af89629a2300ae509d6ad
- SHA512 f4da5d21ddf3c0152e5396d9b004cdcc1720403cf5cbff0db4581471d297df57a9557d67f2a774125a8de28bcc575841df90067feb941d5aaff83e6ab2b994dd
- SSDEEP 24576:H86rLP1cKsNO5ukZx9MAuyEE9BpajXt7zkDcgQeHOvXsXTcbPKx4GOTyTkKk+D5c:H89YpMA9BpajXBzYcgKskd+u
- TLSH T1F9A57C97A7A840E8C1BED07CC65B560BE7F238050750A7DB12A0867E6F67FE05ABD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:44:4b:af:50:16:30:7c:4c:87:77:06:23:79:2e:58:e8:2c:bc:15:6b:4a:32:17:4a:de:88:04:b8:4e:29:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
786656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\msdia140.pdb
kernel32
SetLastError
FindResourceExW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
LoadLibraryExW
GetProcAddress
LocalAlloc
LocalFree
GetModuleFileNameW
GetLastError
GetSystemInfo
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
CloseHandle
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
RaiseException
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetFullPathNameW
SetStdHandle
GetFileType
SetFilePointerEx
ReadFile
GetConsoleMode
ReadConsoleW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
CompareStringW
WriteFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
GetCurrentDirectoryW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
VirtualAlloc
VirtualFree
GetFileAttributesW
SetFileAttributesW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteFileW
OutputDebugStringA
DeviceIoControl
Sleep
MapViewOfFileEx
ExpandEnvironmentStringsW
GetFileAttributesExW
FormatMessageA
TryAcquireSRWLockExclusive
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
GetSystemTimePreciseAsFileTime
GetLogicalProcessorInformationEx
CompareRE
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
378KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=259, version=30795,
count=177, id=261, version=30795,
count=15, id=260, version=30795,
count=10, id=259, version=35207,
count=36, id=260, version=35207,
count=103, id=261, version=35207,
count=3, id=257, version=30795,
count=167, id=1, productName=Unmarked objects,
count=33, id=265, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=151,
count=1, id=258, version=35207,
FrameGlass/arm64/KernelTraceControl.dll
- SHA256 45b6d97a6c64229976b71a0fe709617190267fd02147a5c7e1e4fb9b17fa2956
- MD5 705cf5ff005ccdd8a9cb600ca89ad4cf
- SHA1 b9c93ce3a957447315054844adfa8e7dc25f9bc2
- SHA512 826574d529ab49898318a3c17c1be00a808292c6c04b440a4e8b2633a6ec39bc896523d40a25965257c83471aceb66c002bd530d74bafb29257ddcf006e3f2b5
- SSDEEP 3072:VJxCYKhMXJw5eSpmpi4F1Lvvt+S/77gQQgfUFOlkBsTdUM3J/qyPUQrmqMlw2T3L:VJxJK/dpOfr37g1QOe5qWlr0lww7
- TLSH T1F6441B816BCE9CA1D6C6AE3DCE178B54B67BF9288910C1873153131FDEAFBD0C991492
- MD5 SHA1 SHA512 SSDEEP TLSH
FrameGlass/arm64/msdia140.dll
- SHA256 149f8d131a9d664014cafdfc3b77935b13472c250743dd669341ef0d1d4ef0fd
- MD5 556fcd88813e8c2b747628f0b973bd5c
- SHA1 c400d846bf537bd94b17a6122899fcdfc080efee
- SHA512 a1c51ab08743bbdb70bf3f40ecdba222cb6079efb56d8780cbbb6ef3398ed5f35dd105b9b402e0e2ec16bd11fccd403ef98188adc1e3b3ea71863c857cc146d4
- SSDEEP 49152:Xg5r0NrLIntJRwfkjfyQKITtS1/LPkY2+oF79:XgmNrLGtJRwfmfytICDcY2+E9
- TLSH T186363B51AA8DA821D3DAD63DAFB38F247237F530C5B58E8BB10D035DEC45BC58E92261
- MD5 SHA1 SHA512 SSDEEP TLSH
FrameGlass/x86/KernelTraceControl.Win61.dll
- IMPHASH a4527734d6154455cfe4ddf926590c3b
- SHA256 b7a83f51eae2824e9259ffe567f0fb42177d7b02674be760eb88df270459d8bf
- MD5 107a3c0b778d7c9b6063dcb0fb3c1795
- SHA1 0ea58772d0aa1ce63950b7c36b840316099b429c
- SHA512 7c386fb2c56d23354bef051a8ccf21e87f5a15a6850d0ed2ef6a875340656a6440ebd3716f5f3c6b481f3f20ce22acd5d1529d2b450bb194eb2a892a5717eed2
- SSDEEP 3072:6hX0evCgVCHu/KfgQ2gPz8rJZfiucwcngahVNixKNE4:6hX0evCgVcc0V7CZiDhlXl
- TLSH T10BF37D22BA98C232DADF3275246DF66B62BDD1908B6001C72B945FDEED743D05E3418B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
39:f4:4f:ef:7e:a2:56:9f:f6:7c:cc:ad:bd:ac:15:d4:f0:1c:0e:1d:5d:6a:77:58:24:39:85:42:8e:10:c0:0b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
43:33:29:1f:02:c7:7c:c0:26:7d:cc:e4:ab:b9:63:af:ad:45:2a:29
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 5, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a6:fd:52:e0:8b:16:27:3f:00:00:00:00:00:00:a6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
3
Major OS version
6
Entry point
108856
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
