apppatch.zip
- SHA256 4af09ed623747dfc31bf695b1a1481e4f896b8ea8779113ddeb9fa49b1409782
Overview
overview
3Static
static
3apppatch.zip
windows10-2004-x64
1apppatch.zip
windows11-ltsc_2024-x64
1apppatch/0...in.sdb
windows10-2004-x64
3apppatch/0...in.sdb
windows11-ltsc_2024-x64
3apppatch/0...in.sdb
windows10-2004-x64
3apppatch/0...in.sdb
windows11-ltsc_2024-x64
3apppatch/A...st.dll
windows10-2004-x64
1apppatch/A...st.dll
windows11-ltsc_2024-x64
1apppatch/A...t2.dll
windows10-2004-x64
1apppatch/A...t2.dll
windows11-ltsc_2024-x64
1apppatch/A...st.dll
windows10-2004-x64
3apppatch/A...st.dll
windows11-ltsc_2024-x64
3apppatch/A...t2.dll
windows10-2004-x64
3apppatch/A...t2.dll
windows11-ltsc_2024-x64
3apppatch/AcRes.dll
windows10-2004-x64
1apppatch/C...1}.sdb
windows10-2004-x64
3apppatch/C...1}.sdb
windows11-ltsc_2024-x64
3apppatch/D...ps.sdb
windows10-2004-x64
3apppatch/D...ps.sdb
windows11-ltsc_2024-x64
3apppatch/D...OD.sdb
windows10-2004-x64
3apppatch/D...OD.sdb
windows11-ltsc_2024-x64
3apppatch/M...in.sdb
windows10-2004-x64
3apppatch/M...in.sdb
windows11-ltsc_2024-x64
3apppatch/M...in.sdb
windows10-2004-x64
3apppatch/M...in.sdb
windows11-ltsc_2024-x64
3apppatch/M...in.sdb
windows10-2004-x64
3apppatch/M...in.sdb
windows11-ltsc_2024-x64
3apppatch/M...in.sdb
windows10-2004-x64
3apppatch/M...in.sdb
windows11-ltsc_2024-x64
3apppatch/M...ge.sdb
windows10-2004-x64
3apppatch/M...ge.sdb
windows11-ltsc_2024-x64
3apppatch/M...ge.sdb
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
apppatch.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
apppatch.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
apppatch/01DD4AD9E381DA46.sysmain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
apppatch/01DD4AD9E381DA46.sysmain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
apppatch/01DD4AD9E849C5E5.msimain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
apppatch/01DD4AD9E849C5E5.msimain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
apppatch/AcPluginDlls/Plugin/AcPlugin_Test.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
apppatch/AcPluginDlls/Plugin/AcPlugin_Test.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
apppatch/AcPluginDlls/Plugin/AcPlugin_Test2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
apppatch/AcPluginDlls/Plugin/AcPlugin_Test2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
apppatch/AcRes.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
apppatch/CustomSDB/{22221111-1111-1111-1111-111111111111}.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
apppatch/CustomSDB/{22221111-1111-1111-1111-111111111111}.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
apppatch/DirectXApps.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
apppatch/DirectXApps.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
apppatch/DirectXApps_FOD.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
