msixx.msix.zip
- SHA256 e5634f9e2668fffdaffe257bbe4d8eee07c02fb9435fe82c753387f544f87cf0
-
Unsigned File
Checks for missing codesigning on a file that is often signed.
Overview
overview
3Static
static
3msixx.msix.appx
windows10-2004-x64
msixx.msix.appx
windows11-ltsc_2024-x64
AppName.dll
windows10-2004-x64
1AppName.dll
windows11-ltsc_2024-x64
1AppName.exe
windows10-2004-x64
1AppName.exe
windows11-ltsc_2024-x64
1DirectML.dll
windows10-2004-x64
1DirectML.dll
windows11-ltsc_2024-x64
1Microsoft....64.dll
windows10-2004-x64
1Microsoft....64.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....re.dll
windows11-ltsc_2024-x64
1Microsoft....re.dll
windows10-2004-x64
1Microsoft....re.dll
windows11-ltsc_2024-x64
1Microsoft....ry.dll
windows10-2004-x64
1Microsoft....ry.dll
windows11-ltsc_2024-x64
1Microsoft.WinUI.dll
windows10-2004-x64
1Microsoft.WinUI.dll
windows11-ltsc_2024-x64
1Microsoft....ng.dll
windows10-2004-x64
1Microsoft....ng.dll
windows11-ltsc_2024-x64
1Microsoft....sk.dll
windows10-2004-x64
1Microsoft....sk.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....ET.dll
windows10-2004-x64
1Microsoft....ET.dll
windows11-ltsc_2024-x64
1Microsoft....ap.dll
windows10-2004-x64
1Microsoft....ap.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
msixx.msix.appx
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
msixx.msix.appx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
AppName.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AppName.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
AppName.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
AppName.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
DirectML.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
DirectML.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft.DiaSymReader.Native.amd64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft.DiaSymReader.Native.amd64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Microsoft.InteractiveExperiences.Projection.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Microsoft.InteractiveExperiences.Projection.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Microsoft.Web.WebView2.Core.Projection.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Microsoft.Web.WebView2.Core.Projection.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Microsoft.Win32.Registry.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Microsoft.Win32.Registry.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Microsoft.WinUI.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Microsoft.WinUI.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Microsoft.Windows.AI.MachineLearning.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Microsoft.Windows.AI.MachineLearning.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Microsoft.Windows.SDK.NET.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Microsoft.Windows.SDK.NET.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Microsoft.WindowsAppRuntime.Bootstrap.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Microsoft.WindowsAppRuntime.Bootstrap.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target msixx.msix.zip
- Size 28.7MB
- Sample261101-sd17aac15p
- SHA256 e5634f9e2668fffdaffe257bbe4d8eee07c02fb9435fe82c753387f544f87cf0
- MD5 22f55855b2e81d140b243309fd13d692
- SHA1 92a7471b01f98f9818bd47a56c8302fd69352f83
- SHA512 2bf7005f1f12fb550e44170c47bdf6d57d2aa89ac86ae6514e798380fb30355db1269b6ed02f6db6e429b9b492c6a0dda5973a9892093c0c3c35f67e4ba5b345
- SSDEEP 786432:czduHaRIDNRLFvfVm3s2OhpihkuEAgA0hNb:ZHaRgLOOfiq3VthJ
- TLSH T12E6733B632FAE056DB0B0D35957B0473B2E149CC0DBEAE0983BF341B905A9F9535849E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned File 1 IoCs
Checks for missing codesigning on a file that is often signed.
resource msixx.msix.zip - Unsigned PE 31 IoCs
Checks for missing Authenticode signature.
resource unpack001/AppName.dll unpack001/AppName.exe unpack001/Microsoft.InteractiveExperiences.Projection.dll unpack001/Microsoft.Web.WebView2.Core.Projection.dll unpack001/Microsoft.Win32.Registry.dll unpack001/Microsoft.WinUI.dll unpack001/Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll unpack001/Microsoft.Windows.SDK.NET.dll unpack001/System.Collections.Concurrent.dll unpack001/System.Collections.Immutable.dll unpack001/System.Collections.NonGeneric.dll unpack001/System.Collections.Specialized.dll unpack001/System.Collections.dll unpack001/System.ComponentModel.Primitives.dll unpack001/System.ComponentModel.TypeConverter.dll unpack001/System.ComponentModel.dll unpack001/System.Diagnostics.Process.dll unpack001/System.Diagnostics.StackTrace.dll unpack001/System.IO.Compression.dll unpack001/System.IO.MemoryMappedFiles.dll unpack001/System.Linq.Expressions.dll unpack001/System.Linq.dll unpack001/System.ObjectModel.dll unpack001/System.Private.CoreLib.dll unpack001/System.Private.Uri.dll unpack001/System.Reflection.Metadata.dll unpack001/System.Runtime.InteropServices.dll unpack001/System.Security.Cryptography.dll unpack001/System.Web.HttpUtility.dll unpack001/System.dll unpack001/WinRT.Runtime.dll
File Explorer
-
msixx.msix.zip.appx 28.7MB
-
AppName.deps.json16KB
-
AppName.dll.dll 72KB
-
AppName.exe.exe 148KB
-
AppName.runtimeconfig.json1KB
-
AppxBlockMap.xml.xml 90KB
-
AppxManifest.xml3KB
-
AppxSignature.p7x13KB
-
Assets/LargeTile.scale-100.png.png 6KB
-
Assets/LargeTile.scale-125.png.png 8KB
-
Assets/LargeTile.scale-150.png.png 10KB
-
Assets/LargeTile.scale-200.png.png 14KB
-
Assets/LargeTile.scale-400.png.png 38KB
-
Assets/LockScreenLogo.scale-200.png.png 432B
-
Assets/SmallTile.scale-100.png.png 1KB
-
Assets/SmallTile.scale-125.png.png 2KB
-
Assets/SmallTile.scale-150.png.png 2KB
-
Assets/SmallTile.scale-200.png.png 3KB
-
Assets/SmallTile.scale-400.png.png 8KB
-
Assets/SplashScreen.scale-100.png.png 6KB
-
Assets/SplashScreen.scale-125.png.png 8KB
-
Assets/SplashScreen.scale-150.png.png 10KB
-
Assets/SplashScreen.scale-200.png.png 15KB
-
Assets/SplashScreen.scale-400.png.png 42KB
-
Assets/Square150x150Logo.scale-100.png.png 2KB
-
Assets/Square150x150Logo.scale-125.png.png 3KB
-
Assets/Square150x150Logo.scale-150.png.png 4KB
-
Assets/Square150x150Logo.scale-200.png.png 6KB
-
Assets/Square150x150Logo.scale-400.png.png 13KB
-
Assets/Square44x44Logo.altform-lightunplated_targetsize-16.png.png 730B
-
Assets/Square44x44Logo.altform-lightunplated_targetsize-24.png.png 1KB
-
Assets/Square44x44Logo.altform-lightunplated_targetsize-256.png.png 14KB
-
Assets/Square44x44Logo.altform-lightunplated_targetsize-32.png.png 1KB
-
Assets/Square44x44Logo.altform-lightunplated_targetsize-48.png.png 2KB
-
Assets/Square44x44Logo.altform-unplated_targetsize-16.png.png 730B
-
Assets/Square44x44Logo.altform-unplated_targetsize-256.png.png 14KB
-
Assets/Square44x44Logo.altform-unplated_targetsize-32.png.png 1KB
-
Assets/Square44x44Logo.altform-unplated_targetsize-48.png.png 2KB
-
Assets/Square44x44Logo.scale-100.png.png 1KB
-
Assets/Square44x44Logo.scale-125.png.png 2KB
-
Assets/Square44x44Logo.scale-150.png.png 2KB
-
Assets/Square44x44Logo.scale-200.png.png 3KB
-
Assets/Square44x44Logo.scale-400.png.png 7KB
-
Assets/Square44x44Logo.targetsize-16.png.png 546B
-
Assets/Square44x44Logo.targetsize-24.png.png 853B
-
Assets/Square44x44Logo.targetsize-24_altform-unplated.png.png 1KB
-
Assets/Square44x44Logo.targetsize-256.png.png 10KB
-
Assets/Square44x44Logo.targetsize-32.png.png 1KB
-
Assets/Square44x44Logo.targetsize-48.png.png 1KB
-
Assets/StoreLogo.scale-100.png.png 2KB
-
Assets/StoreLogo.scale-125.png.png 3KB
-
Assets/StoreLogo.scale-150.png.png 3KB
-
Assets/StoreLogo.scale-200.png.png 5KB
-
Assets/StoreLogo.scale-400.png.png 10KB
-
Assets/Wide310x150Logo.scale-100.png.png 3KB
-
Assets/Wide310x150Logo.scale-125.png.png 3KB
-
Assets/Wide310x150Logo.scale-150.png.png 5KB
-
Assets/Wide310x150Logo.scale-200.png.png 6KB
-
Assets/Wide310x150Logo.scale-400.png.png 15KB
-
DirectML.dll.dll 17.8MB
-
Microsoft.DiaSymReader.Native.amd64.dll.dll 2.1MB
-
Microsoft.InteractiveExperiences.Projection.dll.dll 100KB
-
Microsoft.Web.WebView2.Core.Projection.dll.dll 52KB
-
Microsoft.Web.WebView2.Core.dll.dll 775KB
-
Microsoft.Web.WebView2.Core.winmd.dll 132KB
-
Microsoft.Win32.Registry.dll.dll 44KB
-
Microsoft.WinUI.dll.dll 336KB
-
Microsoft.Windows.AI.MachineLearning.dll.dll 882KB
-
Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.dll.dll 93KB
-
Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll.dll 40KB
-
Microsoft.Windows.SDK.NET.dll.dll 200KB
-
Microsoft.WindowsAppRuntime.Bootstrap.dll.dll 384KB
-
System.Collections.Concurrent.dll.dll 64KB
-
System.Collections.Immutable.dll.dll 48KB
-
System.Collections.NonGeneric.dll.dll 7KB
-
System.Collections.Specialized.dll.dll 28KB
-
System.Collections.dll.dll 32KB
-
System.ComponentModel.Primitives.dll.dll 28KB
-
System.ComponentModel.TypeConverter.dll.dll 28KB
-
System.ComponentModel.dll.dll 4KB
-
System.Diagnostics.Process.dll.dll 164KB
-
System.Diagnostics.StackTrace.dll.dll 24KB
-
System.IO.Compression.Native.dll.dll 809KB
-
System.IO.Compression.dll.dll 72KB
-
System.IO.MemoryMappedFiles.dll.dll 52KB
-
System.Linq.Expressions.dll.dll 64KB
-
System.Linq.dll.dll 28KB
-
System.ObjectModel.dll.dll 32KB
-
System.Private.CoreLib.dll.dll 5.6MB
-
System.Private.Uri.dll.dll 164KB
-
System.Reflection.Metadata.dll.dll 212KB
-
System.Runtime.InteropServices.dll.dll 32KB
-
System.Security.Cryptography.dll.dll 80KB
-
System.Web.HttpUtility.dll.dll 32KB
-
System.dll.dll 5KB
-
WebView2Loader.dll.dll 156KB
-
WinRT.Runtime.dll.dll 1.1MB
-
[Content_Types].xml.xml 757B
-
clretwrc.dll.dll 303KB
-
clrgc.dll.dll 652KB
-
clrjit.dll.dll 1.7MB
-
coreclr.dll.dll 4.8MB
-
createdump.exe.exe 70KB
-
hostfxr.dll.dll 358KB
-
hostpolicy.dll.dll 397KB
-
mscordaccore.dll.dll 1.3MB
-
mscordaccore_amd64_amd64_8.0.2225.52707.dll.dll 1.3MB
-
mscordbi.dll.dll 1.2MB
-
mscorrc.dll.dll 133KB
-
msquic.dll.dll 517KB
-
onnxruntime.dll.dll 20.7MB
-
resources.pri7KB
AppName.deps.json
- SHA256 3bdff43f9fa88533ed1adc6ac6a001447d66d1825af6f272ebfad51d7446b41f
- MD5 9348d3672e03ac7544030536f79f6003
- SHA1 be3a7b88e8d4b333a60866daacea8a3902d14baf
- SHA512 26486e74ea5041572a0db006b5a66ab064ba54deae0b2ed081a285555ddab4417e8b701213a86e43c22c550280646b24a624a0c104c0da3c915a3e33335194d8
- SSDEEP 192:QY6tbaxjK0hw4Aibqwhvx2LwO6stt5NBCLwP:QY6tbaxjK0y4tb/RnBI/h
- TLSH T190729B65E4600DB74931B7AE283E4682FA65037F61004E9A74FC107D9F73AABA251F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
AppName.dll
- SHA256 566e52d5176791c792a434a1bd30e949ff2a0a133a68cba296b91867e1fd335f
- MD5 fd0ece766c76b10bfccd4e1a5dbf0370
- SHA1 6e0a052e0b149fa1989ef1536173df732904de21
- SHA512 630f8d1632c5b1443e6cea62b6adda7df03e8ba52babe77fc67752b4706ef969ffd0bdea32adbdc2e118c9d65fcde764231ede774457ca7a20aaa6200361b4c2
- SSDEEP 1536:xM29FevI257VrWhBij9MDRMqgSZSqcuLyF5/PfvG:xM29CI21VrGwyDRMqgSZ9JLW3n
- TLSH T1A673E40477A84355C67A0278E9B39E4AD272FE63A701D9CF099494CC0F877D1BB71B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\appinstaller\5\AppName\AppName\obj\x64\Release\net8.0-windows10.0.19041.0\win-x64\linked\AppName.pdb
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
AppName.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 5d6afdb8cf94071e4010defa2a2ac2d1a7156f939987c98841aeefa891fa1238
- MD5 30b574a20ab42164f51d124f0b076e8a
- SHA1 41b51e60782f9d6450af053edf2b7a5ebd8bd318
- SHA512 c498d2b4900e7a34b61fe172bd186021da2597ec27e9a0589522a67d7435703af91fe27efc6711873ad8186ab08adc0bee74a0332312714a9b46a7e7437e264b
- SSDEEP 3072:LcqvmgiYSo4k8uIPzlSRwa/WB26mlIgV:w6ok83LlMvQmIg
- TLSH T13BE33B07E6A850BEE1B7D679CD924C41FB7378594B71A7CF07504AB60E63AD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
AppName.runtimeconfig.json
- SHA256 0ac51d65255aa5a3c038a0413f65d16a2e42bc392633aaa2486278e0fbdb0ac7
- MD5 0d7ae7b13f32c233f0268f5d11589191
- SHA1 fb5d640bedd95ad049a2cc279e4fdc0bd401ac03
- SHA512 ef2d0aaaca522d9637cb31192338bce862cd706f870f1055ee4ca37e9c6533efaa46c18d20700f737a7cc953d52a664f64d455798368a8d416298f206ba3a0fe
- TLSH T1A8213524DA5A6DFE017A917B9861C492DA30472710147C42F1FD081CAFFBAB42232FA6
- MD5 SHA1 SHA512 TLSH
AppxBlockMap.xml
- SHA256 efa74d95ccf7145c7e6f769ceccce09d7609fd8a83a1a743586a713f4a7b7727
- MD5 0c4f15f3a1c458678e62bebc142e4029
- SHA1 354e0f167e7fd4c8691bd422d85c75a64332b1a8
- SHA512 a569192f3b8982140ec8bf3bc6b999b36fb921a9fffaeede95e97d90680cbcfa669ca67d875ed7df49d794b998d4142a847c3d61acde3b86e22b4f314d6eb476
- SSDEEP 1536:PV+BxcvbJwfepfFYEDwwcU99+FqLYmc1b9ZdT:PUBxkmepfFXwnI9+cLI9DT
- TLSH T17F9390A0153EFE3B82590AB88F65F5585C25982617732E0EEC4ED0BA0C2F9765F630D9
- MD5 SHA1 SHA512 SSDEEP TLSH
AppxManifest.xml
- SHA256 1d072855a6bb2ec410db8857b887d448e3a23f42eeb751d5d4cd75f9c5f03baf
- MD5 cdff15f71636cf15aa6d00d29b709257
- SHA1 948fcb818cdbe74c2405a7395488801218cc0737
- SHA512 aa616bbeaabcd805313250bef2ffafc27e538ab5c3b776601c114e3997051bdc0b9fb140ce82e124578a1eb9edbd7720ff66e052b6ef6cd3059b41a0344f36ce
- TLSH T129819542B0C426B0D3729BE5F376B287EB2DB1C364C889147C9C9D071F132A4923B72A
- MD5 SHA1 SHA512 TLSH
AppxSignature.p7x
- SHA256 b1537f989c2714f8bccbe581e23246bbd4ef7933bfe4f7cfd80c72662b0de746
- MD5 a0460094ab777f71d43ef59866b56356
- SHA1 3875042bf311ae2bba16d12d1641d41d65b725d4
- SHA512 a36606cdc16787d8a897a955fe632153abf90293758beba4a275573d85f9d4361eaa49a812f1150beded999f46fb37813ab64d6aef41eecc1acdae5d69a5a430
- SSDEEP 192:PO4+szpPIKfhig1R7JNcpPIKA1+D7fZfgYsylaxivFMdPf43x++Xa21RRb3B:m4ppwK3spwKOyhsyl1FMwx7bL9x
- TLSH T11E525B872D3078829F868C95B0D9DB739CB172B0EF5545D660768288DE897E23B190AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LargeTile.scale-100.png
- SHA256 ce28cd7dcceed63d52ea20cc155cb4a18a7e6b15a0cd6d6bd4a77e16420a95ca
- MD5 2b9b3f64f3819bf5d3050d3cf00a8c17
- SHA1 c3c6fc0bd6c2251cd6148e5d0683aec3c9f5c857
- SHA512 c9f387536532b3f569613e62b90ab741e3dffb9b0660f7ca9798bfc86dd7e7f530979e238758120afa3c295286051ea64a2ede686f6ce2f8174be45918cce422
- SSDEEP 96:mQAD7rf/1w4FWWOoy55Mn4m3erveOizbpdmGJtIpxr6XAh7fWkvn59Mt27JouiVQ:mtzf/8Z83ervepHrJipxrVNOmLdZ
- TLSH T18AD16BAA734E6F3445B69BD83067C67C10E30AE21C5228E72715A9F8DB0D83A4B7048E
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LargeTile.scale-125.png
- SHA256 0aa2819044f92a15e2f2644bf4ed5b9376ef4d7619fe1451e9606efaa2576749
- MD5 f23737280878daf815644b69249be7e1
- SHA1 749c5d4cec1001235d8502a03916c29fa4174401
- SHA512 9624dced15acfa64faa0459f63e1265adfd0c19ad4d46e0c4590bb49af0c25558f458a46a5866d80d07cb94d7e91bee1a85e04c53f89a1879038c8353359006f
- SSDEEP 192:K45CBE79IlkHV346Zept6YRdf9KT0faXZnH:K1BE79qke6Yt6TXZnH