KernelTraceControl.pdb
msvcrt
?terminate@@YAXXZ
_stricmp
_memicmp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_mbsstr
strrchr
towlower
wcstol
memmove
memchr
wcschr
wcsncmp
_vscwprintf
vswprintf_s
_wcsicmp
_gmtime64
_purecall
??0exception@@QAE@XZ
_callnewh
_CxxThrowException
memset
calloc
iswdigit
_wcsnicmp
_vsnwprintf
_wcslwr_s
wcscspn
wcsspn
ldiv
wcsstr
realloc
_errno
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
wcscpy_s
memcpy_s
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
free
malloc
memmove_s
wcsrchr
memcpy
user32
UnregisterClassA
ole32
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
SysAllocString
kernel32
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPopEntrySList
VirtualFree
GetWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetModuleHandleW
WriteFile
GetTempFileNameW
GetTempPathW
DeleteFileW
FindResourceExW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
CreateDirectoryW
UnmapViewOfFile
CreateFileW
GetFileSize
GetDllDirectoryW
SetDllDirectoryW
GetSystemInfo
GetModuleFileNameW
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
FreeLibrary
GetLastError
GetProcAddress
LocalAlloc
LoadLibraryExA
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
OutputDebugStringA
CreateFileMappingW
MapViewOfFileEx
CloseHandle
FindResourceW
LoadResource
InterlockedPushEntrySList
LockResource
SizeofResource
GetSystemDirectoryW
GetSystemWindowsDirectoryW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
LoadLibraryW
SystemTimeToFileTime
FlushInstructionCache
advapi32
ProcessTrace
RegisterTraceGuidsW
ControlTraceW
UnregisterTraceGuids
OpenTraceW
CloseTrace
EventWrite
RegEnumKeyExW
EnableTraceEx
StartTraceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
TraceEvent
version
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
CreateMergedTraceFile
DllCanUnloadNow
StartKernelTrace
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=205, version=65501,
count=14, id=206, version=65501,
count=179, id=1, productName=Unmarked objects,
count=15, id=203, version=65501,
count=1, id=202, version=65501,
count=17, id=211, version=65501,
count=10, id=207, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
FrameGlass/x86/KernelTraceControl.dll
- IMPHASH f1e2ead0c3315673dc5317594ec39ad7
- SHA256 7a4b8319f36304a7686576ea130a351818f73fabf90c511e243b957fdfa8cbb0
- MD5 a8476f5242697891eda4c2054cf214bb
- SHA1 86cc262672d6f66c363003c9f17415b680732b74
- SHA512 e23d9f49a69cfaa6f090dba7d733daebe2c4d568b9c7bdfb182ea1cca1bbbf2f158398a3a7ba060bc5c1b534c6b21949b9de18568a94a93498c249bcb67b39bb
- SSDEEP 3072:zfy2AZ6BpwtCsY6Xs5D6lp5s/VtCU1rOKvYEWbktusXB4FutodqEFcyG:jyZ6Dwost8DO0dtAqYErtusXWMtokyG
- TLSH T161044A32A998C576DBCB36B4151DB237A1BDE6A00B6142C7575C6FFAAC283C05E3418B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ed:37:09:67:78:f5:4d:68:00:55:57:21:7a:53:92:2b:c0:5e:fa:ec:cd:7e:ce:44:85:db:28:f9:96:51:4e:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 5, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:30:4b:5d:89:ac:e6:70:47:00:00:00:00:01:52
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
135680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
KernelTraceControl.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__gmtime64
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__memicmp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o_calloc
_o_ceil
_o_free
_o_iswdigit
_o_malloc
_o_realloc
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wmemcpy_s
_except_handler4_common
__current_exception
__current_exception_context
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o__callnewh
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcschr
wcsrchr
strrchr
wcsstr
_CxxThrowException
__CxxFrameHandler3
memchr
memcpy
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
wcsncmp
wcsspn
wcscspn
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
ReleaseMutex
OpenSemaphoreW
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
RaiseException
api-ms-win-core-com-l1-1-0
CoCreateGuid
CoUninitialize
StringFromGUID2
CoCreateInstance
CoInitializeEx
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetWindowsDirectoryW
GetSystemInfo
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
api-ms-win-eventing-legacy-l1-1-0
EnableTraceEx
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-kernel32-legacy-l1-1-0
CopyFileW