apppatch/DirectXApps_FOD.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
apppatch/MergeSdbFiles/01DA54B25CE0D000.msimain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
apppatch/MergeSdbFiles/01DA54B25CE0D000.msimain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
apppatch/MergeSdbFiles/01DA54B25CE0D000.sysmain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
apppatch/MergeSdbFiles/01DA54B25CE0D000.sysmain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
apppatch/MergeSdbFiles/01DA78C738588000.msimain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
apppatch/MergeSdbFiles/01DA78C738588000.msimain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
apppatch/MergeSdbFiles/01DA78C738588000.sysmain.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
apppatch/MergeSdbFiles/01DA78C738588000.sysmain.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
apppatch/MergeSdbFilesSource/msiMerge.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
apppatch/MergeSdbFilesSource/msiMerge.sdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
apppatch/MergeSdbFilesSource/sysMerge.sdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target apppatch.zip
- Size 5.3MB
- Sample261026-sshngstw3q
- SHA256 4af09ed623747dfc31bf695b1a1481e4f896b8ea8779113ddeb9fa49b1409782
- MD5 255079e9e099decefce8d891e5fc3fcd
- SHA1 489e36c488fee62f8aefb4722006b566951ee4fa
- SHA512 6c455319d17ab5df3591fb7064fddafc1e3c3eed14f2e536d37a2f410aa259b5f16994ef78d0e9955cf36a3d422555d731ea3bc5d2d04ae8821343cb8a227c71
- SSDEEP 98304:2IsGIpg7UV259KaFl+KfC/pHZKuZ3bmkDvsvrr/AowkXqxspnzFGCUxI9/:2IsGIuQV2J+KWZKuZLm8svX4owkXRpz/
- TLSH T1DE4633C9D885AAFDC35A56F6B03902E77BFE5D22EE495DD1AF6CE05098090317C840AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/apppatch/en-US/AcRes.dll.mui
File Explorer
-
apppatch.zip.zip 5.3MB
-
apppatch/01DD4AD9E381DA46.sysmain.sdb4.0MB
-
apppatch/01DD4AD9E849C5E5.msimain.sdb3.3MB
-
apppatch/AcPluginDlls/Plugin/AcPlugin_Test.dll.dll 118KB
-
apppatch/AcPluginDlls/Plugin/AcPlugin_Test2.dll.dll 119KB
-
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test.dll.dll 99KB
-
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test2.dll.dll 100KB
-
apppatch/AcRes.dll.dll 345KB
-
apppatch/CustomSDB/{22221111-1111-1111-1111-111111111111}.sdb3KB
-
apppatch/DirectXApps.sdb1.5MB
-
apppatch/DirectXApps_FOD.sdb1.5MB
-
apppatch/MergeSdbFiles/01DA54B25CE0D000.msimain.sdb6KB
-
apppatch/MergeSdbFiles/01DA54B25CE0D000.sysmain.sdb79KB
-
apppatch/MergeSdbFiles/01DA78C738588000.msimain.sdb1KB
-
apppatch/MergeSdbFiles/01DA78C738588000.sysmain.sdb2KB
-
apppatch/MergeSdbFilesSource/msiMerge.sdb6KB
-
apppatch/MergeSdbFilesSource/sysMerge.sdb79KB
-
apppatch/drvmain.sdb329KB
-
apppatch/drvpatch.sdb1KB
-
apppatch/en-US/AcRes.dll.mui.dll 326KB
-
apppatch/frxmain.sdb4KB
-
apppatch/msimain.sdb3.3MB
-
apppatch/pcamain.sdb63KB
-
apppatch/shellFeatureInbox.sdb13KB