- TLSH T15802F832F60C86F2580D9B71D9E283377318942B57326BC5E4B45DCCE00F869AF69263
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LargeTile.scale-150.png
- SHA256 a2b1157b495e0895d76fe1ca875c1eab0a392012abecbf83402da19873af8c74
- MD5 a8847b401b4741c1683f946884fcf8ae
- SHA1 9d72d6e6cd1eaf198446e1b03d12b48ad201c7b3
- SHA512 9835bf456bf2c96461f1a25a2bdb928c46d69ddc2a49fb549ef9dfd33d78abaea6668107dffe88ac0cd33cbd071dc640fecd1ed6b79a97703fef3386b0c2f2a6
- SSDEEP 192:98eSCDz38oTgbfICW7lRpj1f1M1bRlUyXJPgfTuySPrbs8:9BSCDz3X7pRpf1MJjzJPqSyabs8
- TLSH T1B122AEC31577E38EB4081587E9A7C87B1AF840FF4A40ADADB92D70F926E77100219336
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LargeTile.scale-200.png
- SHA256 be9c42c7f3187ec6955b43640f485fc4d44a8fe826d9418802527a05b78e399d
- MD5 351f4222b262a158302dc480ffb51897
- SHA1 db056c594aee68f5784823cb0298370e6c4573f5
- SHA512 687771984a0eea798a86e02d7c91a9c36167e83a6495f7820290acbf4fddb2ca0a4f380f7f47c3840064fca641b97fff035e923cb1d7e2320b139ae13bcb8abd
- SSDEEP 192:xXQma6qILHn27sLXka+C9GentnXv9euoc2QFiTE05qY5Ojv7Hy6KB2UFGxS2:FLP3LHpXNUOZXv8uoevYQv7ddWGxT
- TLSH T1EC62AEE777CA0DE6DC962703D875568084A68280FE8329B691D3DDFFC964A2DEA4C130
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LargeTile.scale-400.png
- SHA256 ad3d623bdac8c2f15182ad50430a933caa90ff87f5ab61c62f9b8dd900a6120b
- MD5 0ed0dfc61e35095f12a5f71459769b7e
- SHA1 bf8daa52562d6d97cf6b45f73fb850f69ce6e0ed
- SHA512 700e40f6697abf7204e4995931b8b07fb4543a05e49f9b0da8211324e2e404c0a22edf0f922651c50c4dfab89ed6cab48edab70f0587d4b36ad5ab378ca7d010
- SSDEEP 768:aQWfARh0UbXM4j5O2XHiIQ7vs+5Y9i096PR+VIyS:aQWofnTPl/1Q7T5MP4PR+V2
- TLSH T16803296653E3434DC31C623536A29AB3359310883BD846975F7FBD5F09DBEA8583BA08
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/LockScreenLogo.scale-200.png
- SHA256 688f384ef8832609d1f4d5e7fa9f6e08a81a6f52bba2c67070e385a015dfb42b
- MD5 0e648e2d233a08282587372e08b71b78
- SHA1 8af105880421ea32046d748d80a5f0e38fcd6b06
- SHA512 0b5efb2504ae020ce6fd566aac2d9268e5d0672d358e5fdcbf91fcc59e7c929c46a4edefb3db517d6cee9c8efe4da153d7eae342607e48505be44955751c6ba0
- TLSH T1E9E023E31F644FF5D6657FEE875502144F24911D466EC52F880B030887235043444307
- MD5 SHA1 SHA512 TLSH
Assets/SmallTile.scale-100.png
- SHA256 fc7cdfb5b5901a7d4cfb7f0e61f331c4e30674ca178fff45784cb766b6ed5d3f
- MD5 ac3bfbc6e3244e614e30ca09857c1be6
- SHA1 f64a815becd0701b1cead02ce5f2ed8d162929f3
- SHA512 293ccc76524e8dc34b12583eba92bbd62c1da31e214780dbab8dd69e93762555c9c81b4d3d6435ed51d35ca56591a532b2d41b87ec0869ddf59c506456d34f80
- TLSH T1E1412AD5A0AD8843E9117F0022CF4168581A06D415AEEC7C9376898B283E337D5F20DC
- MD5 SHA1 SHA512 TLSH
Assets/SmallTile.scale-125.png
- SHA256 a127531aefb12d21cc4aa898628824efdd3d426d36bdb8f3c8432a6fc862099c
- MD5 d23817bfe4c8192cc649c18abed187b7
- SHA1 4cb05d4a0c900b88eecfa28074304f456b72e000
- SHA512 add930aac926d21017b62377a87e9eab76f24ff3d96371eeff279317fe42d90a0358ed778ea104b26143760be014f0f3097e3dc7f99b5242a228251181ad6086
- TLSH T1CC514DD8449934484A4E3300BB5C75A1BDDDABEA5D3D18451DCD903B4B4228FD45AFF8
- MD5 SHA1 SHA512 TLSH
Assets/SmallTile.scale-150.png
- SHA256 057577dfe8e1c03659011eebe6867c28a24264c9d1415ca4d069bdee75afb3c8
- MD5 f6a703884bdcfaa145330614668bc7d7
- SHA1 c984cbdaecaebedef4608c6b107aa4788225c3d9
- SHA512 231995c017825ffa442de56f5859273226daab5aec5fa0d43f1d0b1ce87d25c6b21f46cfc08836ef30401dc350643560f2c11f1f02ddffb711b556f07a94c1a9
- TLSH T1F2515EED38D83B703EA5C70504600C89866DE07A1B47ED91932E10B6A05A1B14FCD55E
- MD5 SHA1 SHA512 TLSH
Assets/SmallTile.scale-200.png
- SHA256 d8edcb938af9ba3e71825e57c1702707a2380b472f8599aab0909bd9c3d15b29
- MD5 695b2e58551f1d12c89ef4fe74e8ee41
- SHA1 c8e46a51d3f1c4421c74ed25d39c7bcd3a74cd1b
- SHA512 c504a1fea5158348efeb0bcb9c898f7ad5e665f8ba4b6eb8b7126a494cb193bd746132d80f1c78b692bf4d393e9c623a3e055de1b26d139be208741e5693bad9
- TLSH T1D6816EB76361499AE612836A9DBFE00BA089764B04767D90D580B22B011FD47B73DCFA
- MD5 SHA1 SHA512 TLSH
Assets/SmallTile.scale-400.png
- SHA256 386f2f47fb622ecbadd501c9e5319994fc72b75b19952324791e35b7d65a8ee2
- MD5 6d5a5d1b5bbe93e71f52d6bec9d92346
- SHA1 7278c228efbdd859f3995083c35c4f8f916ac93d
- SHA512 99755d7692b4ae6dbd863c742b0cca64d6d84f21366c11953274639c83a60c8b5eb426e4ed5cb7ce1b9fc6544e6e42a79afb6497709b46b122e7683c22d6b0ef
- SSDEEP 192:o+wi2vD0tGjqTYXUXbIJM8qDuk1xFVls8IBNMdst:o+n2v4tGjqTYX0D8qDdZPUNv
- TLSH T1A1025AC1E4F0A2911987F243CAEBFA736BC83430BB199665701D3852D7A8E3DF5A450C
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/SplashScreen.scale-100.png
- SHA256 2e7c826d7f4b2f3b0a7f4c45a649cfb70c16403c2a9f80eb308343ad00526df7
- MD5 1805a78c47a6563d49c0daafd519ac31
- SHA1 80dd31adee5ba22751f5370e54e59b5682b8f270
- SHA512 52a7732c2832f271bc54143c4b8f09cc8fb339877d9e70f8ac559de860ee0e805906afa85499a692578dd8cdf1c168877101c82fc26fe99288d64eb43cf51efd
- SSDEEP 192:t1n9sSShxp9dtQkG1Z07CYVp0SchkLHuqKNrRn84S:tt9s7xp9dez0d/06L9KNdn84S
- TLSH T19CE1C8DF02A44E5B9C064012ABBA5AFC53DE149159E3E5325DD8FAAB174B36E80E0C37
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/SplashScreen.scale-125.png
- SHA256 1755b841ac8cd30e7551867d931f0b7ada1917d0e892772383a07a455b6cfed4
- MD5 8898458f5f787786cf67e899c14a790f
- SHA1 3772a99c9d06cc2a701de69ffbce64f5eabac0e9
- SHA512 0e92ba00ebfa3e662b162cbae168054f1d1581f4f7dfa15122ea3ba07c122d54518921dff90073e2a0bf89fbd450ce832f1e8538b67fb5c77c49cced6e23641b
- SSDEEP 192:81hvelVx8Kyv1HcC2jX4qOVWMfJlYptBjVYUxd+zdt1Gw9:810lV2v1Hc94hWUJWBjVx6U8
- TLSH T15B02F9AAD3283BF4590DEB368086F4409E7205F455E4C7C744AE78EE091FB6E7E8950E
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/SplashScreen.scale-150.png
- SHA256 63cbc424151744fa2f08e89186db6863ee39a0d249b2d308631dffddc285ba40
- MD5 a6235800c2a59fd6c549e9dec4b0ebc7
- SHA1 3b836658430046b006674136bedfa80043318bdf
- SHA512 b4a1bcc0b69d7d6fc2d71f49309be2cdc04bc8d287c19451e8da77ca67676361616365149e1a84291e42b06c7a548d5648fa2892f8c7258c463d4d756e5a62d3
- SSDEEP 192:BRZDtm1je8gKGi+HmVKzELn0IFwRmugbFzcorvc2/NHOUfwWJtHMfezmG5uD:ff+N+TTELneM55rvDkUfhJtHSez1K
- TLSH T12F32F96D5B3258B8438EECA6AADD0CE23EED2D64429A71411588424C07383CF75FEFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/SplashScreen.scale-200.png
- SHA256 5c93b81d9a253a120e4d8d2a3c0a0a12ae82c265349daa8502ca972303acaf35
- MD5 d6353240a6dffad5c1ab96679e6772d5
- SHA1 3cd0c56bad9818bfef88a9106303f3b0164da991
- SHA512 24959ce44b494b60da871cdbfc99bf89de7d5610e4da091ba843340a3bccfa843cfbe165dff237113b58e83885190dd79de78fdd189233fb2cc1b1979f1deeee
- SSDEEP 192:jDqVnhZW4CU4sEscSyOQZyVeSxqo+epbLwVkRD6IG3SteFLcmDDJ4zGf3xAZBIF6:cnG4FByvOxf9P32StmLdDDlmLIXY
- TLSH T19F6206701E57CE04CBDD04B98CF62D37583618EE7E86E20242DBB92FD9E11B004A65CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/SplashScreen.scale-400.png
- SHA256 29091598dd7774f644b241804631638112a085ce8e0eed83e6ebd18386a8b42a
- MD5 c1d9928f728329b889026976167ca700
- SHA1 51806008d36d8a84fd25560d74eb458aaf1e8aa5
- SHA512 d0bee52581266bb46aedbf5c303bf5f761cb0b00416e0a99e9a71dba487a50f5cb48519047e6c08ab04acb89715754ffe22501d0b7d5e8f2280e67f7fd0e2573
- SSDEEP 768:NDtS1FzkfACb39Bj+3DNaB2fvQvsn7UXdAjbjOSVEgybDdqMQ3ujjjjjjjjjjjjS:5I1FRYBSxrvQvsnAdEOSVEgMQ3L
- TLSH T16313E54546E34AC9C9880134DBA37F3CF664679E767A9722D3BAFB30290B27FE011158
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square150x150Logo.scale-100.png
- SHA256 d67d792577f4382a2d5fc389838ed4491d280e260a75b46a75278df0f1562e20
- MD5 7c3a9fbc628f6e82c5fd8663faa062f3
- SHA1 e8ea05f55b28ce7e9904809d6551f694bd13c199
- SHA512 db0d39582fb906758bdebd2a4a0011cf3f65569a98d47c3adf908cec3897bc6e77b0b74fb109b7bfa9450a197426b8309949395df1b2ab4eb49d24fc1c9e14fb
- TLSH T1EB51C7CA6655FB69E61E54011A2981E01FD80A7FF1DF3ABD3B654CD35C3B4222F321A2
- MD5 SHA1 SHA512 TLSH
Assets/Square150x150Logo.scale-125.png
- SHA256 1057a46b7c8fdabbb4b33d01fef9055eaae7637f6a47bd227b1f91fe14b025e5
- MD5 b7b8dfb613ada18a159d957626636ade
- SHA1 3f1135d93dac4148fb9d0d284616e9276c85ca97
- SHA512 feea00c52870c03991cf187bd05f4ca33b48f09e1906fb308b9851008c3cdb600a5983805eece0ccd32a429f24de51bfee208a8bfe39ac6d9108241d8bb5068e
- TLSH T1D271B3A9BC783B7B7296665043832A013896CB3B024809C2A0016E68DDF53CBDDF1EA0
- MD5 SHA1 SHA512 TLSH
Assets/Square150x150Logo.scale-150.png
- SHA256 c59840d8862b86460c8ae6c9bb39b005cbdc7c276b6fb81577c86b9be70a2ef6
- MD5 8d4f105941e9c6ba1ec1e67cb91e1b5e
- SHA1 8b0c317946fbae3e8f525b6faaed8852ee8c9a8f
- SHA512 66f99a98c58eb2f08c514f50e891cea904b618e9d7a1436f9260b279eef9fbb7d234b740d3f3c256e44a74e5f73175df05794dc246ee8c44c33f6422e72770a0
- SSDEEP 96:iaOlVF1UfpSafrK+ofBlecwmGWYjcv2a540sBRK8gN0P6:ia61OfzofBleoYAdc40i
- TLSH T13EA17E02714700D495D88E41455A21509032DCEFBF2E6F9E689B93E3BCBC1B48BAC0EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square150x150Logo.scale-200.png
- SHA256 02e0067d82710ba8425a289ebd7b244f9b2999f39ef621e026a59fd89c6e657c
- MD5 d1d84175bb1d46a732fabb6bd444dafc
- SHA1 670baa69072a425f6ec498254a61a2a5c0f07644
- SHA512 2940236bac32602e234fa2a41d64c62e4e793cd2024acd66816349e1449e604ab1f4e20abf1e6536c72731e31aa7e3ce3d36eac9bd56a7c584dd33f773242596
- SSDEEP 96:of52/v1TTZdyEs8HK0SWAmd5KvenW02HEHVWhu+QopJKHVitpna8WbT1KEs92Zn:c52/vB+EsLzM5KvenSbhulopscUHtsW
- TLSH T12DD15C3B297560444E61B44A854329B15B3667B22FE1BBF54BEA7D28032F07C8C37B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square150x150Logo.scale-400.png
- SHA256 04b67d6f58fbfc9b5666f9282fd533399c95dee36394507cfccaa72646ae1357
- MD5 2e6f304bb6125b04a7c702cda3e2cfca
- SHA1 3d2d002aff3ee7628d791badb8ff0bd66ee7cbff
- SHA512 8e91780bcc92338fcf638af6845a5de76dad01642ec780af3655b1982ed0b1a6938fe4a08afb5ee2e9cc2ca4808d35334d110686225475163d7f9e4c3634ecd0
- SSDEEP 192:MR0aNyXKgoIGDyUpbSI61qNlWsVO1JcQjuD+t/Tby4M3XAHJD2cTn7v0Cw6ZpI:MjNkKgoIGDbZItPy4MIJD2Ynz/w6zI
- TLSH T18B529C00676E017EDE3A47D99C5F6832EDDE851193FD704A93CB72706798630E6C446B
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square44x44Logo.altform-lightunplated_targetsize-16.png
- SHA256 d8bb54e6bc57bb077715db879de8fcb085d89e823fd79941f673dc88c3d97416
- MD5 c8582cb7c832e593b2599771472ad9c3
- SHA1 6df82bd6b729975efeefb063e726e9906a68c825
- SHA512 1277a2166801719ef9abadf60b3b025ad345c6082260c9da8e87d6a13b4838a10cb084434db02805966c58e2075cb3211065b3069f6f02b7fd5fe680f4b9d362
- TLSH T1EA0165CDB6108C7EF141222895020D15AAD573C94A25420B2D81EB8CA3C4F99645FAA7
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-lightunplated_targetsize-24.png
- SHA256 e224a07e4ff6e66195a81b21aae4bd14e6bdf46417e4a584352cac2b30538c24
- MD5 c9a27e99e44fdf88828093c08b0fa8d7
- SHA1 5416b0f41420829b00a184c710eea66c203eda92
- SHA512 9f1d494d1c1e91282fb88f0e46eab42faa6d02d6aee710e0612420970c94a9a192801c1cdd42d1f750c0f0f72dad7ad6ddaa18ec8e563ee6728e81622a790840
- TLSH T10C21C66993004637D6902D55F90F9FECC52254ACA0A497C6082CD8E0EFBA7F48C95535
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-lightunplated_targetsize-256.png
- SHA256 6154f92e59566dc3f43d27b0227442dd9a872412b48fda1619167579d2e9478f
- MD5 36f8c7cd707c0cb6d756c39ff7662862
- SHA1 0a1d24724bb2f1a7ac3f9849828e86bebc3defd5
- SHA512 eea75cc4486cab21d0fcd4ad818e59a4629ca49acef458d1f1041fd9b6f128456cfd2f6e9ddb4da32e1ef1a713e802f6fbf508087de68cc825fdafd7859a3823
- SSDEEP 384:ZEy7jySN4Bnqz4NsYALokC0Y9nT/+lKNyy:ZtPyM4wz4NYEkCdHyy
- TLSH T1B662C0B264B73D6DE7E7523E0438402C0288165CFEFC9781AA47B906A98A45FDB31ED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square44x44Logo.altform-lightunplated_targetsize-32.png
- SHA256 7a51e7c528f8b8b8dc898f799d6e5e54c883ed54b6f17d0e7c00e1a7c611c42a
- MD5 ad07588cd52d105f63fb4d8034c901c0
- SHA1 023e46b0d8ba2ba48b9a496ef9124041e9138fde
- SHA512 06ed302751a6f57cc6aafdf99e220b8b42c4574f43f64aea3d869b215d45c023713ecb1a8a8d1496f917202bf0c7af719ee9a8e51fcca19d11caa495592385f0
- TLSH T1543108F35B50C62A4BE154B3A8135186D8E758214D16B2BE94AED2B098358B1A318938
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-lightunplated_targetsize-48.png
- SHA256 957978504f5c68c2e01b9e57272755103e7f405d635467dc7d40bed51952d0b2
- MD5 498c2762b6e43806cdc1cfe2f3e6b020
- SHA1 5cd44ee45b518ab51669009d8e8b047b381a7a9b
- SHA512 7d0958b8fae4f54881d980db85ab6669ab4a8c13ee3106e00096cc37bc92cca3317d01a71677f98f753b0c2d1a5921e88e76358449dee04c0e9dcd9635360ba7
- TLSH T184413DDE3EEDC2D3C6B19DB33A163CB5C8F520D195868600505655DD56CBBE0860486F
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-unplated_targetsize-16.png
- SHA256 d8bb54e6bc57bb077715db879de8fcb085d89e823fd79941f673dc88c3d97416
- MD5 c8582cb7c832e593b2599771472ad9c3
- SHA1 6df82bd6b729975efeefb063e726e9906a68c825
- SHA512 1277a2166801719ef9abadf60b3b025ad345c6082260c9da8e87d6a13b4838a10cb084434db02805966c58e2075cb3211065b3069f6f02b7fd5fe680f4b9d362
- TLSH T1EA0165CDB6108C7EF141222895020D15AAD573C94A25420B2D81EB8CA3C4F99645FAA7
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-unplated_targetsize-256.png
- SHA256 6154f92e59566dc3f43d27b0227442dd9a872412b48fda1619167579d2e9478f
- MD5 36f8c7cd707c0cb6d756c39ff7662862
- SHA1 0a1d24724bb2f1a7ac3f9849828e86bebc3defd5
- SHA512 eea75cc4486cab21d0fcd4ad818e59a4629ca49acef458d1f1041fd9b6f128456cfd2f6e9ddb4da32e1ef1a713e802f6fbf508087de68cc825fdafd7859a3823
- SSDEEP 384:ZEy7jySN4Bnqz4NsYALokC0Y9nT/+lKNyy:ZtPyM4wz4NYEkCdHyy
- TLSH T1B662C0B264B73D6DE7E7523E0438402C0288165CFEFC9781AA47B906A98A45FDB31ED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square44x44Logo.altform-unplated_targetsize-32.png
- SHA256 7a51e7c528f8b8b8dc898f799d6e5e54c883ed54b6f17d0e7c00e1a7c611c42a
- MD5 ad07588cd52d105f63fb4d8034c901c0
- SHA1 023e46b0d8ba2ba48b9a496ef9124041e9138fde
- SHA512 06ed302751a6f57cc6aafdf99e220b8b42c4574f43f64aea3d869b215d45c023713ecb1a8a8d1496f917202bf0c7af719ee9a8e51fcca19d11caa495592385f0
- TLSH T1543108F35B50C62A4BE154B3A8135186D8E758214D16B2BE94AED2B098358B1A318938
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.altform-unplated_targetsize-48.png
- SHA256 957978504f5c68c2e01b9e57272755103e7f405d635467dc7d40bed51952d0b2
- MD5 498c2762b6e43806cdc1cfe2f3e6b020
- SHA1 5cd44ee45b518ab51669009d8e8b047b381a7a9b
- SHA512 7d0958b8fae4f54881d980db85ab6669ab4a8c13ee3106e00096cc37bc92cca3317d01a71677f98f753b0c2d1a5921e88e76358449dee04c0e9dcd9635360ba7
- TLSH T184413DDE3EEDC2D3C6B19DB33A163CB5C8F520D195868600505655DD56CBBE0860486F
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.scale-100.png
- SHA256 2eeb61cdec4440de2ff14b4a156303d5717fea03c8e46f50de92efdede2ba2da
- MD5 e1722c4b5c89d9def8e8f0aff5a107ec
- SHA1 2fe9f01ce66114d1a6ad78aefb5be9c04b8d1de4
- SHA512 843a896b7c8a15b35e44541a7a9b75943e58efa02b456a73ee322137359f7223691cf1606d8f575ffd517a6044110b16bedb932391db2f483202e65ea9894918