FindResourceW
oleaut32
SysFreeString
SysAllocString
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
CreateProcessW
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetExitCodeProcess
GetCurrentThread
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-1-0
FindResourceExW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
FreeLibrary
GetModuleHandleW
SizeofResource
GetModuleHandleExW
LockResource
LoadResource
GetModuleFileNameA
ntdll
RtlGetVersion
RtlAcquireSRWLockExclusive
RtlImageDirectoryEntryToData
RtlImageRvaToVa
RtlReleaseSRWLockExclusive
api-ms-win-eventing-consumer-l1-1-0
ProcessTrace
CloseTrace
OpenTraceW
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
api-ms-win-core-file-l1-1-0
FindNextFileW
GetFileAttributesW
WriteFile
SetFilePointer
SetFilePointerEx
CreateDirectoryW
GetFileSize
GetFinalPathNameByHandleW
CreateFileW
FindFirstFileW
GetTempFileNameW
FindClose
DeleteFileW
FindFirstVolumeW
FindVolumeClose
QueryDosDeviceW
FindNextVolumeW
ReadFile
api-ms-win-core-file-l1-2-0
GetTempPathW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
MapViewOfFileEx
VirtualQuery
CreateFileMappingW
VirtualProtect
api-ms-win-core-wow64-l1-1-0
Wow64RevertWow64FsRedirection
IsWow64Process
Wow64DisableWow64FsRedirection
api-ms-win-core-version-l1-1-0
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-heap-l1-1-0
HeapSize
GetProcessHeap
HeapFree
HeapDestroy
HeapReAlloc
HeapAlloc
CreateMergedTraceFile
DllCanUnloadNow
StartHeapTrace
StartKernelTrace
UpdateHeapTrace
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=75, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1246, id=1, productName=Unmarked objects,
count=3, id=259, version=29395,
count=25, id=261, version=29395,
count=1, id=256, version=29395,
count=25, id=264, version=29395,
count=2, id=253, version=29395,
count=12, id=260, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
FrameGlass/x86/msdia140.dll
- IMPHASH 22f7d3c56b2a5ae9eec3a42b22a78c69
- SHA256 db546904a0824c78134a75b366a45434ed7745e4a4782628414e37fd0254c30b
- MD5 22390862b2ff748bc827178444996cb6
- SHA1 3df9b1132440618ff2b1f78abc76ed5bf887c9cf
- SHA512 ffb6bc9c230d3999679f334e91a074bfe6bf8d19e82c1d58d874f22c4edfb67b6402b1755423819f8465d6e437a6cf2837da2ec94613c7aa97970b801715d1aa
- SSDEEP 49152:PXhDT0VqDcjpx2h1Soi59QPrCz9GkTksgw5oi3j3jI8svq:N8qSx2hUop4G+f
- TLSH T14BA54C31E64E9675CA8E10309C7E7B5F62ACB96E0B1044D373B46A3D9C316E32B34697
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:58:43:2e:1a:25:1c:cb:b7:95:83:8b:b8:cc:7b:01:ec:a8:42:a7:c7:58:cd:1d:b1:e2:c0:52:97:3b:91:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:05:3c:75:6c:82:44:87:cd:fe:00:01:00:00:02:05
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
1022000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\x86ret\bin\i386\msdia140.pdb
kernel32
SetLastError
FindResourceExW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
LoadLibraryExW
GetProcAddress
LocalAlloc
LocalFree
GetModuleFileNameW
GetLastError
GetSystemInfo
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
CloseHandle
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
RaiseException
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwind
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetFullPathNameW
SetStdHandle
GetFileType
SetFilePointerEx
ReadFile
GetConsoleMode
ReadConsoleW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
WriteFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
GetCurrentDirectoryW
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
WriteConsoleW
VirtualAlloc
VirtualFree
GetFileAttributesW
SetFileAttributesW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteFileW
OutputDebugStringA
DeviceIoControl
Sleep
MapViewOfFileEx
ExpandEnvironmentStringsW
GetFileAttributesExW
FormatMessageA
TryAcquireSRWLockExclusive
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
GetSystemTimePreciseAsFileTime
GetLogicalProcessorInformationEx
CompareRE
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=259, version=30795,
count=180, id=261, version=30795,
count=24, id=260, version=30795,
count=25, id=259, version=35207,
count=37, id=260, version=35207,
count=101, id=261, version=35207,
count=3, id=257, version=30795,
count=167, id=1, productName=Unmarked objects,
count=33, id=265, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=151,
count=1, id=258, version=35207,