-
apppatch/sysmain.sdb3.9MB
apppatch/01DD4AD9E381DA46.sysmain.sdb
- SHA256 3a215058927c32ba3d16703a9b435eb0ee137db337dff65bf43881a1c26f0dae
- MD5 f09e8657abddc067d77d54ccc6b753e5
- SHA1 bedfb3d5588724ce05cae8dcc0c74e9f492c173c
- SHA512 8a0f40398a2b1dd7e4ba29514a3268ec76e9a2779affaa18248e98693ba92963b04c3e3f951f84ca0c45dfbd0aae4ab5c74049b4df2ff0f74987ca73be33624a
- SSDEEP 24576:3EJWjkpS7wF68IwI8cE7Vq6FUpNVsYL06nxtxVyu3RC/WYERQwJq+Si9Hp08tYkq:3qWjkw7CjAEUZpNWJ6nUyRQd6AH
- TLSH T180163E375FF61302F6F696725BF583CC5E237A259922860CC5883A5E1821A30FE61F76
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/01DD4AD9E849C5E5.msimain.sdb
- SHA256 0873a95ae766a86af61a0facda4511638acede0bc1a91a70f0a5d9c9403fdd2b
- MD5 adc6d85f1f781ab90aa13af23f8dd60d
- SHA1 390a14d962de3086cab5a5c5db01a66d0663dce2
- SHA512 471b6c1ec8532b484f679cfef56041e6f6d6eafbf233d5b77fc7e9ccf7c8d947d965f564622e225577a631c44b17c225971f2fa6adc2c30e1ca7686b99b87e53
- SSDEEP 12288:NwVVyLnMEbLfVVgOmZE9F6b2rhDOptlJKN1vweCHwMeEsRO:/RBVRmMF6b2rhDOptlJK4euloO
- TLSH T19AF595337FF54511F0F6AAB0DFF182495A32FC91DD21960EA491B70E1A71A80ADA1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/AcPluginDlls/Plugin/AcPlugin_Test.dll
- IMPHASH ebeae7d93c6f397530cc3feee02d4ebc
- SHA256 d891ecba5a22e89da9112084fc223e03a1afd30f7b3d27a6be27474c4ebc4f91
- MD5 50612c44ed978363773804e93b577efa
- SHA1 7207b4a913cf5a57ac1393c5364ae29e2a711f5a
- SHA512 d1beea9fb4a7dec37e3ee9654b9c265580a74df0faf96772ffac4ab76f4af240bf2a547b5838cf0daffa5deb5f7b0d30fdb46c5b1bc3a23a7b08e18313d5cda4
- SSDEEP 3072:wLR2am8Yuk4SuCqIwd2GgzsOpgyzfWHDrB7ijPGyuIWC+vmXO/2iePL3zfbHPyeO:ePZTXIw50eW0
- TLSH T1B8C35B57A3B500BBE5B78638C5A74A09EB76B8410762ABEF0394425A1F233D18D3DF31
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:0d:a9:df:c5:d9:a1:5f:fe:43:60:2e:1e:05:a4:3a:9e:8d:f0:45:53:fc:5b:f2:50:bd:86:c0:48:8d:53:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:85:5e:99:ec:0e:59:2f:cd:d7:00:00:00:00:04:85
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
6848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\x64\Release\AcPlugin_Test.pdb
apphelp
SE_GetShimId
SE_ShimDPF
ntdll
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeHeap
RtlAllocateHeap
RtlPcToFileHeader
kernel32
HeapSize
WriteConsoleW
CreateFileW
GetProcessHeap
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
CloseHandle
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetStringTypeW
HeapReAlloc
GetHookAPIs
NotifyShims
Name
.text
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=31, id=261, version=35207,
count=2, id=257, version=33145,
count=5, id=257, version=30795,
count=100, id=1, productName=Unmarked objects,
count=4, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=151,
count=1, id=258, version=33145,
apppatch/AcPluginDlls/Plugin/AcPlugin_Test2.dll
- IMPHASH bede71c1509597e0e0e04ad29174c5c6
- SHA256 0f5b4758fd2b95515c5941f49e0cc6a68fa3d9eaeffe5f975528ed9a7395505d