- TLSH T19A31D8B0BC948EDBF7B44E5A270F9B1415805D847709A2E3F32152DCA95E6452453A36
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.scale-125.png
- SHA256 ee762b7799244a5c956d0a47e3559e7964fd9e46f3e1868eccc970f63f1abb48
- MD5 02aeb1cff6872be073d56050a9e928bc
- SHA1 c8325743037de27aef7abd08df94041cf10577c2
- SHA512 0731efa53aa139afa06c3228aa3dab2cd89fff28092a0db92f6c49c2ab32af4adda99fc2c5b6a313c90e8279e025b2aca5f4bb9c0375ce6b19d1c098f845fe50
- TLSH T100411A7DC85C5156CB977C61BE7C1C591B78B1C81969119C283FF9488EAFB51C44CC8C
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.scale-150.png
- SHA256 c63e248152e191688a77495964b8a9cd9ef7042daf171a3984da491f441c6531
- MD5 b24f913aacc9097eb25c00652f65db71
- SHA1 9ef15827207be4bc5cbce1c9fbaadb65a93356cc
- SHA512 178d9d59313b85c27a93ea48fbbab1d011960f0d77fff62501d6f78390cca8e43cc2e35a725dc12e912dd7bd5fd262747549f8e65c83d81a2bbdcccc64cde793
- TLSH T177517CA3203EB0EF9689D1E0346B44125CF942139CE8B20FF164B45D9C2318EC9B3B91
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.scale-200.png
- SHA256 84a48bda0fdbf86e84679fd17e58aef36884c272471c6a545610e9b71a052800
- MD5 16b8747f7ba3ae51bdc3593009fa4afb
- SHA1 072f442112fadfe4b6956057d28bbc05228367a7
- SHA512 52eb8bac80539a259d4e8e6d02a00f4e1573bdbf3e75519ff6be8c915f9d4fcb46e33e66a41811df7256b4a19183a4f6514900e63295a81c50877aa8e549f504
- TLSH T10C717DF218A43E2CA20387B391794BC78A12932F684512933C73E34E4E55B843F71EC2
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.scale-400.png
- SHA256 c251edf187decc91b9df3f7e21abd81f1544a37a4964a2657f93235eba2da6bb
- MD5 ff6a6dafd5cb1d10e8026ab45bfb4f30
- SHA1 487e055c6f9e82b13d2c898baab4ece5acc0ac0a
- SHA512 cf5a01a0914f13a96e72f6ab37259a4a687635f4e239a01e3bb30916b689d7ea680c2d9fce39ed5a6805b8e2a521ab6eb641e20b28e47ed29791b3650bc2365f
- SSDEEP 192:fKvZhRfwYraEWWMDQnAuGYYnfDfCqPbfzqgjytA:MdvWhEAeYZjVYA
- TLSH T1F6E17E833D2BEC180A69120ABF41B5C9A470FAFB027829C3192F7F52748C5F4F644D56
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square44x44Logo.targetsize-16.png
- SHA256 0635150e6fac780ee1a7ef8eea31c1c45d12d041e5c3ddc5c7cd8ff180ec9fa9
- MD5 931063f3b0fc69ab83384542ebdda676
- SHA1 b7c4583fc1855940d6f269a3d6acb1c76dbfe0e2
- SHA512 14417a20cc9d64d80bfd53daa41eea7613f84f44e7b063b97c0547735a3c5a63b988ab43cb327e99db1f7e06c3a419c399d4fe8b4b2302db9f6dee20b71e56f4
- TLSH T183F0268085D0387EE6574391046E6E01ADC529B459F79818A507E80A1E70590E9F5340
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.targetsize-24.png
- SHA256 76b05e18f2939b7c4fb2d9943a4b26b736eb5f13aa2c0863f5b781be857c5a30
- MD5 2a2af3bc8a5ce5c4aaaa89d4d6727991
- SHA1 9fec36a7c56f3d3543203c3eb5cb768c11fa503a
- SHA512 86ee9db63513e318bc4898835ba95390e8b32d4e5cc78fad39f4b465c5a32dd73fae3e9dd4a0e4aebd6cc1026e79072a5102859433b5da279ff0014972d3a8b2
- TLSH T1C201D6C20BAC18FFF44A4424FAFF03F2896347F2E1204649A613896E66C017730A05F5
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.targetsize-24_altform-unplated.png
- SHA256 e224a07e4ff6e66195a81b21aae4bd14e6bdf46417e4a584352cac2b30538c24
- MD5 c9a27e99e44fdf88828093c08b0fa8d7
- SHA1 5416b0f41420829b00a184c710eea66c203eda92
- SHA512 9f1d494d1c1e91282fb88f0e46eab42faa6d02d6aee710e0612420970c94a9a192801c1cdd42d1f750c0f0f72dad7ad6ddaa18ec8e563ee6728e81622a790840
- TLSH T10C21C66993004637D6902D55F90F9FECC52254ACA0A497C6082CD8E0EFBA7F48C95535
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.targetsize-256.png
- SHA256 3e2aca72e3f19d09672879dc35adaf4ae9b100a72f1a33c3c03f7f64441ff082
- MD5 fddb685e3bede189d72c4c81a60fa58b
- SHA1 0afe159f1960c264274824343a2039443a61e343
- SHA512 72e619124a784fd56de960c753ddb6031cc2aad52351479c2efbeb11d8f3e59bd796bf3a5811a9c470efeba39b1beef94336e56278e7403fbe3d3493408ab1c8
- SSDEEP 192:xq444447vwNwiypaLk3bTTeiQprp8IUs/Mh8Y2ge03lakx31TvsgZ44444i:xq444447INwiun6iiKIHMhrPe0VaMTTl
- TLSH T1A6329FC6A0D1ED1DBCFF5E13A4E72B0D616CC1D933E3754698221408BAD1C15F6AA7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Square44x44Logo.targetsize-32.png
- SHA256 402b5c6088b5c8e6242364db5224a6a15a8683431b2ea504395d70f91af012ef
- MD5 28595f09641971051b0bbe8c532242db
- SHA1 b067d88c8175cbc4f56a66efccc2bd7bca2807e8
- SHA512 2f2efbbacf0b1990ff20c8cbd16512cf50e1a30e1a9402dfc52518f4258d1950f371e930c18790a6dd22cc7e6d0cfd2e4f0ca065cd289650fc9fb1b91d4fcba4
- TLSH T18521CD915709CCB56F20901362D73BB074C941DFFD27644F1237D1ED32466445C941D2
- MD5 SHA1 SHA512 TLSH
Assets/Square44x44Logo.targetsize-48.png
- SHA256 019440f6f4630b83e4bb12dcc3835a321e5cdb669ac52bbc9e6d920ca4ad1482
- MD5 3935319685c5776c660ad94b0e2da953
- SHA1 54265ae7620453ad1954a79beb90dfce582f39a5
- SHA512 690b8c31aaa633029633ed162553e110e8725f6b4cea38b43469bcebf127877c3c02f810262b58b78aab6ba92853365524f55110afe781f7d950740d804e73c2
- TLSH T15431298309E1EA2AF4553403578D2BBC823742EB255F5524E0928800187EC88FA40BF6
- MD5 SHA1 SHA512 TLSH
Assets/StoreLogo.scale-100.png
- SHA256 f58f812eb35cd7e781baea66e070d8ae8574df0d38679e40aebc7c8e928eac29
- MD5 2fddc3aacdf8159bd85a868f6564b928
- SHA1 68119c94fc57f404775ba5d8114d4f841a62725c
- SHA512 df7e46dd190b6abf8d4be84614236ce38be5bc191952b116ddbc9d0de3fc49b92d5af535be59667ada9cbf1aae0553fe3981ee7b9b13680fdd1348ba54a7a7a0
- TLSH T1E3514D670F501D64EA582221B4255580C9D1149A9F39FE0FA7D09E7F03F5B9544FE8C6
- MD5 SHA1 SHA512 TLSH
Assets/StoreLogo.scale-125.png
- SHA256 ca29f09003b2e0e109c002543a3ac2b343f03b207c5d8c499ebbf1ea7efc0aa3
- MD5 78f5d2a63622001c10306dbdd325ca17
- SHA1 5b64dd46f9363c48d680ef92aba4e1557cbd95e5
- SHA512 10b2695ca974eb0bc95a0fc4d4d1a86148ae3bfa52f4503674f7481e9d3d96f2a2cc0d1b37cec6a913416fcfda4b775b4cac34484ec22655c4ce3f01e2cce336
- TLSH T18B615C7C16F058EC7F4976245965D2C01B9F78AF4BC1809ACA3CFC12B0993A9A810E63
- MD5 SHA1 SHA512 TLSH
Assets/StoreLogo.scale-150.png
- SHA256 3da91c1a434d25f71c1c72fc6baa1361b5d9338011812860c0f318fe7fbe9b74
- MD5 425a8fc796ed45f28274b0daeccc4797
- SHA1 5f31064a73d814b04cfa0dcbaececa13b6e90290
- SHA512 1391e1f90e4612b85e11fc0a07a4999ae9d3ebfe95e1a08518a7bf8a4cde6f905bbfd1710ab0d3bacb376f20d61980747afefe68e35e00ade6775a1b06dced10
- TLSH T1CE816E2334116C3EA7F570B7D7D1012999727054AD830ED98E68F9B11987A9743321EF
- MD5 SHA1 SHA512 TLSH
Assets/StoreLogo.scale-200.png
- SHA256 bdb48f8ffc78acec710f98581e9b4c61611fd07a11daa73da12175cd76ddb6e5
- MD5 97af69bd19442d01c245c9427e4c51bf
- SHA1 9e7ea27d111bd83c594ffa00019553ef71464c0b
- SHA512 07f05bf8771520317ce5ca758e29ddac880d0a6aa10b756ec531360dec8f6a2115c8b09713ff2b1ffdd606a9b27c1b9fdad953ce67b8cd0587bde449b2c70565
- SSDEEP 96:NyeKRRhFOcBQRL5q4pFhF36KarOboCx1DdUVtXfCm2RO860f/wl:H2hUKQRNlvF3COboYYr2bo
- TLSH T126B16DAF476B7F3154C8592FDF4188AA017D4C8530C5A109AAFB7CA7CBE151DA0590C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/StoreLogo.scale-400.png
- SHA256 fc1a8d144542f282b970c9c89ef9125d2da2cd8100ade42624d78f8541ccddd6
- MD5 e4f8255b5a084ddc6ab549e4797d853d
- SHA1 e8e96584f679ca95d4859d50119c763f59027e91
- SHA512 9f3391d45cab9fea597e07303c29391bf7baceea08c413d111c122d705d0c956dbcfeeae8e2b3823eb2d0eb9576314606298ede2fdc7dfe361eb41902ca72841
- SSDEEP 192:Pt9xdg3OQD6MmtsfcU4wzcnMnxSxe6BiBsr2FFgUykjS/8esaFAS6S:rxy3OQDCtsfcdT7RBi7fgUyw01FAC
- TLSH T15332AE32DEAB110798905F4CF7F4B2EB8F89907E5E728EC28085F2F518EAC6515483C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Wide310x150Logo.scale-100.png
- SHA256 e88cc6103d812acb6cfb66be06aafab870914844342efcd0e6444366b4daecc1
- MD5 864b81711a297653e2f888e779e1d072
- SHA1 0f6af90703a519bda3d2a184b7adb10d8dfab399
- SHA512 656d572db5de475f714adfa1b0634af5e36e5b55d6b6655dc2d3d9a59d3a43cdf2525f7ddebc2fa82aaaf17b57bb2dce8484b40ee72c4dcc9f2d087610a32f30
- TLSH T11E61A4956DF822FF6FA53026221B779FCF4376AE34112E62BF495245B5DC944330A093
- MD5 SHA1 SHA512 TLSH
Assets/Wide310x150Logo.scale-125.png
- SHA256 5ada3596e6567966c7b003852949e0444bd65719fa590cf58af0b83428b829f6
- MD5 590612c9c614799f50e38367d9398652
- SHA1 dd032e0b8346c9d8520cfe4398cf9495b8b9e75f
- SHA512 3cc3346f9c6fa357f01cb551b439621e2c3095ce2fea3dead148dde0286e9cf9b64619325665dc43a668862853844ca2e81b859abb4c40c704237012e827393f
- TLSH T13B817FFA394964C52B747820EDF6C385BFD9543E459FB35D9AF4E84D022E4492C0219E
- MD5 SHA1 SHA512 TLSH
Assets/Wide310x150Logo.scale-150.png
- SHA256 54b6fa8f506e45ef370fcf4149bd4a51f6f935e4f8a8e5be1addbe233a5d8e4d
- MD5 253ddf25c6ee3a5bc68d83a8f7e828c3
- SHA1 ff0b1c5cc9e00e985538877745a25867cee7402f
- SHA512 df01099ef15bbeb36bd5091aefb567bb2a80f4c3425bc64b19e464eb9cf6e55cb895cba18be0e6be7cb73f9afe0dd63f6894a4b73b80caf7c0869b17c8b3db26
- SSDEEP 96:3PBli0M80aWwwlg50zNAPMwnjovbt6q0aG:3PPi0Mna0WGNV48vbtkl
- TLSH T101B18DE52357A68EF92D046FCFAA1EC301930C0CCD13A91AB8BDB5C26E5248D057A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Wide310x150Logo.scale-200.png
- SHA256 2e7c826d7f4b2f3b0a7f4c45a649cfb70c16403c2a9f80eb308343ad00526df7
- MD5 1805a78c47a6563d49c0daafd519ac31
- SHA1 80dd31adee5ba22751f5370e54e59b5682b8f270
- SHA512 52a7732c2832f271bc54143c4b8f09cc8fb339877d9e70f8ac559de860ee0e805906afa85499a692578dd8cdf1c168877101c82fc26fe99288d64eb43cf51efd
- SSDEEP 192:t1n9sSShxp9dtQkG1Z07CYVp0SchkLHuqKNrRn84S:tt9s7xp9dez0d/06L9KNdn84S
- TLSH T19CE1C8DF02A44E5B9C064012ABBA5AFC53DE149159E3E5325DD8FAAB174B36E80E0C37
- MD5 SHA1 SHA512 SSDEEP TLSH
Assets/Wide310x150Logo.scale-400.png
- SHA256 5c93b81d9a253a120e4d8d2a3c0a0a12ae82c265349daa8502ca972303acaf35
- MD5 d6353240a6dffad5c1ab96679e6772d5
- SHA1 3cd0c56bad9818bfef88a9106303f3b0164da991
- SHA512 24959ce44b494b60da871cdbfc99bf89de7d5610e4da091ba843340a3bccfa843cfbe165dff237113b58e83885190dd79de78fdd189233fb2cc1b1979f1deeee
- SSDEEP 192:jDqVnhZW4CU4sEscSyOQZyVeSxqo+epbLwVkRD6IG3SteFLcmDDJ4zGf3xAZBIF6:cnG4FByvOxf9P32StmLdDDlmLIXY
- TLSH T19F6206701E57CE04CBDD04B98CF62D37583618EE7E86E20242DBB92FD9E11B004A65CE
- MD5 SHA1 SHA512 SSDEEP TLSH
DirectML.dll
- IMPHASH 0eb962894c1f1cf400b452799094c50a
- SHA256 257c75b2f607940c986d0b96d9309a2c897e57ef3192b6c678d707c22d747611
- MD5 96f5a3ec27f85c1ed3a3aa0a33d6b5f7
- SHA1 44e5299f03bcf504b906ea95f0ec6e2253776102
- SHA512 92187577627116edb3f92da6872d13e69ac511c3e7ab52ca7e0b208bb48504a0f21e9ce79b998b985557ccc36c3460846f5be6d6525b255107632a91059861a7
- SSDEEP 196608:iAZfeTLx3Ohq0Ytzn7OBdzIkRnyrQAH5+sM3TKp:H80hMtz7oZIkByrQo5QTc
- TLSH T1C317D01A6F6415A6C0BAD23D9A534A43E776748743706AE706F80E311F97BE05B3F382
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:67:45:19:2b:2b:9c:21:d4:1a:cd:b5:4d:c3:4a:8a:fb:9b:8b:fe:bf:71:28:19:86:eb:14:4a:41:02:6d:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 9, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
47:67:45:19:2b:2b:9c:21:d4:1a:cd:b5:4d:c3:4a:8a:fb:9b:8b:fe:bf:71:28:19:86:eb:14:4a:41:02:6d:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 4, 2026
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Sep 8, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fe:fe:8a:48:b5:ce:c4:60:f1:00:00:00:00:01:fe
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Minor OS version
0
Major OS version
6
Entry point
3186464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\build\x64-win-redist-release\bin\DirectML.pdb
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-heap-l1-1-0
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
HeapSize
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
TryAcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
TlsAlloc
ExitProcess
TlsGetValue
TlsSetValue
TlsFree
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
DisableThreadLibraryCalls
LoadResource
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
LockResource
api-ms-win-core-localization-l1-2-0
GetCPInfo
FormatMessageW
GetLocaleInfoEx
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetLocaleInfoW
GetOEMCP
LCMapStringEx
IsValidLocale
GetACP
LCMapStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryW
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
d3d12
D3D12SerializeVersionedRootSignature
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
CompareStringEx
MultiByteToWideChar
GetStringTypeW
CompareStringW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-file-l1-1-0
FindFirstFileExW
FindClose
CreateFileW
SetFilePointerEx
GetFileType
FlushFileBuffers
FindNextFileW
WriteFile
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-processenvironment-l1-1-0
SetEnvironmentVariableW
GetCommandLineA
SetStdHandle
GetCommandLineW
GetEnvironmentStringsW
GetStdHandle
FreeEnvironmentStringsW
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsFree
FlsGetValue
FlsAlloc
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-console-l1-1-0
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageFullName
DMLCreateDevice
DMLCreateDevice1
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.7MB
Virtual Size
6.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
85KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=25, id=260, version=29395,
count=10, id=259, version=33808,
count=15, id=260, version=33808,
count=82, id=261, version=33808,
count=9, id=260, version=34120,
count=174, id=261, version=29395,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=141, id=1, productName=Unmarked objects,
count=280, id=261, version=34120,
count=1, id=256, version=34120,
count=1, id=255, version=34120,
count=1, id=151,
count=1, id=258, version=34120,
Microsoft.DiaSymReader.Native.amd64.dll
- IMPHASH 6a827b726a1cd6617ca52b2f9f7d9fe4
- SHA256 315a61c47c41b8d4c815f4274bb6584c1d24b4640c7eedc354ed5b03a9a1361e
- MD5 e4dc9335fb0065d4b3066fcb8a878a9a
- SHA1 0d66f04b77a0726f1bc2077675d485700848d9af
- SHA512 929eb77e8b843e484ee74b408edfefffa15d0ee75d70d3b47a808fe380eeaaa9dc40bb29ef549e47e89dbeab159f806b4f823e8d3dc85e657f7bb32485a1c947
- SSDEEP 49152:8oJlAZFbi/H3LzED3pattTg4nm1OPriyQ:gZFbiPcEHg4mUPQ
- TLSH T1BBA58D97A3AC41E4C47AD178D66B460BE7F238050321A7DF02A0863E7F67BE15A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a1:b4:5e:a3:6f:6b:de:38:ca:fd:cb:b7:86:fd:f0:63:de:1c:0e:85:e4:82:f6:e9:e5:97:27:78:46:08:0d:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 26, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ec:e0:2b:a4:82:d0:91:52:80:00:01:00:00:01:ec
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
143152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\Microsoft.DiaSymReader.Native.amd64.pdb
kernel32
GetLastError
FreeLibrary
DisableThreadLibraryCalls
LocalAlloc
GetCurrentThreadId
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
CreateFileW
CloseHandle
WriteConsoleW
LocalFree
FormatMessageW
GetEnvironmentVariableW
GetTickCount64
GetSystemInfo
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