- MD5 7a6260303312daa304d83bbf0a13063a
- SHA1 44aad65489f95d7ec88d6829daafec997426f9ff
- SHA512 3a846a7a4fbee18871be26f15b9cb6b7e40ed4720779159889538ed4844322a62053391725c31d741c97030f3bc2f6c204dd05d8e5285a39030a23e63c2f2a8b
- SSDEEP 3072:TPJQKcbFZLkW9QPEy+xF/GWmATMGJAST/2njLhbCDvmSOo2iePG3ufWCnSl24ISG:TPi51M8y+f2UU
- TLSH T1CFC36B57A3B500BBE1B7863888A78A05D772B95107719FEF07A0824A1F273D08D3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f1:66:fe:4f:72:15:2d:86:0f:8a:e6:45:18:6e:dd:70:b7:62:62:8c:34:39:98:5d:c5:29:7b:ac:6b:a2:7e:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
7552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\x64\Release\AcPlugin_Test2.pdb
apphelp
SE_GetShimId
SE_ShimDPF
ntdll
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeHeap
RtlAllocateHeap
RtlPcToFileHeader
kernel32
HeapSize
WriteConsoleW
CreateFileW
GetProcessHeap
CloseThreadpool
CreateThreadpool
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
CloseHandle
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetStringTypeW
HeapReAlloc
GetHookAPIs
NotifyShims
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=31, id=261, version=35207,
count=2, id=257, version=33145,
count=5, id=257, version=30795,
count=100, id=1, productName=Unmarked objects,
count=3, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=151,
count=1, id=258, version=33145,
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test.dll
- IMPHASH f891a0c56fdabcca5acccfbf34af31d3
- SHA256 23631634bb912bcb6e3095e4f71603b84186c6b260e8b297ef05ba6fc522a97a
- MD5 2352b7a50d390452a732f16eeb4997e8
- SHA1 2f7532bccc585034b2b4230d27967b3261b3c0f4
- SHA512 454abbc47a4579d38112f513ac3cc29fff5baba6e071af9a80c7d26ff40ab93b4d68fe3d72b576dfcc10f0f28e0bb5f9ee85b832ec8ddb4f2fe412ec5e6a7c04
- SSDEEP 3072:5PreJKAjGtjU4DyqoL3kNLn747BJt5JIJrc:5PC7CBU2yFDL5JF
- TLSH T1EEA38D50B4D18035D8BE18341574DA726B7DBA60CFE19CEF276956AA4F313C0EF30A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:11:dc:14:a4:6c:fc:34:4a:9a:6a:f4:45:f3:fc:41:86:77:99:fa:bf:a5:59:be:9f:2d:99:ee:c4:46:60:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
6560
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\Release\AcPlugin_Test.pdb
apphelp
SE_ShimDPF
SE_GetShimId
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlUnwind
kernel32
HeapAlloc
CreateFileW
DecodePointer
GetProcessHeap
GetConsoleMode
GetConsoleOutputCP
CloseHandle
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
WriteConsoleW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetHookAPIs
NotifyShims
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=15, id=260, version=35207,
count=29, id=261, version=35207,
count=2, id=257, version=33145,
count=5, id=257, version=30795,
count=96, id=1, productName=Unmarked objects,
count=4, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=151,
count=1, id=258, version=33145,
apppatch/AcPluginDlls/PluginWowX86/AcPlugin_Test2.dll
- IMPHASH b2e82cec2bdda7374594c4b7f18566e5
- SHA256 a293dbe73a80b8418e6410281caa155b6d615023f70d3734d0a13cbf71d544d3
- MD5 1aeb4480ca7b538ff6309b1301b4128a
- SHA1 651f62c328302b3141e142018e7142da9e14f4db
- SHA512 56fb7792cac2a1d69eac7eda3b18493cb52ac47783b8396dfb1752ef1c4905f2807deebd0a9f68f9305306c9f9eface016986a3442e85724d191e1fa9983623b
- SSDEEP 3072:Ttyg6197Kj/ucwiSWor3EVtZ4mgapD6+:TcpT+mcU5jch6
- TLSH T19BA37C50B5D18035D8BE18340868D9716B3D7A50DFF19DEF276A2A6E4F713C1EE30A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:4e:1f:49:20:7f:ce:06:3a:5c:9d:95:e8:19:a7:34:da:ee:2a:86:8a:a7:d7:e8:a3:67:86:83:8b:b8:a5:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:84:98:e2:12:e0:78:a3:31:5d:00:00:00:00:04:84
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
7152
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\Release\AcPlugin_Test2.pdb
apphelp
SE_ShimDPF
SE_GetShimId
ntdll
RtlAllocateHeap
RtlFreeHeap
RtlUnwind
kernel32
HeapAlloc
CreateFileW
DecodePointer
GetProcessHeap
CloseThreadpool
CreateThreadpool
GetConsoleMode
GetConsoleOutputCP
CloseHandle
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
WriteConsoleW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetHookAPIs
NotifyShims
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35207,
count=15, id=260, version=35207,
count=29, id=261, version=35207,
count=2, id=257, version=33145,
count=5, id=257, version=30795,
count=96, id=1, productName=Unmarked objects,
count=3, id=265, version=33145,
count=1, id=256, version=33145,
count=1, id=255, version=33145,
count=1, id=151,
count=1, id=258, version=33145,
apppatch/AcRes.dll
- SHA256 6045a103cce5c9f4d2fe5ae9cd9151abf46f1f5ddeed59c9da2759aafdd46650
- MD5 44e76207c3a33e16dd4189c07a6132f1
- SHA1 4cb8738f02c12cb3afc7a2b3248f08e7d6ec6e62
- SHA512 44e3eb92ad4dd7ba01dfcffef2636894453d38846adf8e33859d112157aec05c8e6760fb8b06a60ccc30706936412703b51014529c8d373bf1fe658e9e2b4730
- SSDEEP 3072:Byo/mBJrub7YxdJcMvZlW6SqGePnpTNyj9eM1dMxOPUiiyAWgw1:BkJk7EjrCAWP
- TLSH T16274684263FE9608F6F77F746EB822655E3ABCA6AD38D29C1201505D4972E50CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e3:5d:10:dc:0e:c1:c4:be:8b:e9:60:08:2b:6a:fd:c5:33:af:22:d1:a7:3b:ee:91:16:07:5c:16:f6:8f:f0:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2026
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Oct 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
328KB
Virtual Size
326KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
apppatch/CustomSDB/{22221111-1111-1111-1111-111111111111}.sdb
- SHA256 5915aa16df0bfbaa4c1fc9100802ab7e7d66f68a3720ecec70b17953fd5710ec
- MD5 75873be7c3668939504a65a41cf8fff8
- SHA1 b478e6cc89fe77015ab950201ef85c16a8ea82e7
- SHA512 3b2645f6a3e3b44b61b62c1a0c364883d153fa95f8ffe2eb2a9ec420990bf931cd75e52a9c3d995963591cef99866c2d0e4d0cfbb03aeef89c0de828024ff374