VirtualAlloc
VirtualFree
DeleteFileW
SetEndOfFile
OutputDebugStringA
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
ExpandEnvironmentStringsW
GetFullPathNameW
GetFileAttributesExW
FormatMessageA
VirtualProtect
VirtualQuery
LoadLibraryExA
GetDriveTypeW
GetCurrentDirectoryW
TryAcquireSRWLockExclusive
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
GetNativeSystemInfo
ole32
CoTaskMemAlloc
CoTaskMemFree
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CreateNGenPdbWriter
CreateSymReader
CreateSymWriter
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectInternal
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=177, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=34321,
count=37, id=260, version=34321,
count=7, id=257, version=30795,
count=194, id=1, productName=Unmarked objects,
count=135, id=261, version=34321,
count=31, id=265, version=34321,
count=1, id=256, version=34321,
count=1, id=255, version=34321,
count=1, id=151,
count=1, id=258, version=34321,
Microsoft.InteractiveExperiences.Projection.dll
- SHA256 92486731f279e49962b3c2cfd6a364cc3cff227a76baff102e8cbb662a494e4d
- MD5 84cd26e7e54ceb4974a5377070b78bc0
- SHA1 a901754843165587382e245e8b079559e9c819e9
- SHA512 0a96437d2fb94e2e2f99e0a773b00ef2960568a2da7f13993d58897117a4710bf298a710abf588f6d9cf461315369f23c6586cdde0bbbdfa3b36788d53451f56
- SSDEEP 768:otjfIVuqn5vUSLYQl+YrvniaFm3DyNlN6zTUbPk6JppYp3p2HnPpzp5pxr7VcPyl:oBgVZn5sAYZE/UGB6zTUzZ6rUOYTe
- TLSH T100A3A31073F90350EAFA8ABDD92B5C65D076FC268B11D3DF1449494D4EE2AC0A6B2F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.Web.WebView2.Core.Projection.dll
- SHA256 0d16d1b24b6782928426aedcacb6459651a8e02cd21685cc81bf0603627a2675
- MD5 9f85d0830eb661d5ff4ef2fc935dca96
- SHA1 955292e14792b6daa6279a0860a56326a212549a
- SHA512 3e3c0d2783aed2e40a3f2a45e57d76eb1fc25cdcedd79f5d2f890de68339bf57aabff3ca6cb7460f8c5d06a93c0fc7d58aef79df01bf47e45ea1940ad29d893b
- SSDEEP 1536:YkdUTXwSgYeke0/Qq4fl9nzc0Og+HX0Ivf0:YkdoPg9ke0/Qq4fl9nzc0Og+HX0Ik
- TLSH T1A033394A634C42B5DABE86FFC8EB4951E025F6437B135ACF08484E4D8F1B7E0A379295
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
364B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.Web.WebView2.Core.dll
- IMPHASH bedf51e5db35b7d6e22e4d4cf54503f0
- SHA256 17ccd9141c486d7a3689ed38d72d3bd8bb0e216b7990fcc76c132dc9102c6320
- MD5 e6fb2b085bc11e777318c6ddb2d934c2
- SHA1 0c6b40efe569cb911c64f874aa7683a9ce2c0aae
- SHA512 360d3e4853788abd357aaceb081354c5a07cb5df8a2ca21de04b7e86095b25563cfc0518407b696f1e7dd96c778ba863bfdd0745633accf2360d4f2b8a09a23b
- SSDEEP 12288:QAf6KkH0mTWQdfBOPNM7gCfU5fKivmTWIZn5pe+NFiqqiwc++ZJPj9llFQ8UoTfG:QAfLsOPsgC85yTWIhns
- TLSH T100F44A4AD6AD1185D439D838DA334909F972B8065360E7CF06A1C76E6F3BBF4963BB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
51:de:7c:49:0f:65:d2:0b:19:39:b2:f3:3d:bf:18:22:2e:2e:8e:0c:cc:29:96:c2:b8:89:f8:24:a3:09:7c:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
512400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Web.WebView2.Core.pdb
kernel32
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
GetLastError
SetLastError
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EncodePointer
ReleaseSRWLockShared
AcquireSRWLockShared
InitOnceExecuteOnce
GetFileAttributesW
CreateFileW
OutputDebugStringA
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
FreeLibrary
GetEnvironmentVariableW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
RaiseException
RtlPcToFileHeader
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
MultiByteToWideChar
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoOriginateError
RoOriginateErrorW
api-ms-win-core-winrt-string-l1-1-0
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer
api-ms-win-shcore-stream-winrt-l1-1-0
CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream
oleaut32
SysFreeString
SysStringLen
GetErrorInfo
VariantInit
VariantClear
SetErrorInfo
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegGetValueW
RegCloseKey
RegOpenKeyExW
api-ms-win-crt-runtime-l1-1-0
abort
_invalid_parameter_noinfo
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_errno
_invoke_watson
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsicmp
strlen
iswspace
wcscmp
wcslen
strcmp
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-convert-l1-1-0
_ultow_s
_wtoi
wcstol
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
free
malloc
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-crt-math-l1-1-0
floor
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=11, id=260, version=35207,
count=46, id=261, version=35207,
count=2, id=260, version=33145,
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33145,
count=132, id=1, productName=Unmarked objects,
count=6, productName=Unmarked objects (old),
count=7, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
Microsoft.Web.WebView2.Core.winmd
- SHA256 88779fd2dbd142738339de337a07a7a111257fa972b9ee8d4618c34902f44f49
- MD5 f3fc7c2e99117c493c1ecdf1e886071e
- SHA1 b48b9b723a746fcfefbb8206b5f6b356e39cc8f1
- SHA512 5307a53a4b19c8fef6e0367c7e47d8d2bded66b4f21c9d33c2e5441ef40c7cfff59209f1cd93af7a9d042079d540ad51ba7a61015cda2bb1a6e54403b24c1125
- SSDEEP 3072:QMcdl8aN7jcQe6nwHhMx9+l9KSky8yKDh2+XQqyPSm3ao0+zmbc0knDQBUQBEhTl:cdrpe6nKhMx9+l9KSky8yKDh2+XQqyPB
- TLSH T1B3D3E703988BAD76ECCA7FFCB8A94A60177D558B3185CF07D60B2D592E833A0BD45274
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
54:8a:b1:0a:f4:d9:48:9b:d3:97:cc:44:84:50:f2:2f:f2:d8:56:2d:39:a1:8b:87:eb:7c:16:ee:79:fd:08:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
2
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
generic
Microsoft.Win32.Registry.dll
- SHA256 b095bd699adea3ffbc5d2e463c92d7de7bb359bfa2df94b037edab3d12d50620
- MD5 2e268018a57ab0b1ee7331b8a79471d3
- SHA1 c2d063bd08d0920f1f271b1acccf79dfc3b44eb7
- SHA512 6b493b7197a6746be374bb70c092a6706009b90296d9f4c7ac51d568617a818e0e4b2d7d72b8f030835b32d74367076363558716c48ba6ba7f4c221324dec2cb
- SSDEEP 768:/OshdDK0dwrmo5yINwAdif3QZI2Htl1Iai+Lf2CyT:/ZhdDK0dwrmeylQ62Hn1Iaigfo
- TLSH T19A132905AFD0421FF5BA8A7E8867D91186B1F8821B05EEDF04C4468F5E36FC1AB71229
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.WinUI.dll
- SHA256 179277126d93344670840cedc4dcf620521b3683448faf6db990b98b8636f8a0
- MD5 cedd13347eecb274c117537c5602f2c0
- SHA1 e766c60038613d3fb0222bf09946891ad9387d68
- SHA512 3bfb73b8a1d36a7a2885258344d1981f16c5e51a8c5514ca3a778b84b6b990df3feac6163cf59d159a35d2c72a2f119ec6351e8ad536c53b64549817c5f1e525
- SSDEEP 6144:FcDhmYL8J/HaCQC9ZT1GGCm9P+aKOB1BwMzi:+gEd+GGr9vS
- TLSH T13874B424D3FD1350FABB9D7956668815F532B923CB84D7DF0100488D8AA6FD096B2F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
296KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.Windows.AI.MachineLearning.dll
- IMPHASH 73a56738ae2e832e430367d3b24c3bad
- SHA256 bbbb34415d8ce303f8a2a2c524c46bd749e21423ccabeb7d38c5fc7334a7848f
- MD5 0a4b6fce3e8a707ffc53fa3017a14d7b
- SHA1 3de9e8eb0416ee4c076874894e84742c8c0367b9
- SHA512 146d06ade6fb5c4ff6cc72cc6d6ab83f51e62086df624505a871d44345272ee5c4c152fe39b89a756e4a1df915df71d946c8b60f14ebb475959cadca64d31656
- SSDEEP 24576:1nscpvRlwXnf4l0ndr6G6CLgNuM38yiczq:NscpEXw0l6ZcM3ficm
- TLSH T12C156C2AA2A800E5D1FAD17DDA538517E6B2741713309BDF13B4861A3F2BFE4893E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b3:7a:da:b2:46:10:d6:7a:dd:20:d9:46:ac:16:f8:fc:83:4f:c0:e2:6e:45:70:07:8f:2a:53:9e:b4:cc:49:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 9, 2026
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Sep 8, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
532352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\bin\x64\Release\src\Microsoft.Windows.AI.MachineLearning\Microsoft.Windows.AI.MachineLearning.pdb
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
SwitchToThread
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageW
LCMapStringEx
FormatMessageA
api-ms-win-core-wow64-l1-1-1
IsWow64Process2
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
LockResource
GetModuleHandleExW
LoadLibraryExA
FreeLibrary
SizeofResource
LoadResource
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CreateThreadpoolWork
CloseThreadpoolTimer
SetThreadpoolWaitEx
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWait
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
OpenSemaphoreW
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObject
CreateEventExW
ReleaseSemaphore
CreateMutexExW
CreateSemaphoreExW
ReleaseSRWLockExclusive
SetEvent
WaitForSingleObjectEx
ReleaseMutex
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeConditionVariable
InitOnceComplete
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-com-l1-1-0
CoGetObjectContext
CoGetApartmentType
CoCreateFreeThreadedMarshaler
PropVariantClear
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoIncrementMTAUsage
CoDecrementMTAUsage
CoUninitialize
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-1-0
GetFullPathNameW
GetFileAttributesExW
CreateFileW
SetFileInformationByHandle
FindClose
CreateDirectoryW
FindFirstFileW
api-ms-win-core-string-l1-1-0
CompareStringEx
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CompareStringOrdinal
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
bcrypt
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
api-ms-win-core-sidebyside-l1-1-0
DeactivateActCtx
ReleaseActCtx
CreateActCtxW
ActivateActCtx
api-ms-win-core-featurestaging-l1-1-0
GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification
api-ms-win-appmodel-runtime-l1-1-0
GetCurrentPackageInfo
api-ms-win-core-psm-appnotify-l1-1-0
RegisterAppStateChangeNotification
ntdll
RtlGetVersion
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_initialize_narrow_environment
abort
_configure_narrow_argv
_invoke_watson
_invalid_parameter_noinfo
_errno
_seh_filter_dll
_register_onexit_function
_crt_atexit
_initterm_e
_initterm
terminate
_cexit
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
_wcsdup
isupper
__strncnt
wcsnlen
islower
strcmp
strlen
towlower
_wcsicmp
iswspace
strcpy_s
api-ms-win-crt-stdio-l1-1-0
fgetc
_wfsopen
setvbuf
__stdio_common_vswprintf
fclose
_get_stream_buffer_pointers
fread
fwrite
fgetpos
_fseeki64
fsetpos
fflush
__stdio_common_vswprintf_s
ungetc
fputc
api-ms-win-crt-heap-l1-1-0
_calloc_base
calloc
_malloc_base
realloc
free
_callnewh
malloc
_free_base
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
___mb_cur_max_func
__pctype_func
___lc_collate_cp_func
___lc_codepage_func
setlocale
_unlock_locales
_lock_locales
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-rtlsupport-l1-1-0
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
api-ms-win-core-fibers-l1-1-0
FlsFree
FlsAlloc
FlsSetValue
FlsGetValue
oleaut32
SetErrorInfo
SysFreeString
SysStringLen
GetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoTransformError
RoFailFastWithErrorContext
api-ms-win-core-com-l1-1-1
RoGetAgileReference
DllCanUnloadNow
DllGetActivationFactory
WinMLAsyncCancel
WinMLAsyncClose
WinMLAsyncGetStatus
WinMLCatalogModelInfoEnumExecutionProviders
WinMLCatalogModelInfoGetId
WinMLCatalogModelInfoGetIdSize
WinMLCatalogModelInfoGetInstanceAsync
WinMLCatalogModelInfoGetInstanceResult
WinMLCatalogModelInfoGetInstanceWithHeadersAsync
WinMLCatalogModelInfoGetLicense
WinMLCatalogModelInfoGetLicenseSize
WinMLCatalogModelInfoGetLicenseText
WinMLCatalogModelInfoGetLicenseTextSize
WinMLCatalogModelInfoGetLicenseUri
WinMLCatalogModelInfoGetLicenseUriSize
WinMLCatalogModelInfoGetModelSizeInBytes
WinMLCatalogModelInfoGetName
WinMLCatalogModelInfoGetNameSize
WinMLCatalogModelInfoGetPublisher
WinMLCatalogModelInfoGetPublisherSize
WinMLCatalogModelInfoGetSourceId
WinMLCatalogModelInfoGetSourceIdSize
WinMLCatalogModelInfoGetStatus
WinMLCatalogModelInfoGetUri
WinMLCatalogModelInfoGetUriSize
WinMLCatalogModelInfoGetVersion
WinMLCatalogModelInfoGetVersionSize
WinMLCatalogModelInfoRelease
WinMLCatalogModelInstanceClose
WinMLCatalogModelInstanceEnumModelPaths
WinMLCatalogModelInstanceGetModelInfo
WinMLCatalogModelInstanceRelease
WinMLEpCatalogCreate
WinMLEpCatalogCreateWithMode
WinMLEpCatalogEnumProviders
WinMLEpCatalogFindProvider
WinMLEpCatalogRelease
WinMLEpEnsureReady
WinMLEpEnsureReadyAsync
WinMLEpGetCertification
WinMLEpGetLibraryPath
WinMLEpGetLibraryPathSize
WinMLEpGetName
WinMLEpGetNameSize
WinMLEpGetPackageFamilyName
WinMLEpGetPackageFamilyNameSize
WinMLEpGetPackageRootPath
WinMLEpGetPackageRootPathSize
WinMLEpGetReadyState
WinMLEpGetVersion
WinMLEpGetVersionSize
WinMLModelCatalogCreate
WinMLModelCatalogEnumExecutionProviders
WinMLModelCatalogFindAllModels
WinMLModelCatalogFindAllModelsAsync
WinMLModelCatalogFindAllModelsGetResult
WinMLModelCatalogFindModel
WinMLModelCatalogFindModelAsync
WinMLModelCatalogFindModelGetResult
WinMLModelCatalogGetAvailableModel
WinMLModelCatalogGetAvailableModels
WinMLModelCatalogRelease
WinMLModelCatalogSetExecutionProviders
WinMLModelCatalogSourceCreateFromUri
WinMLModelCatalogSourceCreateFromUriAsync
WinMLModelCatalogSourceCreateFromUriWithHeaders
WinMLModelCatalogSourceCreateFromUriWithHeadersAsync
WinMLModelCatalogSourceGetId
WinMLModelCatalogSourceGetIdSize
WinMLModelCatalogSourceGetResult
WinMLModelCatalogSourceGetUri
WinMLModelCatalogSourceGetUriSize
WinMLModelCatalogSourceRelease
Name
.text
Size
653KB
Virtual Size
652KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=35222,
count=45, id=261, version=35222,
count=13, id=259, version=35222,
count=2, id=257, version=33145,
count=4, id=261, version=35207,
count=103, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=273, id=1, productName=Unmarked objects,
count=69, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,
Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.dll
- IMPHASH a0ab3d67fb2834e8c3fb7777dd4be9c7
- SHA256 4d51cbf8109572779c8f3789da137e68925743fdc1cd844bc502ae33e4b0a618
- MD5 2a78109ad77310e7187565692ed59674
- SHA1 e48346dd4c4632270dd6d7e76c0245aec515c315
- SHA512 e1f6561266f9cce178dc3ba4a5b6e26d7567df03f19bbbe3c983d3420ad7b6b307b0b8acb5d7fd0b78d183746d6e676242f58c136e8c64caa9ed2bc85435c05d
- SSDEEP 1536:wAQp3alEeZ65TUyCNNtVH8YTEjbqaMKQZbIKIx9E7oeDNrze:/QpKiq69UyURREjbx/s8mcCNry
- TLSH T14F934A55A2B911F9E0BB907DC5D74A0AEB76B016672127DB0361836E0F73FD19E3E280
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
da:6e:49:5a:c8:44:3d:63:a2:cf:47:f1:1e:9b:26:59:2a:67:96:6f:32:f0:ac:19:fa:ec:e2:17:c3:bf:3f:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
32256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Windows.ApplicationModel.Background.UniversalBGTask.pdb
microsoft.internal.frameworkudk