- TLSH T13651AB26ABF90301E3F6DA7069BA03D89F3B78166C22D24D8444254E84A2F54FD26F73
- MD5 SHA1 SHA512 TLSH
apppatch/DirectXApps.sdb
- SHA256 a0c58d93ea88511cc24a473da3e2c54da910d4cefe903cd6505f4347486dc3e6
- MD5 1c03051f4a8408ec7eb90dbf11b592a1
- SHA1 dcb34233cf40c8293aa41c3fb891caadc2388972
- SHA512 c113eef968a90ead9cdd224bbaeb33c3d81d8aa3533dc1149940935529a346ddc54bd1a47a187657cd1f4e54f15ec29bd3a984395b55476495dce412161f2006
- SSDEEP 24576:MN3fstUF8dG4tfSn4xmycJqDWrUpfCTbc/Jj3CGC1UNHND9Xdbdl9WBc:C/7n4xm1rUpSA
- TLSH T1AF757B772FF68331E2F1C620D7B6438A6F717849E992468CC644BB0F4621594EF9CE26
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/DirectXApps_FOD.sdb
- SHA256 e9f03570d66343e77dcea4535947a0f7f225cde697e48c4cb4927d646dfd9c6a
- MD5 fa3f1ede5dce58310dd54f821ea61c76
- SHA1 5c9c11548ead49e4db03143c4a13c4bc723aa20a
- SHA512 7b65fd1e29069d7414c91f914d2a3ab5af6892c00ec6e07fb9bb2446cdfbd6ed17186bb0975668d228a8f428f039880a8283bcae3b1bb90678237f75d2e9af51
- SSDEEP 24576:AuZu4UjGeS1T7UDLAOK8XREGUwuckncUqfxOqTs+XxIX1UNHND9XdbdXsEG9:Az5zDLBy2kj1
- TLSH T1837595371FF38621F1F2E620A6B35799AF707818E9A2431CC585BB0F8611558EF9CE25
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/MergeSdbFiles/01DA54B25CE0D000.msimain.sdb
- SHA256 e522e3cac200bc726bf62c5d9105fcf61fd4d7ebbfddfce58335af5074d5ce0b
- MD5 291c0027ec7e215c3ae3ef0b31a57705
- SHA1 3190c3feefc85dc2276af2cf7104f1a48d3773d0
- SHA512 c1dcf7e032dad1e2653934a664e3febfdd27e6978a036d7a56203c7f7a8f17dcaca66867f22b586d02649199fa8292d916a71e8cc6a200f0a096948e205a211e
- SSDEEP 192:jDuwUw2uuTGwIXqSFq2vHGf+MrW8O/KY/gdMXhVxdx3VpKFC:GwUwVUiv/CihVxdx3VpKFC
- TLSH T16BD1AC7217B80303F0F4AAB27DA9428A5EB27D60CE62939CC419368D2574AD46CB1F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/MergeSdbFiles/01DA54B25CE0D000.sysmain.sdb
- SHA256 375b9daf8ec47c4e4dd1777841830e6e37a943da0fc5c38d2bc6ee812b1f7091
- MD5 a2767a8a7dbfc01d9bccec1b15c56036
- SHA1 329dfbe7b6f780016a99e0cb714806c2808d9726
- SHA512 a6640d8f3404dfda2981c0c6a4a2978cb02a75ba0b292fa93c9728da93ea63960f6d425fc1603c18cf366b33e285af6e7ba37e0db897dc810cfec6192865c4b9
- SSDEEP 1536:cIpGgp/KYC3lRhtOX4LrWiyqEgzs0KRK2bmVNSPdiXe:5pyVV/tzyNRK2bwNSPdiXe
- TLSH T1AB83FA675FF65314F5F69630ABF183C85F377866AA218A0CC2587E0E15219A0FE21F36
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/MergeSdbFiles/01DA78C738588000.msimain.sdb
- SHA256 f372ea707e8681990e11a3764915953be655875c003ba8cd44adb1011981bd61
- MD5 c3220b8f2aefc15ff294bf5c65b27db9
- SHA1 a2d88554c6941e9315177dba7bb0ed72272d0b98
- SHA512 9628b1107d79b5e2400be03270670c233aea6fdda49ee717640091023cb8096a2da5df963cd9c0ba1b520414674fb96607aedaeb9f6ab2477abdf3bdb91e3dc4
- TLSH T1D231D813BFEA1300F2FBAB622ABA12DC0F3B7E206D35C60A5104244D0563B56BC20F23
- MD5 SHA1 SHA512 TLSH
apppatch/MergeSdbFiles/01DA78C738588000.sysmain.sdb
- SHA256 c7d1fd3df2381dee8a294b8211fe763ef5350b3df3918dd78d7fd0715e348748