Containment_GetChangeEnabled
kernel32
WideCharToMultiByte
FreeLibrary
FormatMessageW
GetCurrentThreadId
GetProcessHeap
HeapAlloc
GetModuleHandleW
GetProcAddress
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
LoadLibraryExW
IsDebuggerPresent
OutputDebugStringW
MultiByteToWideChar
api-ms-win-crt-private-l1-1-0
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__register_onexit_function
_o__seh_filter_dll
_o_abort
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___std_exception_destroy
_o___std_exception_copy
api-ms-win-core-com-l1-1-0
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsSetValue
FlsFree
FlsGetValue
FlsAlloc
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
SysAllocString
SysStringLen
DllCanUnloadNow
DllGetActivationFactory
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=35724,
count=10, id=259, version=35724,
count=34, id=261, version=35724,
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=253, version=35724,
count=5, id=257, version=33145,
count=1119, id=1, productName=Unmarked objects,
count=6, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,
Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll
- SHA256 bf1e229ccb586c8fc452f9a50b27ed0e83f44b4dfa44760d36908db0a2291a0a
- MD5 c3cec8dad07168f98f929ed955bc5948
- SHA1 3ff4aac61743d7f79c8976d959ac97a3a5cd0114
- SHA512 c477d42c1e35a50f771766fab95eca6bc98235adf9f259a59eea21f1ad3b02fabde82e501e2d81845f4c7b67b5ac0a1d06c0ad9f7b8f5e32d63bbcaeaa9b8429
- SSDEEP 384:uWFGyFMphY92K8PWbnfOt9V6NGUIlvLDZeZIGweFOMCKRKBJ49eGMLBP9bjf:1cpC92MnC9VSGUWltEFOmjvM9P
- TLSH T18603288543888222DEBBA276CC9B5E41E9B1F1776B52FEFF0480D44C6EA7BD41331586
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.Windows.SDK.NET.dll
- SHA256 05a76606848822e08d5240efdad585ad301eda842965530fd07196e48f436722
- MD5 1e8eb16704ca8df57cae8e13432ff9a3
- SHA1 9836920652a9cd2dee26e8dfa17ebdc3b166c59a
- SHA512 b67f024d550b207fdbd6bd39e03538c563e832f42cd38c99b8db849c6db890737840317191dd8be5f8353ca0ef61e78196c254abece253c09efe06d4c47fb158
- SSDEEP 3072:D0IKb7msQP3oQC9rE8o2tkLGJs8vL9nu1WJ8hO0MyHq7MTzjiYCj7jjTgUiZ+cD2:nk61foRo2tURBiYCjHXgUiZ+chc4t45
- TLSH T1F5143A6253AD0714FABF5A7E9257CB21C071E8138B01C2CB16BA55580F93BC1A3F67A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
176KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.WindowsAppRuntime.Bootstrap.dll
- IMPHASH b1e2ab305645ba3ec8e20fa948a6fc2a
- SHA256 07f219d022f5b2fdc75f455d6dc7df35ebdcfcb2dcd0a14c59827c64eefc9b70
- MD5 7212bb2ca1e81ae3cdb8326666153f27
- SHA1 fe28cc7cc823be2f350ccf180fa3cb1b1fc623ec
- SHA512 934c81825bd0051969d1d55ceeffe4e1093077f45995a278275596a3bb4a9869cdf93476dc739597500cd01dfdb148891b3656ecc325403dbf7f8512cab1372a
- SSDEEP 6144:CAs3AvP92f0fl0CmqX5V9ph0lhSMXlBXBWn08Qp:CAs3AEsflnmqX53ph0lhSMXli086
- TLSH T191848D25FBE981F9F12B9178D9B74B06FB33308D432156DB026981251F77BE2693A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b1:a2:1f:de:52:f3:0f:34:63:c0:e3:85:22:45:69:f4:9e:3a:5c:61:1e:48:45:25:52:44:81:52:e1:a0:f1:8e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 16, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
150688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.WindowsAppRuntime.Bootstrap.pdb
advapi32
EventWriteTransfer
EventUnregister
EventActivityIdControl
DeregisterEventSource
EventSetInformation
EventRegister
ReportEventW
RegisterEventSourceW
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
kernel32
GetModuleHandleW
ReleaseSemaphore
SetLastError
GetLastError
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
CreateSemaphoreExW
HeapAlloc
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
CreateEventExW
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
DisableThreadLibraryCalls
CloseHandle
GetCurrentPackageFullName
DebugBreak
CreateMutexExW
LoadLibraryW
CompareStringOrdinal
PackageIdFromFullName
OpenPackageInfoByFullName
GetPackageInfo
AddDllDirectory
SetEnvironmentVariableW
GetEnvironmentVariableW
RemoveDllDirectory
GetCurrentProcessId
FormatApplicationUserModelId
GetPackagePathByFullName
FindFirstFileW
OpenSemaphoreW
HeapFree
GetProcessHeap
InitOnceComplete
GetModuleFileNameW
K32GetModuleFileNameExW
WaitForSingleObjectEx
ReleaseMutex
ClosePackageInfo
SetEvent
InitOnceBeginInitialize
FindClose
WaitForSingleObject
ole32
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
RoFailFastWithErrorContext
SetRestrictedErrorInfo
oleaut32
SysFreeString
SysAllocString
SysStringLen
SetErrorInfo
GetErrorInfo
user32
MessageBoxW
LoadStringA
rpcrt4
UuidFromStringW
shell32
ShellExecuteExW
api-ms-win-appmodel-runtime-l1-1-1
VerifyPackageFamilyName
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
api-ms-win-crt-private-l1-1-0
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o__callnewh
_o__calloc_base
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__dsign
_o__errno
_o__execute_onexit_table
_o__fdsign
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__ldsign
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswprintf
_o_abort
_o_calloc
_o_free
_o_iswspace
_o_localeconv
_o_malloc
_o_setlocale
_o_terminate
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-synch-l1-1-0
CreateEventW
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-errorhandling-l1-1-0
RaiseException
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
api-ms-win-core-fibers-l1-1-0
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
MddBootstrapInitialize
MddBootstrapInitialize2
MddBootstrapShutdown
MddBootstrapTestInitialize
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
185KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
668B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=261, version=35207,
count=11, id=260, version=35724,
count=11, id=259, version=35724,
count=38, id=261, version=35724,
count=1, id=253, version=35724,
count=2, id=260, version=33145,
count=1192, id=1, productName=Unmarked objects,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=265, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=151,
count=1, id=258, version=35724,
System.Collections.Concurrent.dll
- SHA256 02904d3147251c23684e4c5383fc0cb0bf1c0a21b50ad9cdbc0c8a890dbd19d4
- MD5 d9d542c99a065ee36b8a04e5b75e437c
- SHA1 87e98476085000815a558754efb1e329951de5fa
- SHA512 3737a2caf852137c55bdc23a7b590554344f96515d123e02d158eaa0f06a17b5bb36d410db623e95fff1a4056bd9f18b66bf1df6184c98c81d5eb2ff57549b54
- SSDEEP 768:k9m7048I8HFnTWHrI1h43i0P7HegMLyqhvQskTw/PU+ZGdDQcSnX3Tls/m9S:k0Kh43i0P+e8vA2q07P9S
- TLSH T177533C2033DC0315E4BF473A99B6E8609972FA971712C4CF00D9A14E1E77FC16A766A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
52KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Collections.Immutable.dll
- SHA256 d753ec67f80dfa8e928137ac307917c29878403cde22a5732a6e2f7e5374576d
- MD5 2aa57a2cce1b3287cc5c627e63e645e5
- SHA1 8aa786ff49800c9bdd73166b6b241a9526d56cf1
- SHA512 3e43bc14475f1cd52f567d47a9f8ad6973e0bb006baaff297c7bbdfc29ce436ee26682e35f84510e7c3333f49998cd6a331e65e1a84fbe20e0c7315519e33a4c
- SSDEEP 768:9MeMfMufKsSg3ou+oXsMT0mK5eohTvdc0+R53p6:9CfMuRSg3KMLKXhbd+3p
- TLSH T19123191073D80371F8BF4B7FA8A281558331F9626722D9CF01C8964E5E777C196B636A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Collections.NonGeneric.dll
- SHA256 e8c68ccc744981a2bc99147598b29e802bdcb52562b3f83df36d8bc980142d3d
- MD5 9611e98ef6de2ee5a9bf2e2b6ac62b34
- SHA1 355f9f6fc7deb9bde51cb8995cb4735ccee68945
- SHA512 a7cef302273d1c0765156e07c581515d581fdc24722ac4c744ac269e7f72767e680c68f563733974d8560ee4ff9514f0f59c63c07c99574f128cb2f3966570c6
- SSDEEP 96:P0HR+la+R/a7et8yMHdR//f3mWvGD63v1M+XBD4OGsfxvVmanDmDeIDQWPdoWaT:gcQ8OX373v1TXWOHfxNfhWPdoWaT
- TLSH T112E1721173E81336FEF71B72AC776281567ABDA58823DA2D1049010FAD35B104BB2B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
System.Collections.Specialized.dll
- SHA256 c18545c6b084c079112aea9b7cc650dbd3c5ac73c624d6223a78c5d7cad7d283
- MD5 2e4f056d86fbef4313ed4ba1dde93b99
- SHA1 d459388440aceb67598874762a0f42cbd3ec8874
- SHA512 4fa6f3160d6c6ec66997c77d318c067415fb43bb469e9f8e34b6c97ae8cec1e5dd540cf59d178892f6b27cda418cf91ff08cd0bffed4523f0187eb1b1be2b9b1
- SSDEEP 384:AW5+1WGsAcdDLQhlodsZ8NCGmayOa/3/aaVdpEaMoQQSaix3:udsAcdbdlfwf1DpPb/l
- TLSH T138D2172AA3D80720DEBB677D8C7B5A42C670FC942753D7DF20A4858E0D567C05B72A27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Collections.dll
- SHA256 94b816eedcf0ed4a9ae88444ea45df80830764f4dbaa42e5fb8bdb1f19a1c055
- MD5 44fcb0d3e70cc5163b16dda9c03cc2f5
- SHA1 43375e6742f374aa946e2e357200a3b2a1986d95
- SHA512 e812c9c3b6aa4b04bcd943aad15a0fc8cc656cd940e2f4e5f305b8c038fae7522a874c4eeceaa4be64e003555598c141c1c350af7242f6e3416370312edaa79d
- SSDEEP 384:luWSFFQWGyDL1rU6kBw0CjbGp48DIYzpqgq063/dz7iMMWfjNBCi0X7r:24MnkBw0ibGpf/El069iA
- TLSH T1F9E2E620B3D85336F9F7073AA87B52109676F9B16B02EBDF1085510E5C61BC087B67BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.ComponentModel.Primitives.dll
- SHA256 0533f23db8e523ce1855002a57ad3dc13bc81bd9a6b3bc4dd393927e19f5bbef
- MD5 3530ed90c1b5014cb3aa810b79bc0268
- SHA1 b3e939a351e97f7ba79364a226343147377e6be8
- SHA512 2b9d93dad242f5bf17cce4ad4bc8dde6ceca292dc0be364057108b40ef4e087454ef2879f91ccd21911399e88905a06607a2ece04a1f1517c48386952ec35afe
- SSDEEP 384:DlWnyZWGx2hI2gzCJTBem4TcP4CW4+INtR+rMkP6oNeTGc:D/hxOxdUm4TXo+k
- TLSH T175D2092A73E94322FAF307B859738A0192B5FA086B13CADF0492564D5F6778012B17A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
974B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.ComponentModel.TypeConverter.dll
- SHA256 fe2f97a364ef7aae52c67df82adacd554b6ad52414ba7502c0c7e204a33982ae
- MD5 70d35af1db9a41323ed89b55e07f2a9f
- SHA1 62fa47694105bf99cbdad508ca302ce932b919a1
- SHA512 b0d7cd90202408aceeba7e8f838e7fbf71c020b2c096ec555569522379ee6a0a5e4e1db25bfa59d23311975fc13aa2e1938301f3aed8fb6d9980779617ae932b
- SSDEEP 384:jWYETWGZuJ8jwvQ+FlypNGObN8KWjGNGt+Xxww4cY:EbwujR+FkGKWXg
- TLSH T1F9D2B621B7E90368F8F307796E3AAA019E7ABC546E63CA9F0444444D1DB2FC4C9B1776
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
487B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.ComponentModel.dll
- SHA256 eb131c6a32272b8b63fd36e6f124daab9671b046b2a545656fea4ef95de34480
- MD5 6ca74facbd28b0e2ab62a3bae3c67afc
- SHA1 55bac84876e9c002a356fa70db93a9beecab62b0
- SHA512 d378ee2a5aa9fc04e3026ca010bf1f3e88ae053ed1307db7580d2f606e270184d35b0b4db56895fd37e0ec5a87fb635be4f4308af6363bdfc0e661ce5b3e9b95
- SSDEEP 48:6nWXjQRBhWC4+O8g3+Iv1X0l1YTzDmDQlM3ZD4+Y5yWFZWOTW0Kt2W3aWx5Wml4F:hjuBl4+A3xv1qEDmDeIDFIW4O1WaT
- TLSH T1A6916325D3F443B7DC738B32AC63A28162B9BB18DD23DB3E05C9415A6D56A248B71722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.Process.dll
- SHA256 813be7aea0a50c328d90a1d8194e450531ff8bb787d07c7e52f38604a59b6c9e
- MD5 c7c4433f0e7acf49d9f57edd8370e52e
- SHA1 1ecb6df5a6a7111b05d0bf2f06a84168309bf340
- SHA512 516fd9bd07abb77c032891b6c14f3b00d8f4eb29030c5eb52487530a9f70e71ace5b6bbf2244d4fe87b7f09a8e6cfa1ad9611afce72750ab87836864a98f2581
- SSDEEP 3072:sud17SkdIXwU1o/+b32qWb7VgdkrLUZ+tujb3XMlotl5EZ45KDX:pXpiGqWOdkrm+Qjb3XMloX5s45Kr
- TLSH T1A3F34A12EB98411BF6AF4A7EA4630902D373F4970751D9CB04C4C69B1F67BC2BE32662
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
144KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.StackTrace.dll
- SHA256 c55dcc3786d8ce457c40873a4a8460c887944cd468526c8d627c4e7255fccac8
- MD5 46fa8ebfb5a7768bd9c22eff6859c6b0
- SHA1 11d9cf5a398710176f0c5bdd6b8304bb85927c46
- SHA512 c2f86e636755a76d4fc776d44d698320d4a927f2562a4404a48a8f8dc249091f4ecd1c3711bfda67d2edf2a836014707cacad8eab0f529f9bba90796b481a65f
- SSDEEP 192:/XWnVgWaT5n83hEtU/Lw6Ny8BfC6IeEox2nCb:/XWnVgWGhuOmw6PYen5
- TLSH T1F9B21A26B3D8D72AF9EE0F79ECE286111370DE5458C3CF9B0A84160BDC676806B71658
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
403B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.IO.Compression.Native.dll
- IMPHASH 760ae29f65375c7d8e3d74d417c76f29
- SHA256 93045a2d6b619b6e838e0f25889e4a39b771a2fe17e3749e189fb0b54a7b4172
- MD5 064382ce75b58dbebed18082cf42535a
- SHA1 8883dc66264f6123535180d34342f4b21d74321a
- SHA512 4a1eccbc89d2a16b1285b7e17f805309ba88804cfd462a95275cead968444bc7b6b048584936a684b04778cab627795843d0a996478449c48f6356117f6253b2
- SSDEEP 12288:CRTTQHZgpzurjX/Dbn3QQz05ADnbAHhlyZ8OXTw05nmZfRztEQ:hQ96bAPlAmZfRRj
- TLSH T183059E07E5B25775CC2B80788DA71236EB3572A8531089A7729CE5353E83B2417BB3ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:5a:3a:08:44:d1:ec:c9:c0:13:ce:13:8a:70:a4:80:fa:36:ff:1d:6b:e4:50:89:7f:63:ea:22:b3:27:a0:fd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
317136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\native\net8.0-windows-Release-x64\System.IO.Compression.Native\System.IO.Compression.Native.pdb
kernel32
HeapCreate
HeapFree
EncodePointer
HeapAlloc
DecodePointer
HeapDestroy
GetProcessHeap
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
_initterm
exit
_initialize_narrow_environment
abort
api-ms-win-crt-string-l1-1-0
wcsncmp
api-ms-win-crt-math-l1-1-0
log2
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderIsFinished
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderSetParameter
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_
Name
.text
Size
314KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
474KB
Virtual Size
473KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=35207,
count=10, id=260, version=35207,
count=32, id=261, version=35207,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33140,
count=67, id=1, productName=Unmarked objects,
count=47, id=264, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
System.IO.Compression.dll
- SHA256 d5e23e4cc88b302cbf347ee8bd586271b32ad01ffe0f16b8d1cb4daf14194fd7
- MD5 31c2e692be591db6c0567583b01037d3
- SHA1 6f96c38244c2db8e99f5ce1d3d56fae100accb7f
- SHA512 7bc1974ab1c0902fba4f3198ba1ac0ce7f0329e967843aa2a69ad925e4a8e6abea2a6e3a36e03c1e88e3e91cbe5703732955a6b2573ffdd3e87df4d39fc696b7
- SSDEEP 768:5z9YWr8jLhC4Dny9dgAZElfTRO+Bi8Skri6X60YMX8PFhHTjQ//LLQ:5aWgjLg4Dy9dJ4f4+ISri6SMX89hXQr
- TLSH T14C735C1577F40237E9AD86BD89B3454683F0F4552B12C6CF444C88CE3E67BCA8A726A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.IO.MemoryMappedFiles.dll
- SHA256 cc0ad75691ccb18343c5f7077d276188f616e7712070c7189fa053568fcb823f
- MD5 bf902ce711e33194330663dd67d0d755
- SHA1 1085cbe8c516843d9faa47fe6689dc633b4d2888
- SHA512 99d8368c7c1866313059830c2d9fa4af98dba99d22531d609b73256ba9e8b25e318e6f3b484e15032ec2c0be961d05a344dd3c4a25bbc153e67dbdfa5d3d2cb6
- SSDEEP 768:e0T3oGfPx4oS5G54crGQZxvUlL181zB9ZBYnkm80EwaIizk15OGbuISk:eaZx4oS5G5fPTUlxNhHEldzk15fb