- MD5 de115a13a31a54dd5afbb194552c7d7f
- SHA1 e90e2402466498498c97f59969d30a6d52f1924a
- SHA512 9c3a36b76c31b26dd0a086c0a2215034b326c38131d10ed71107ed4e2900bdbb0d4e99de73a1c7597820d2985daed224db68738befe2726aec28effcd5492048
- TLSH T13341BA136BF61565F1FBEB310AB793988F3A79A06D30C05DD10864AC48A2354AE75F37
- MD5 SHA1 SHA512 TLSH
apppatch/MergeSdbFilesSource/msiMerge.sdb
- SHA256 e522e3cac200bc726bf62c5d9105fcf61fd4d7ebbfddfce58335af5074d5ce0b
- MD5 291c0027ec7e215c3ae3ef0b31a57705
- SHA1 3190c3feefc85dc2276af2cf7104f1a48d3773d0
- SHA512 c1dcf7e032dad1e2653934a664e3febfdd27e6978a036d7a56203c7f7a8f17dcaca66867f22b586d02649199fa8292d916a71e8cc6a200f0a096948e205a211e
- SSDEEP 192:jDuwUw2uuTGwIXqSFq2vHGf+MrW8O/KY/gdMXhVxdx3VpKFC:GwUwVUiv/CihVxdx3VpKFC
- TLSH T16BD1AC7217B80303F0F4AAB27DA9428A5EB27D60CE62939CC419368D2574AD46CB1F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/MergeSdbFilesSource/sysMerge.sdb
- SHA256 375b9daf8ec47c4e4dd1777841830e6e37a943da0fc5c38d2bc6ee812b1f7091
- MD5 a2767a8a7dbfc01d9bccec1b15c56036
- SHA1 329dfbe7b6f780016a99e0cb714806c2808d9726
- SHA512 a6640d8f3404dfda2981c0c6a4a2978cb02a75ba0b292fa93c9728da93ea63960f6d425fc1603c18cf366b33e285af6e7ba37e0db897dc810cfec6192865c4b9
- SSDEEP 1536:cIpGgp/KYC3lRhtOX4LrWiyqEgzs0KRK2bmVNSPdiXe:5pyVV/tzyNRK2bwNSPdiXe
- TLSH T1AB83FA675FF65314F5F69630ABF183C85F377866AA218A0CC2587E0E15219A0FE21F36
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/drvmain.sdb
- SHA256 40319748e62fffc5d296c0f128bb1f9dbbbf74ee3c190b8439ce29ff21ec8ad3
- MD5 d9f599c57788da3bd5f228ecffe1b016
- SHA1 e50bed198d79d4a7a22ea96683a1154c413cdff1
- SHA512 c9b5f7d47d57bfe7ee2ac38d5657d733e7cf2f0c4c5affadbfbd8761b42941b83f1dc8b82ba2934c99b90c6e2c5e4c75a2a0457dee6a398aaf9d64d3c0b0ecba
- SSDEEP 3072:EOH2UDRYdC5o1AMwcdfBWX7T5zdts08HCZ711PeEmxS1qXndKichczpDZNKrrNbN:xbRM+o1XW8CS4czpDZ4HPPz
- TLSH T1C5742437ABFA0650E5F6D5B197DF83BF6A3534A269225328C9AD370D2250C00ED63D6C
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/drvpatch.sdb
- SHA256 f6b54e4c5eea0d2444c39a596fd350a84e1035bd00ff284223d13bfc09e14d0f
- MD5 efe757dc374b22f96b92f511d930c19a
- SHA1 fa7acdf8269619a741d0f67952251ff9fc55daa9
- SHA512 a3da5a11c7da6727afe2934334872ace46074bcbe4a1726cb4f25c6d7aee9b7b416cb0113dca6975d93ab13ab0e5e00e74432582ef371f8959fa124b8d4a04a5
- TLSH T1AE415826E7F80202F7F69F30AAB603D8AF3BBC666D21D24D8554614D0461B64EC71B73
- MD5 SHA1 SHA512 TLSH
apppatch/en-US/AcRes.dll.mui
- SHA256 90b3d8548ed99b0adf96c1b172f1603a212912f3df40cd4b439c1e3e72d1f988
- MD5 453d0fd60aa935c772eed61e153e89fa
- SHA1 afcd478e0edddf7b65861a23b725ce8e931d03bb
- SHA512 0be9a4b0c4fa5ca7dab883d1405a6ef59751e3ef1de688d7e68843ae5cc24e6e55bb8e08ccedc6942c8e4cc2a25d768792842535ee2d29384527e8ad4b27ab29
- SSDEEP 3072:SnB/muSoubUHxeatB7ZOhOhyibIn8TNyj4Tc1dMWOOUiibAa1:SZSbU94nRDX2
- TLSH T190646A41A3FE9608F6F77F646EF922644E7ABCA6AD38D29C1201505D4972E50CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