- TLSH T15D330A1663E4021BF6BE8F798673A644E670F8972712DACF0442D24F1E53BC19AB2753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Linq.Expressions.dll
- SHA256 e7dc5e723956fd1dbf11c36314458c403358f271dfc17c06cae539d1df86c03d
- MD5 6dcdb8a8c40eee9d858ffb60844730a8
- SHA1 a6efcbad0e26c2a2e4a43beb0f1ca9fce0d2356e
- SHA512 8ef9ff398a79fee192c1ceaaec9d95a5b68e50b71a77eef9e3ecb5c85ad790152326a18281c9fc7c2380b91f08a4a151a0c742f1cd08a933533ddc76d1a1f43c
- SSDEEP 1536:iCsw+uOZJT8x5q5Rzzjw3Ur/AQ89SIzGOF:iCsjZJT8x5qvzzjw3S4QASIv
- TLSH T1FF53E715B7F84361F5FB4B386672C7048A36B9A62B22C98F1058026D2E63F509773B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Linq.dll
- SHA256 2d0b591285a3e775c1456851de99ce6a3de528f047957e88a69c88d5d937618f
- MD5 8293213fa8f56a8c9a9264c9f8b8f000
- SHA1 8a184792d03906ce85bfdd5b107a87ae5c91aac6
- SHA512 69667b831a5a0d5ba08afd220a19191ab761aca79f1fefc905a61ba2023678dde07d25f8ddb38d13b78a1972a2cbf770fe4129bef6ec051c0aaa24220f8d3575
- SSDEEP 384:IW0AvWGFdiPAauTyIeqI4FC3TDLUOYLQ03RYF:1XLEAauGIeqTFCnLWh
- TLSH T175D21B18A7D85337D9BB0ABFEC321652D771FA049B16DEDF4486414E1CA23C0AB3187A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.ObjectModel.dll
- SHA256 340cd69ee3740a1d9bf98d86ec3b027a4e868defbb37869bde761dcc8766f746
- MD5 88c420e391912849cba1af4a04e5799f
- SHA1 5f0dd4ee58a061a248e91d143bd16b7738261ee6
- SHA512 bfd992c6fa32743299283c0fbe005f698886a89f88f815fe19f4d0bce2553ab5825bb5a18a02113f3635d79f04e79d3de1886d148ace7c383993e801666b3919
- SSDEEP 384:ipWSoIXWGrNMTZr+6rsZyDS/TV+UvfM7hx9yKfaThHxh3zZyg3Dmb6CkY:OfrN4ruZyDbd7dEdHAP6N
- TLSH T152E23A35B3E82377FABA033999BB0643D231B8962753C6CF1650804F1EA27C15772A76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Private.CoreLib.dll
- SHA256 8b9c405b37bdb6b366201bad913fc82678eef21f434f50c89553e562c4d7195f
- MD5 6366ca1e2c996b03fed591cbc71ccfef
- SHA1 3e0c2946e1a10717d30bb6e0261aba01d09e4c9d
- SHA512 285790efb0943b3290ec25e1551c184573a5d71d14a37c1a6ffb6d288316addd88b69eefb1807746656734ac451c640f6d190a0a1b0e0538d583412cf519b4dd
- SSDEEP 49152:TWDt1iG3Pgfp1vN3xtgYJym6a/odGkEQO0Z3MQf9oxMDzvg1EfzzkORL1t6af2uc:TWDyV1SrH/RL1t6gMBzwSMa
- TLSH T10946BE11B3C88615E62F827CD5ABC309E6F2B5521340D2CB2825CAA96F53FC5EF771A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
5.4MB
Virtual Size
5.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
232KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Private.Uri.dll
- SHA256 1d2cba19362228f670579d6f3e14c14f768fadc828d83031b843ce7c6765c682
- MD5 22d2fb30c649052fb8b2fea1281433b0
- SHA1 9b480daf7047b755c533fa36d4810248ee03f277
- SHA512 a42896d40f52c8c24d5b73105a65ca2973d8e0ee539450ddc3bdae0235d8a6a39bff08a343924a04195884873421564f2fc6f2bd2b61f938c7b1ac5d032e94a3
- SSDEEP 3072:hd/Mmma901KXXf8sPkXm+Q1Q9GlVsT28kiWueD8AhxctG4Czql:D/M5f1WXfDPk2HdlMzntGu
- TLSH T142F38C11E3D951ABE66F83B881674343E7B37942A342F5D348E49C861E2B7C2B837563
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
148KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
548B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Reflection.Metadata.dll
- SHA256 17b60d7d8fd6a9e865d7b9fe798e48cf93ff7081bd2c4ad41fbf7c461bb4a00c
- MD5 bb06ea912f34e8a24b4cfcab78c2abc4
- SHA1 682219be3a9d6347207bcf8925be8fec9146aaa5
- SHA512 2da5786a4a80e8e666af93e55324d9038e0dc5282573d4151959d603d427cfd49f59ce7cf2144330603a1bcacc2385f6156e49c217d083ecb33e35f004ce2e7b
- SSDEEP 3072:ukx9eLf/01kR90itLjSd3+gLLgEgmibw3IWej4g2VhtvRtay2WhOtnv15j:f9e790T3+WLgaibuIA3b+J
- TLSH T16E246C2163EC4D53F7AA823A9163C111EB3734971322D2CF86949E8B1E47BD1AD356B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
192KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.InteropServices.dll
- SHA256 fd507ae2b01c8c4e8ccfa0460ff5506a655aa6aebe863766431efbd8a485d7b1
- MD5 b60aef83d408b4c70399871abd61c9fc
- SHA1 b09fca0447c2b0e88220077b7b7067029bc7c4c7
- SHA512 2365694f17abd0054bfce87a6a089983d2eac6c3205309d5a61c1588f7d7f185fdc2a834213ce38a08af6df8f6d72f81700436f6057f47ed41e025e4b83c0631
- SSDEEP 384:CW0viWGsJkel2Yd5zVNA0wK86u7FjVyn061Ehyv3N5wnSTdFhoI:IqefQI+FK+Ml50
- TLSH T1BDE2062163CC6A76EA660A3D9C3B8E458E71F9C98B03D6DF86C8950F1E97BC45730760
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Security.Cryptography.dll
- SHA256 0f0f09834ec7ef525f049583fc1d4b7d1a370367ab88bec188d5b1d9169274e7
- MD5 943a8f04f8d9a4311a8e6ecb43dcbfc0
- SHA1 1ea201eacf7063bea322e13068cedda44959e22b
- SHA512 8a56c802a9781fd0a24edc6aa3b4683949f03ccd547897b5f340ed29d8b3264bd9772a9176bb47c1d663805f3c4d760a101b7b82c79deef433c46c9597c78d7b
- SSDEEP 1536:dChC4c0/ikP6ct9pAA+H093hiQMjPA2twQ7S1v:dCAN0/xyQmA+H0DLMIQ7S5
- TLSH T10883E8167BE4057CF9F7C675AAB6A8014E7EF8D23623DA8D0189029E1C32F458772736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Web.HttpUtility.dll
- SHA256 f1ad3b2e2b7454a76b8da36f9a181f3b40bed4ef2932433c7c1efa4ba3dbfec3
- MD5 6ecf4c447faa3a8713be05093103f2cb
- SHA1 d1915ab424732bb5a0f541e2f1d119eab82f218d
- SHA512 f5d85bbf65ee3ef7da23172019fddd654f6daa2fa427e50adb6df076e61db6054b8fc5325bb9a420510e4b036d982ebaa0b09f9f134ef372d0e1d9c0ecd1f2f0
- SSDEEP 768:PzEPXVPc3AhtIVxKoo0HQ/HRRRRRRRRRRRRRRRRRRRR77RRRRRRR:PQdU0aVEQQ/HRRRRRRRRRRRRRRRRRRR/
- TLSH T14BE24A09F78CC766C6A8953A4C635F36DA75FF915302CEDF1288B50A4D323C2A372869
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 389cef344864d5a96c1930f82f7d228243f7da2e669942019bed0769d4a1ad7e
- MD5 0d81c3b55f147119c23a6bcec68f7c93
- SHA1 843b3e0bc2accc9ba9ee9f8092f27962ccf49c11
- SHA512 d67d5237c8d54cb4f4a9e9a1f5155e07d0a4afb38bd4e3842c05ce5d40cc58479f6d282b4d6e769968d0ece83010380dcb443ed60c438dd7fc6d65f80ab09a02
- SSDEEP 48:6wplz5orsAdiRd/+Om6OKzXX0ZwNPCDmDQlM3ZDlJnxZWV1KtZhd5Wml4kU:fuoAdiz+6N2DmDeIDzWvMLWaT
- TLSH T106B1962893E44337ED774FB2EC63860937B8BE50DD63CB1D18C6114A58176288EB1BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WebView2Loader.dll
- IMPHASH 90db803f7a0acc2517ef287c1dc1bb76
- SHA256 ae69309c5e356350ea28d6b71a900bc43ee7e3f7a457d80a1f82efe6c419cc08
- MD5 7e36757d54d02eb93bfc13f8e81a79a1
- SHA1 48c5f26555d696ef0806d9d136dae28b5ea294de
- SHA512 a3fca3f610a652b63326d021ed1a8551d3fde7780371955a7232b239833e120de9046138f58df64fd07ef3a9c4762ed2d768640e1ee674ee2c0d143784c71386
- SSDEEP 3072:S8Jjy7/ph9euiDNQ6A93jJBC9JGv6TSMEtJ6mj4UrAmx:6/NVZ6A93j/QEtJnrb
- TLSH T19FF35C5BB2E500BBE17BC278C5A34A15E772B8111760AAEF036447791F13BD0AE3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a0:1b:22:f3:f8:f0:c1:ec:59:b0:2b:80:ec:83:8c:91:9c:0b:1b:dc:a4:79:bb:95:e4:da:1c:af:0a:5d:79:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
WinRT.Runtime.dll
- SHA256 c0dde4c4a1105b4bd208e30c2a099d60328ce69fbe8178b57083f30f41d262f6
- MD5 88b9a069a982396ed52400983d4be1ab
- SHA1 40d14b38c57f7985b0029e664377b24d5ef472cb
- SHA512 5fa9ea6b6d5ea13615f39a85f9bfba3fa868d8f2831955431d70cdd784458c480439016bddf7dfa76f608d0722b8a89a297e02eb35964a160db410443de9c6ad
- SSDEEP 12288:R00rpn/dHav96iTNqOSzikxZ/pRdAcEx7YsZWbDDNvgBV78zht5z8Sq9/eHBNL0P:e0rp/hGOZZ+lWbDxoyvd899/eHI1+qs
- TLSH T161454B2553AC4604EA3ED67EC5138601D5F0F8C26321D1CF349AD9A92F53BC3AB763A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
[Content_Types].xml
- SHA256 6a67946e8255f4a1acfdb7dd8b06206e096c523ec5f4b98643dc8ad6306f7fde
- MD5 a95f32b90d9e5bf74fdbe9a8764f2167
- SHA1 c2c7bfd39aa43e70495085bddd898df31cf4ba71
- SHA512 8d6ca8117e8811cc2f07ba642276f38ea03d5a29802eb45b92edab96f6b9622e513050db1603d7bc10346b8daf8c027283817a798c321acab498d5bdf7d0f79b
- TLSH T1F10128E2712BD8A007A6C9BFCA626DC41232592FA4D47B08BBDA658E90E079901713C8
- MD5 SHA1 SHA512 TLSH
clretwrc.dll
- SHA256 01aa7d74d16ae2ff436ae7ac84b87b2f15782bc0967b614a39a104966d703fc3
- MD5 c2c0e61beec43de0fac58f989ffeff2f
- SHA1 7c9752e8cde0d5351065b784e337853f597e21ab
- SHA512 4f7e84a6daf4e30025bcfcea5216b9bafa853996de0ea71ec9502ace9721d222d29a96a66e653bb23306f8ff9e508daf329f4bcd3f3ce5e6c7ec0b5bbc0d7e28
- SSDEEP 3072:E99XK6chFjbdP7oCE33XfQIBchLZtfqYZdcYb:+qn7fqYZdLb
- TLSH T1DC6488063BFD4409F5B75FB0AABB5235A676BCA52A51C01D2054D22D2CF1F80CE62BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
04:56:a9:bb:2c:e4:46:7a:3b:68:36:45:13:82:61:3d:eb:ad:7b:b7:ef:10:dc:40:77:81:56:06:ae:48:ec:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\clretwrc\clretwrc.pdb
Name
.rdata
Size
512B
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
292KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=35215,
count=1, id=258, version=35215,
clrgc.dll
- IMPHASH 304ef40c50a46c259720d54b88877583
- SHA256 965f6c73773166a6f83cd90d8bae7d6f110b0c833763944486b60c37d1e98052
- MD5 99cfab06b8c9ab3b05081f3eb94a877e
- SHA1 6e80ec661007300119641f270e3946c5cf690446
- SHA512 62a5cf91d9651abcfa37d3088f2b8b32b399cbb45490804443f1866cd3034aa771b7abf3b0d4686519dedda84ec0eab06318fdb8433f27376adaa76f72034418
- SSDEEP 12288:XxzB0FedABnetPW92ntex4yVmTJfP+Tuu8GoE:Xl2FeyBnedttY4yVgJfP+/
- TLSH T176E48D5EF2ED609CC52BD07A866B7237E7B5700A1B0179EB079487606FA7ED4673A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:52:70:2e:bc:51:3e:5a:9f:cc:a9:d3:b9:d3:1e:cb:76:6b:4a:c5:0b:ad:45:42:b4:8d:9f:e4:55:16:ce:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ab:af:3a:c8:82:4e:48:55:5d:00:00:00:00:04:ab
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
563008
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\gc\clrgc.pdb
kernel32
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlCaptureContext
GetEnabledXStateFeatures
InterlockedFlushSList
GetProcessGroupAffinity
DebugBreak
SleepEx
GlobalMemoryStatusEx
SetThreadGroupAffinity
SwitchToThread
ResetEvent
GetSystemInfo
CloseHandle
QueryPerformanceFrequency
GetCurrentThread
GetLogicalProcessorInformation
SetEvent
K32GetProcessMemoryInfo
GetLogicalProcessorInformationEx
GetCurrentThreadId
GetTickCount64
CreateEventW
IsProcessInJob
WaitForSingleObject
GetLargePageMinimum
FlushProcessWriteBuffers
InitializeCriticalSection
SetThreadPriority
VirtualUnlock
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
SetThreadAffinityMask
SetThreadIdealProcessorEx
QueryInformationJobObject
GetCurrentProcessorNumberEx
VirtualFree
GetThreadIdealProcessorEx
VirtualAlloc
GetProcessAffinityMask
VirtualAllocExNuma
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initterm_e
_initterm
_seh_filter_dll
abort
terminate
_cexit
_initialize_narrow_environment
_execute_onexit_table
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-string-l1-1-0
strlen
wcsncmp
strcmp
strcpy_s
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GC_Initialize
GC_VersionInfo
Name
.text
Size
567KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=33140,
count=103, id=1, productName=Unmarked objects,
count=8, id=259, version=35207,
count=10, id=260, version=35207,
count=42, id=261, version=35207,
count=26, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
clrjit.dll
- IMPHASH f19036fb9d8088815bcfda2fd9263e0e
- SHA256 35b450153b686e94821d3aa82ef6669f57f60088c1d0cc4af9d967107a7179f9
- MD5 5cc05d4c560517ad835354063cf4e7b3
- SHA1 9e4803bca1d6dead046a8bfd9281b67e4bd27532
- SHA512 a95fb20de52949cfc21f761d22009afeac0640da32c89bfaa1b3cfbe99538e1ee2aa9c2d43ab0d43b5c082828a2763b0da3814411795d0f86e3ef6d01f46d81d
- SSDEEP 49152:pSQLg0khGTcN0/kaHF/W+tWp1V1q3+YsNbeIopSaUcrzzcT59LQTdU:8Phl2/kX+YTVotEbeI/aUKzc3B
- TLSH T162859E42A2F805FCD0AF9534C6574A1BEBB2B45913209FCF43F44A96AF237E2162E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
89:47:84:f0:c4:92:24:b2:68:ad:98:f9:04:ba:30:47:2b:a5:58:ba:50:1e:b0:e2:ae:eb:bd:e2:33:27:43:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
1071200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\jit\clrjit.pdb
kernel32
RaiseException
DebugBreak
OutputDebugStringA
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
QueryThreadCycleTime
GetCurrentThread
GetLastError
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
SetLastError
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
RtlPcToFileHeader
api-ms-win-crt-math-l1-1-0
powf
pow
logf
log2f
_fdopen
log2
log10f
log10
log
tanhf
fmodf
fmod
floorf
_copysign
_copysignf
_isnanf
acosh
asinh
atanh
cbrt
sinf
acoshf
asinhf
atanhf
cbrtf
truncf
ilogb
ilogbf
_finite
floor
sinh
sinhf
expf
exp
coshf
cosh
cosf
sqrt
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
acos
sin
sqrtf
tan
tanf
tanh
_isnan
trunc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
fclose
_wfopen
fseek
ftell
fflush
_fileno
__acrt_iob_func
_dup
_setmode
setvbuf
__stdio_common_vfprintf
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
abort
terminate
_cexit
_errno
_initialize_narrow_environment
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo
_execute_onexit_table
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
strncmp
strnlen
strcpy_s
wcsncmp
strcmp
_stricmp
strlen
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
getJit
getLikelyClasses
getLikelyMethods
jitBuildString
jitStartup
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=33140,
count=186, id=1, productName=Unmarked objects,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=34, id=261, version=35207,
count=120, id=270, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
coreclr.dll
- IMPHASH 5e5dc4f721a3ab29269f22f1050f9ee7
- SHA256 36e658ced657f4b29526d0abf8a2b8e208c20a2730512f25b80d3eec7955920f
- MD5 30fc840ce8a78ff91c15e799ac3da03b
- SHA1 0c18a4e71f03906bf1ddc8419ebbc6c6361705ff
- SHA512 7c60d2a922f771e029fb76d0bb81a289238acb3e8dd0e3b23ce8a0effc75a829f188200e09ec0c97b31ccc358dccc9cc3f4025eba2da6eeaea2f8c370571a912
- SSDEEP 49152:TK3aqe0fVUwpZaoKMtV4NLYPgNdnCyMmDjm5GPmxa7OxJIgoHWm3bLbBADmfjcKZ:A/fVUwpZaoKEcM6aNatVsBFaUGnRR
- TLSH T175369D56F2AD00D8D4BAC0B8CAD35527FBB178591B38DBEF02648A651F237E16A3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6e:cd:6b:1b:c7:0f:28:2d:b5:5d:c1:91:e6:ef:ef:23:e6:db:55:93:c1:12:a4:49:26:de:14:40:ec:20:39:bc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ab:af:3a:c8:82:4e:48:55:5d:00:00:00:00:04:ab
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1a:a9:a0:1d:06:a0:0f:43:aa:00:01:00:00:02:1a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
1447840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscoree\coreclr\coreclr.pdb
kernel32
WaitForSingleObject
RaiseException
FreeLibrary
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
MultiByteToWideChar
GetTickCount
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
RtlLookupFunctionEntry
LocateXStateFeature
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
GetTickCount64
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
GetCurrentThreadId
TlsAlloc
GetCurrentThread
GetCurrentProcessId
CreateThread
GetModuleHandleW
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
WriteFile
GetStdHandle
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
InterlockedPopEntrySList
ExitProcess
Sleep
CreateMemoryResourceNotification
VirtualAlloc
VirtualFree
VirtualProtect
SleepEx
SwitchToThread
SuspendThread
ResumeThread
InitializeContext
SetXStateFeaturesMask
RtlRestoreContext
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ReadFile
GetFileSize
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
SetEvent
ResetEvent
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
CopyContext
WerRegisterRuntimeExceptionModule
RtlInstallFunctionTableCallback
GetSystemDefaultLCID
GetUserDefaultLCID
RtlUnwind
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
GetEnvironmentStringsW
TlsSetValue
FormatMessageW
CreateSemaphoreExW
ReleaseSemaphore
GetACP
LCMapStringEx
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentProcessorNumberEx
GetProcessAffinityMask
QueryInformationJobObject
CreateFileMappingW
GetSystemTimeAsFileTime
GetModuleFileNameW
CreateProcessW
GetCPInfo
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetFullPathNameW
LoadLibraryExA
OpenEventW
ReleaseMutex
ExitThread
CreateMutexW
HeapReAlloc
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
SetFilePointer
MapViewOfFile
GetActiveProcessorGroupCount
GetSystemTime
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
RtlAddFunctionTable
LoadLibraryW
CreateFileMappingA
GetNumaHighestNodeNumber
SetThreadAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlVirtualUnwind
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
CloseHandle
TlsGetValue
GetSystemInfo
GetCurrentProcess
OutputDebugStringW
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
WideCharToMultiByte
GetProcAddress
GetModuleHandleExW
SetThreadErrorMode
FlushProcessWriteBuffers
SetLastError
DebugBreak
GetLastError
FreeEnvironmentStringsW
advapi32
ReportEventW
AdjustTokenPrivileges
SetKernelObjectSecurity
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
DeregisterEventSource
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
LookupPrivilegeValueW
ole32
CoCreateFreeThreadedMarshaler
CoRevokeInitializeSpy
CoGetContextToken
CoGetObjectContext
CoUnmarshalInterface
CoGetClassObject
CreateStreamOnHGlobal
CoGetMarshalSizeMax
CLSIDFromProgID
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoMarshalInterface
oleaut32
SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
VariantInit
VariantClear
VariantChangeTypeEx
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
QueryPathOfRegTypeLi
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
SetErrorInfo
SysStringLen
SysAllocString
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayGetElemsize
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
_strnicmp
strtok_s
isspace
strncpy
_strdup
iswupper
towlower
isalpha
isdigit
wcstok_s
strnlen
wcsncmp
iswascii
towupper
strncpy_s
strcat_s
strcpy_s
_wcsicmp
wcsncpy_s
wcsnlen
wcscpy_s
strlen
_wcsnicmp
strcmp
_stricmp
wcscat_s
strncat_s
wcsncat_s
strncmp
iswspace
wcscmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
fgets
fputs
_wfopen
fclose
_flushall
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
__stdio_common_vsscanf
fopen
fwrite
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_initialize_narrow_environment
_errno
abort
_controlfp_s
terminate
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll
api-ms-win-crt-convert-l1-1-0
_ltow_s
_wtoi
atol
_atoi64
_itow_s
strtoull
wcstoul
_wcstoui64
strtoul
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
pow
cosh
cosf
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
acos
powf
logf
exp
sin
expf
log2f
log2
floor
tanhf
log10f
tanh
tanf
log10
fmaf
log
tan
fmodf
sinf
acoshf
cbrtf
sinh
modff
modf
_finite
_isnan
_copysign
atanhf
asinhf
asinh
cbrt
acosh
atanh
fmod
sqrt
coshf
sinhf
fma
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
CLRJitAttachState
GetCLRRuntimeHost
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_set_error_writer
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics
g_dacTable
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
787KB
Virtual Size
786KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=33140,
count=11, id=257, version=33140,
count=399, id=1, productName=Unmarked objects,
count=20, id=259, version=35207,
count=16, id=260, version=35207,
count=45, id=261, version=35207,
count=21, id=259, version=35215,
count=458, id=270, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=151,
count=1, id=258, version=35215,
createdump.exe
- IMPHASH 79df0272f85cf09f18264750616a3dae
- SHA256 42fec70d833344ae2939dd357b57d756505b6054c23c788ec400ea0ee4a5c933
- MD5 95da9a49d35684756c57399c1c602bc6
- SHA1 c5cdbda59e1baa48ba38e424546d026631696197
- SHA512 4695e2e8cf512060af003a70931afc6755fd970965f10cc32a23cb0642774c03727b20d70d7eac83865a653419769c451bf2a364717bd244057fe60dca327e74
- SSDEEP 768:mrPYw1lUK5Htu3VAHBfnuE8SlrBwX3TUYV2NGcDjZL49zeRP:KPYfK5+AV8UBwTt0X2zCP
- TLSH T1FD633A1ACA2A60EBD25E8C78C5534D06EE71BC838BE0B6CB6B914DD50D66BD09F3D305
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
40:95:79:86:fc:8f:b7:86:90:0c:d7:d9:ee:2e:78:f0:82:91:e6:a9:bb:ad:55:7f:7f:21:61:5d:75:08:f0:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
12160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb
kernel32
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
OpenProcess
GetTempPathA
GetLastError
CreateFileA
CloseHandle
K32GetModuleBaseNameA
GetProcAddress
LocalFree
FormatMessageA
LoadLibraryExW
SetUnhandledExceptionFilter
TerminateProcess
FreeLibrary
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
dbghelp
MiniDumpWriteDump
ws2_32
WSAGetLastError
gethostname
WSAStartup
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationProcess
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fclose
fflush
__acrt_iob_func
fopen
api-ms-win-crt-runtime-l1-1-0
_cexit
_initialize_onexit_table
_register_onexit_function
exit
__p___argv
_errno
strerror
_invoke_watson
__p___argc
_register_thread_local_exe_atexit_callback
abort
_crt_atexit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
terminate
_exit
api-ms-win-crt-string-l1-1-0
strlen
wcsncmp
strcat_s
strcmp
strcpy_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
_callnewh
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35207,
count=12, id=260, version=35207,
count=46, id=261, version=35207,
count=9, id=257, version=33140,
count=98, id=1, productName=Unmarked objects,
count=4, id=265, version=35215,
count=1, id=255, version=35215,
count=1, id=151,
count=1, id=258, version=35215,
hostfxr.dll
- IMPHASH cb65b8f322a878c275ae33c40f473b32
- SHA256 aaa156793b9b22ece28553b21a414036da1aba7121ea9bc01ff481d1fb25911c
- MD5 34b6410844e9031edf79dfab8e239e2b
- SHA1 f56deb1b062da74c6b50593d6acaddd6b0ac43a5
- SHA512 03924aef8b176595e8a3d8c6fbb78fd06df1bff49d36a73e6712644e103646d95f9e3dbd01950fd9db27c8dbb71aac2287e5d5f7a90d6f7624caaeefa75407c0
- SSDEEP 6144:zk7AEgQZhFfr82VvOgQJdNTfDIg6HjN3LQ2wtdnpbyAbqq2EhUPVD8sgsDxqX74O:Xl2V+HCR7YR5EVIsTA4IXZKRS
- TLSH T1ED742816D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:ef:11:1e:b4:96:8a:8a:a6:cc:c9:6e:f0:b3:81:49:7f:2b:65:a0:80:56:4c:94:c3:b4:de:59:82:d6:b7:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
217648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb
kernel32
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
FindFirstFileExW
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
GetFileSizeEx
GetLastError
OutputDebugStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
WakeAllConditionVariable
SleepConditionVariableSRW
SwitchToThread
QueryPerformanceCounter
InitializeCriticalSectionEx
EncodePointer
DecodePointer
advapi32
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
terminate
_initterm
_initterm_e
_errno
_initialize_onexit_table
_register_onexit_function
_wcserror_s
_invoke_watson
_cexit
abort
_execute_onexit_table
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
malloc
realloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
__strncnt
_wcsicmp
islower
_wcsdup
strlen
isupper
toupper
tolower
_wcsnicmp
wcsncmp
strcmp
api-ms-win-crt-stdio-l1-1-0
fclose
fgetc
fwrite
fseek
fgetpos
setvbuf
__stdio_common_vswprintf
fsetpos
__stdio_common_vsnwprintf_s
__stdio_common_vfwprintf
fputws
fread
_fseeki64
fputwc
_get_stream_buffer_pointers
_wfsopen
__acrt_iob_func
ungetc
fflush
fputc
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_time64
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
_unlock_locales
__pctype_func
_lock_locales
___lc_codepage_func
setlocale
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
ceilf
hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_dotnet_environment_info
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_bundle_startupinfo
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=10, id=260, version=35207,
count=83, id=261, version=35207,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=33140,
count=194, id=1, productName=Unmarked objects,
count=27, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
hostpolicy.dll
- IMPHASH bca609f3a8d909aaabd71943203bed63
- SHA256 a0b14a705c5ae27d83de5736a2b45aa0d0ebc7f497340301749bf9e44a1c338f
- MD5 6ccec967e0d0815790713781fd3b5dea
- SHA1 6cdbc97cacf33219e6578514b706e17014a866ab
- SHA512 769bdae9f864a0cc487f36e2511581056921c483cd8bea416163dcd7f7eced58d7ace3cb1c9020dafbaa420ac03c9aaef38dc5ba54384f07210ce5094c04398d
- SSDEEP 6144:1/r154Wmihbodr9m5o4G/lFBfONePrjuT8M/7Go/C77s9eOYrQzZPv5MaFyaOaxx:11mXPb/FON4n38xZZZlPKT7PzT2R
- TLSH T12B842816D6E80078F0B7E6798AB38941EB727C4E477196DF1390896A1F73BD09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
69:fd:23:2a:c7:06:5f:3c:c2:1b:d7:00:8a:ea:87:24:14:34:36:33:8b:67:d6:9b:af:a9:9d:8f:e6:3c:2f:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
255552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\hostpolicy\standalone\hostpolicy.pdb
kernel32
OutputDebugStringW
GetFileSizeEx
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetTempPathW
FindClose
CreateFileW
GetCurrentProcessId
GetLastError
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
Sleep
RemoveDirectoryW
MultiByteToWideChar
CreateDirectoryW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
GetStringTypeW
TryAcquireSRWLockExclusive
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
advapi32
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_cexit
_initterm
_errno
_initterm_e
_seh_filter_dll
_wcserror_s
_invoke_watson
_beginthreadex
terminate
_initialize_narrow_environment
abort
api-ms-win-crt-string-l1-1-0
__strncnt
wcsnlen
strcmp
wcsncmp
strcpy_s
_wcsnicmp
tolower
_wcsdup
isupper
strlen
strcspn
islower
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
realloc
calloc
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
fgetpos
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
_wfsopen
fclose
ungetc
fwrite
__acrt_iob_func
fflush
fputwc
fputws
fsetpos
__stdio_common_vfwprintf
__stdio_common_vswprintf
fread
setvbuf
fseek
fgetc
_fseeki64
_get_stream_buffer_pointers
fputc
api-ms-win-crt-locale-l1-1-0
__pctype_func
___mb_cur_max_func
_unlock_locales
_lock_locales
___lc_codepage_func
___lc_locale_name_func
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
_ldclass
_dclass
frexp
ceilf
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload
Name
.text
Size
274KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=10, id=260, version=35207,
count=84, id=261, version=35207,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=33140,
count=197, id=1, productName=Unmarked objects,
count=30, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
mscordaccore.dll
- IMPHASH e9ad42acf7f24caf6b1dc6bdbd5dff55
- SHA256 c4c706a25775ac5d611be3936cef45539652a59fba8526a9f21b25aa13848018
- MD5 7e844a1b5d41a4a73fa961d609cc406a
- SHA1 a86a946a2be7eb63bf3ccf7db7620a3a5fd93e39
- SHA512 6304c44497d63412fde16f58167536ac18308ffd6ef28b07a6f6620525aee3126324a756c8670c0fbdb7b04140397000715a2513a310cd35bbdcdb3c13852f29
- SSDEEP 12288:RAeUnSAE1k5aU8BEzxK6YYX22lh3pNvuYwXZTf0yUAoyC3+xkeuaSqQPE/l735RR:RjzA/azCvV28bgZTfhUx55U35R1emJ
- TLSH T123555A5AD6BC4488CEA9D0F8C547491FE7B23814077466FF46A48B192F3BBE66B78310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:f1:80:16:28:0b:32:21:01:0c:3a:8a:fe:b8:a5:87:a4:2f:89:55:52:be:dc:9f:f7:bf:c3:33:5f:c1:b0:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2025
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5d:70:ed:48:40:45:ba:82:3f:00:00:00:00:00:5d
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
921232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb
kernel32
HeapAlloc
GetProcessHeap
ReadProcessMemory
CloseHandle
DebugBreak
GetCurrentProcess
FlushInstructionCache
SetFilePointer
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetACP
LCMapStringEx
FormatMessageW
LocalFree
HeapDestroy
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetProcAddress
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentThread
SwitchToThread
GetProcessAffinityMask
QueryInformationJobObject
SetLastError
TerminateProcess
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
GetEnvironmentVariableW
LoadLibraryExW
CreateFileW
GetFullPathNameW
WakeAllConditionVariable
GetThreadId
GetProcessIdOfThread
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
ole32
CoCreateGuid
CoTaskMemFree
oleaut32
SetErrorInfo
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
wcscat_s
wcscpy_s
wcsncpy_s
strnlen
strncat_s
strncpy_s
strcmp
strcpy_s
strlen
wcsncmp
wcsncat_s
strncmp
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_cexit
abort
_initialize_onexit_table
_errno
_initterm_e
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_initterm
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
189KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35207,
count=15, id=260, version=35207,
count=42, id=261, version=35207,
count=4, id=260, version=33140,
count=11, id=257, version=33140,
count=167, id=1, productName=Unmarked objects,
count=184, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
mscordaccore_amd64_amd64_8.0.2225.52707.dll
- IMPHASH e9ad42acf7f24caf6b1dc6bdbd5dff55
- SHA256 c4c706a25775ac5d611be3936cef45539652a59fba8526a9f21b25aa13848018
- MD5 7e844a1b5d41a4a73fa961d609cc406a
- SHA1 a86a946a2be7eb63bf3ccf7db7620a3a5fd93e39
- SHA512 6304c44497d63412fde16f58167536ac18308ffd6ef28b07a6f6620525aee3126324a756c8670c0fbdb7b04140397000715a2513a310cd35bbdcdb3c13852f29
- SSDEEP 12288:RAeUnSAE1k5aU8BEzxK6YYX22lh3pNvuYwXZTf0yUAoyC3+xkeuaSqQPE/l735RR:RjzA/azCvV28bgZTfhUx55U35R1emJ