325KB
Virtual Size
325KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=33145,
count=1, id=258, version=33145,
apppatch/frxmain.sdb
- SHA256 cc57e19be8ec3d74339748b228671f6bf074473277199632c2784b560fc4a392
- MD5 ce2c44dd48a234faeff33eba75738a2b
- SHA1 d357eec7fde5dc7d0fcdbd774e55ca472aaebdf5
- SHA512 99d5dc9c461dec59f4318d86d6a43a49262fd8b8ba90ecb8d6dcbcd5faf47b6a6d77c1278f8dac6c557f01a680feb0bb87c2d2f59e4a9aede36a97b50dc6b8ed
- SSDEEP 96:xW44WWiHUlzi+hmezii+C8i+lmi+siD4yiDO3iDOmSEi7nSEi7dzi+NrSEi797hU:hMMUlzhwezihC8hlmhss4ysO3sOmSEge
- TLSH T12881BD276FAB0340E1E2F870A5E7838BDF3638449C63135AC04CF75E9B20458EEA9E11
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/msimain.sdb
- SHA256 9252d154984dad7b0ef635ea36fc406f8ca6ef3b8bcb0df3bbf6e0090230d735
- MD5 9de61c623915b7256643932dab69642b
- SHA1 9ed32d4099197c384566002058636fc12d5dc503
- SHA512 11bea0f513d5332bc4bb2df1a19cad47caca145ed8c19cd6de39ba6178bc556ce769e3a95ce28719c3e29350b951ff96212b1997bdfe7818f7fea1565c952b5a
- SSDEEP 12288:BI3lpH/lEnHhtVVQOmSW/Pg2trFtPLlfr9BdmUcDVdEiNYttvxsCL8XkrXE85oDs:sHdaZVhmH/Pg2trFtPLlfEkhwTTOlGl+
- TLSH T179F585737FF98111F0E6AA70DFF1824D5A26BC86DD32860FA191B70E5A70980ED51F62
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/pcamain.sdb
- SHA256 505eb81c61d9f9350c98483bb9db1d0595b9e20439bf4247a66fc8a29379736b
- MD5 256de65d167c23a6389ac4c8e20b5ff5
- SHA1 1fa380c075b3bef863a015d2d9fca833d791b343
- SHA512 c5a415fc14a132574ebb1f31ac4ec6018a0da58ab09b1565fc210f68450a831d71453312111efb81fec5bd13f65e99aee7105a6253e4abf88c7109cdabc0193a
- SSDEEP 768:AHLAbC7/Z1tIfwOUyqTbwIa0XrKi5aYTvPJA24LMfR20h0WVoc:AHL77/ZswOUjHXrJ5W24LMk0voc
- TLSH T147538A366BF61304F2F6CA309AF8879D1F6279174970EB1CC6583E5E2125868BD50F3A
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/shellFeatureInbox.sdb
- SHA256 94903253b674d82589abad400fa8d083066ec2e6058d3db2ad306ac79e797aea
- MD5 1e172eaa501bcc2251f46a2a682db975
- SHA1 1e5055c0e0cb1038ef9041dc9ff8f42ac8d9757b
- SHA512 7a89807fff0bb3df18a90cf6019051f09b8feeaed47d6d92e8bf00a25ecb05fdcde11174d733f4569afff525a11e1540d6a99ed4739fb2d48bbd8d2ac87a4ed5
- SSDEEP 384:3f79BALzBTa6g4RA+gtYJZUay8oSoJstgXzLq9svARGXP7/:vZBALzBTa6Jr7NwzLq9svARG/7/
- TLSH T19B52AD374FFA5321F1F2C924A9B187CD7E723815A812EA0DC418BA4F0061959FDA1FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
apppatch/sysmain.sdb
- SHA256 f443b158917e982f74c7db3e166e8dd8fa046b2482345a108d8ffdf9923935de
- MD5 ccd9a0f1743e400032e19d4b675b6042
- SHA1 6d6323d16a1900ed5ebce7e05e8800d6d9aef8bb
- SHA512 e4035e44b78f14bc59ba0dcbe9e6311d200272ce4d481478536077a1a68f46a1c6ca938d30d2a4a7185f5d7d3b3dc315c6b67785f8c6f56705ee86646549aab2
- SSDEEP 24576:CAIXYoPGjiLasP6fse0e3Pzi1gZV4C/dCyzuozKAFpr9SyxwOpDRaji84B:CrXY0GjSnP0seTpZaC/d3/r9kDC
- TLSH T148163D3B5FFA1300F1F69A359AF583DD5E227E658921960CC58C3A8E5931A10FE20F76
- MD5 SHA1 SHA512 SSDEEP TLSH