- TLSH T123555A5AD6BC4488CEA9D0F8C547491FE7B23814077466FF46A48B192F3BBE66B78310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:f1:80:16:28:0b:32:21:01:0c:3a:8a:fe:b8:a5:87:a4:2f:89:55:52:be:dc:9f:f7:bf:c3:33:5f:c1:b0:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2025
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5d:70:ed:48:40:45:ba:82:3f:00:00:00:00:00:5d
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
921232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb
kernel32
HeapAlloc
GetProcessHeap
ReadProcessMemory
CloseHandle
DebugBreak
GetCurrentProcess
FlushInstructionCache
SetFilePointer
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetACP
LCMapStringEx
FormatMessageW
LocalFree
HeapDestroy
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetProcAddress
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentThread
SwitchToThread
GetProcessAffinityMask
QueryInformationJobObject
SetLastError
TerminateProcess
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
GetEnvironmentVariableW
LoadLibraryExW
CreateFileW
GetFullPathNameW
WakeAllConditionVariable
GetThreadId
GetProcessIdOfThread
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
ole32
CoCreateGuid
CoTaskMemFree
oleaut32
SetErrorInfo
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
wcscat_s
wcscpy_s
wcsncpy_s
strnlen
strncat_s
strncpy_s
strcmp
strcpy_s
strlen
wcsncmp
wcsncat_s
strncmp
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_cexit
abort
_initialize_onexit_table
_errno
_initterm_e
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_initterm
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
189KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35207,
count=15, id=260, version=35207,
count=42, id=261, version=35207,
count=4, id=260, version=33140,
count=11, id=257, version=33140,
count=167, id=1, productName=Unmarked objects,
count=184, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
mscordbi.dll
- IMPHASH ff384dabaa036cfc94e822740a20ed71
- SHA256 623eabed437e266785a6cee0be2bfb2d73f0800b04a96019936ecb2f1c6303f6
- MD5 563309ba9c8792737316cc0abe79d966
- SHA1 9e0f32b3cdb1de322ad4f6f5779103ffd03af5a1
- SHA512 aa76d7193cb430e2fda0a13df8dfc369d7d5dab003b832a061600145f033216b6cdc3063d7f3694a5b691d20f39636b6c6b307ab808749d88f0aa5f03a1a56d8
- SSDEEP 12288:7vGsOCGcJl9+cCjNksJZaZz/IHscpwfgIHJRAk7dulkVjFPU2o1OrYYEkyxd306d:Fl9+njNksJEZTngIArmVjGMT2d39d
- TLSH T11F456C56ABFD5199C9A6C0BEC19B421BFA70384523246BDB0790C61D2F3BBE56E7C310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:fa:1d:f3:e5:87:3b:fe:79:aa:3b:fb:9f:d1:01:c5:1e:d6:00:80:1a:0b:f2:5a:80:89:8f:10:e4:26:98:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2025
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5d:70:ed:48:40:45:ba:82:3f:00:00:00:00:00:5d
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
799552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordbi\mscordbi.pdb
kernel32
GetCurrentProcessId
FlushFileBuffers
CreateFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryExW
GetProcAddress
WaitForMultipleObjectsEx
SetEvent
ResetEvent
GetCurrentThreadId
FlushInstructionCache
OpenThread
SuspendThread
ResumeThread
CreateThread
InitializeContext
CopyContext
SetThreadContext
TerminateProcess
GetThreadContext
ContinueDebugEvent
FreeLibrary
VirtualQueryEx
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
OpenProcess
IsWow64Process
ReadProcessMemory
WriteProcessMemory
HeapAlloc
HeapFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapCreate
GetProcessHeap
DebugBreak
VirtualQuery
RaiseException
SetLastError
GetACP
LCMapStringEx
MultiByteToWideChar
FormatMessageW
LocalFree
GetSystemInfo
GetModuleFileNameW
GetEnvironmentVariableW
GetFileAttributesExW
GetFullPathNameW
GetCurrentThread
SwitchToThread
CreateProcessW
SleepEx
VirtualAlloc
VirtualFree
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore
SetFilePointer
TlsFree
CloseHandle
GetLastError
CreateEventW
DuplicateHandle
WaitForSingleObject
WriteFile
GetCurrentProcess
QueryPerformanceFrequency
ReadFile
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
advapi32
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
oleaut32
VariantInit
CreateErrorInfo
SetErrorInfo
user32
LoadStringW
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
api-ms-win-crt-string-l1-1-0
wcscat_s
wcsnlen
wcsncpy_s
wcscpy_s
_wcsicmp
wcsncat_s
strcmp
wcsncmp
strncmp
strncpy_s
strcpy_s
strlen
api-ms-win-crt-runtime-l1-1-0
terminate
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initterm
_initialize_onexit_table
_execute_onexit_table
_cexit
abort
_errno
_invalid_parameter_noinfo
_initialize_narrow_environment
api-ms-win-crt-convert-l1-1-0
wcstoul
CoreCLRCreateCordbObject
CoreCLRCreateCordbObject3
CoreCLRCreateCordbObjectEx
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
OpenVirtualProcessImpl2
Name
.text
Size
956KB
Virtual Size
956KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35207,
count=15, id=260, version=35207,
count=36, id=261, version=35207,
count=4, id=260, version=33140,
count=11, id=257, version=33140,
count=189, id=1, productName=Unmarked objects,
count=1, id=259, version=35215,
count=112, id=265, version=35215,
count=1, id=256, version=35215,
count=1, id=255, version=35215,
count=1, id=258, version=35215,
mscorrc.dll
- SHA256 021fcbc1ed477e345cadf77611017ec423cf4dcd95fbdfa20eac9fcaa944f1ef
- MD5 3d2b66aa22cc3db8a7d2d69c384e7121
- SHA1 12cbddfc41cac7a6ff8ccf4227403c2905bdf46f
- SHA512 32a9166fc52c6ec8f1a50b2450c9de1d382b878dbad275c7431681293a4ee919ff0e9a8f6af18f2954733a0e82cf0e78d83e5cc65b54a96b3faab0ffd4bc5bf9
- SSDEEP 1536:VxaA91YWvh7xR+l5dZU49N9SqignwJ5cvBMgSIctpoECyHDzOR:Vxaoal5dZU4dSqHns2SpSkjc
- TLSH T15AD38851A7F95218FAF73B746DB95AA00E7ABC9AFDB9C21D0240805E5D71A40CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
32:0b:a8:54:b2:f3:4a:7b:44:85:be:d3:e8:b2:d7:96:08:fc:d5:8d:f0:16:2b:4f:42:8f:f3:00:d4:6e:47:df
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 28, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ab:af:3a:c8:82:4e:48:55:5d:00:00:00:00:04:ab
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1b:d0:b2:b8:02:67:f7:72:cf:00:01:00:00:02:1b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb
Name
.rdata
Size
512B
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=35215,
count=1, id=258, version=35215,
msquic.dll
- IMPHASH 0241487334ff849fd689fc2458b87ed1
- SHA256 b2b7fd2dc05b0009acd3f0de7ba443c660c87b1308774a5811fdb8873a76de78
- MD5 6e4bc4179d1115e6f9535fa054da23cc
- SHA1 04ab429db626f3a8cde45c385222684e39f5ff2f
- SHA512 27ac6f7f920e6acec66d27bfa40dc071e58438e6c999c0b77a0ea9fb70263b449df7cd45766079d9c036d529dfed4d594c0638da3417ef1ff73f4bd3d5c36b43
- SSDEEP 6144:dDjTP1Ltlr+jHGOd0zWxV4pU9YYhRfh+KoD/a1rd7qfjf9Q96GnaIh1QeO01wVtm:dDXl7aKOqzUffgDy78i9la8Q+1Y
- TLSH T1B4B47C1227FC14A9F0B7C378C9278527FA72BC244724C65F6291926E1F63750AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:ed:83:e2:f3:3f:23:ac:95:8f:95:13:f3:b5:99:08:c3:65:22:c0:35:91:49:4c:cb:32:c2:f7:4b:d7:76:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f9:1f:67:8d:75:ab:a4:f1:b1:00:01:00:00:01:f9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
186480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\artifacts\bin\windows\x64_Release_schannel\msquic.pdb
winmm
timeGetDevCaps
secur32
SetCredentialsAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
QuerySecurityContextToken
FreeContextBuffer
InitializeSecurityContextW
kernel32
GetCurrentThreadId
SetEvent
ResetEvent
SetThreadPriority
GetLastError
CreateThread
SetThreadIdealProcessor
SetThreadGroupAffinity
HeapCreate
HeapFree
InterlockedPopEntrySList
MultiByteToWideChar
GetLogicalProcessorInformationEx
QueryPerformanceFrequency
HeapAlloc
InitializeSListHead
HeapDestroy
GlobalMemoryStatusEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
TlsFree
TlsSetValue
CloseHandle
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
IsDebuggerPresent
GetCurrentProcessId
LeaveCriticalSection
GetSystemTimeAdjustment
WaitForSingleObject
IsProcessorFeaturePresent
TerminateProcess
PostQueuedCompletionStatus
Sleep
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetCurrentProcess
SetUnhandledExceptionFilter
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EnterCriticalSection
GetCurrentProcessorNumberEx
LoadLibraryA
QueryDepthSList
GetProcAddress
FreeLibrary
CreateEventA
GetActiveProcessorGroupCount
InterlockedFlushSList
InterlockedPushEntrySList
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileCompletionNotificationModes
GetActiveProcessorCount
CancelIoEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsGetValue
InitializeSRWLock
CloseThreadpoolWait
InterlockedPushListSListEx
advapi32
EventUnregister
RegOpenKeyExA
RegQueryValueExA
EventWriteTransfer
RegCloseKey
RegNotifyChangeKeyValue
EventRegister
iphlpapi
GetIpNetEntry2
SetCurrentThreadCompartmentId
ConvertInterfaceLuidToAlias
GetIfTable2
FreeMibTable
ConvertInterfaceIndexToLuid
GetCurrentThreadCompartmentId
ResolveIpNetEntry2
GetAdaptersAddresses
GetBestRoute2
bcrypt
BCryptDecrypt
BCryptDestroyKey
BCryptEncrypt
BCryptGenRandom
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
ws2_32
htonl
GetAddrInfoW
FreeAddrInfoW
WSAGetLastError
setsockopt
getsockopt
WSARecv
htons
WSACleanup
bind
WSAIoctl
connect
closesocket
WSASend
shutdown
socket
getsockname
WSASocketW
WSAStartup
crypt32
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringA
CertAddCertificateLinkToStore
CertSaveStore
CertGetCertificateChain
sspicli
QueryContextAttributesExW
ntdll
RtlNtStatusToDosError
RtlInitUnicodeString
NtSetInformationThread
RtlIpv6AddressToStringExA
RtlIpv4AddressToStringExA
oleaut32
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SysAllocString
SafeArrayUnaccessData
VariantClear
SafeArrayAccessData
ole32
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
api-ms-win-crt-stdio-l1-1-0
fclose
fgets
__stdio_common_vfprintf
__acrt_iob_func
fopen
__stdio_common_vsnprintf_s
api-ms-win-crt-string-l1-1-0
wcsncmp
wcscmp
wcscat_s
_strnicmp
strnlen
strcmp
api-ms-win-crt-convert-l1-1-0
strtoul
mbstowcs_s
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
api-ms-win-crt-runtime-l1-1-0
abort
_initterm_e
_initialize_narrow_environment
_initterm
_seh_filter_dll
terminate
_configure_narrow_argv
_initialize_onexit_table
_execute_onexit_table
_cexit
MsQuicClose
MsQuicOpenVersion
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=33731,
count=11, id=260, version=33731,
count=31, id=261, version=33731,
count=32, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=30795,
count=208, id=1, productName=Unmarked objects,
count=2, id=260, version=30795,
count=56, id=269, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=2, id=151,
count=1, id=258, version=33811,
onnxruntime.dll
- IMPHASH 772561c21cca235ea8689d23907b16b1
- SHA256 3cffeff2d7c25b247a814212baab70eb1f37d727335d4c813ed73785df80a794
- MD5 b75ab78dc31b701a276470536ed903d5
- SHA1 b0a06990bccc7e14026156d9f280640e55109633
- SHA512 85a2727b4fd53573e722b9e9f0e8c3eb28bf06861732e09b511f52d512fa8cdd8bb85586d1e45cbd11915f1d142c6f7fb9bf612302447974da7652eaadaabe35
- SSDEEP 196608:/GjWZoDMJPIBP9spNnDREtHXkY8+MJy7ED9Z6:4wpNDU3My7ED9Z6
- TLSH T137277D2667C706A9D07AD278CAD78F13F772B419437237EB019000661F9B7E26E3B652
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:03:ae:53:5b:c7:bd:ae:04:56:fc:b3:ee:46:dd:1b:93:3d:7c:07:80:e0:de:40:19:33:46:98:f5:7d:6f:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 9, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
12:03:ae:53:5b:c7:bd:ae:04:56:fc:b3:ee:46:dd:1b:93:3d:7c:07:80:e0:de:40:19:33:46:98:f5:7d:6f:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 4, 2026
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 18, 2025 - Sep 8, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fe:fe:8a:48:b5:ce:c4:60:f1:00:00:00:00:01:fe
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Minor OS version
0
Major OS version
6
Entry point
13204336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\win-onnxruntime\build_x64_Release\Release\Release\onnxruntime.pdb
kernel32
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FormatMessageW
WideCharToMultiByte
FreeLibrary
CreateEventW
VirtualAlloc
VirtualFree
MultiByteToWideChar
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableA
CreateDirectoryA
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesA
GetFileAttributesW
GetFileSizeEx
GetFinalPathNameByHandleW
ReadFile
RemoveDirectoryW
SetFilePointerEx
ReleaseMutex
Sleep
GetCurrentProcess
GetCurrentThread
GetSystemInfo
GetLogicalProcessorInformationEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
SetThreadGroupAffinity
FormatMessageA
GetCurrentProcessorNumber
ReleaseSemaphore
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
GetLastError
CloseHandle
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
LoadLibraryA
OutputDebugStringW
DebugBreak
AcquireSRWLockShared
LocalFree
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceExecuteOnce
GetSystemTimePreciseAsFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
RtlCaptureStackBackTrace
GetLogicalProcessorInformation
IsDebuggerPresent
CreateFile2
GetMaximumProcessorGroupCount
GetMaximumProcessorCount
GetStdHandle
WriteFile
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
OutputDebugStringA
InitOnceBeginInitialize
LoadLibraryExW
InitOnceComplete
CreateFileW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCPInfo
CompareStringEx
GetFileAttributesExW
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetNativeSystemInfo
SwitchToThread
GetStringTypeW
WakeAllConditionVariable
GetFileInformationByHandleEx
advapi32
RegQueryValueExW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
CloseServiceHandle
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchRemoveBackslash
setupapi
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initterm_e
_cexit
_seh_filter_dll
_invoke_watson
_crt_atexit
abort
_exit
_beginthreadex
terminate
_errno
_invalid_parameter_noinfo
_set_doserrno
strerror_s
_configure_narrow_argv
_initterm
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
strerror
_set_errno
__doserrno
api-ms-win-crt-string-l1-1-0
strcspn
wcslen
tolower
strncmp
towlower
isalpha
isalnum
isupper
strcmp
isspace
_wcsdup
strnlen
islower
strncpy
isdigit
strcpy_s
strlen
_towlower_l
__strncnt
wcsnlen
_towupper_l
_stricmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_wfsopen
_fsopen
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vswprintf
_read
_wsopen_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf_s
_write
fseek
fgetwc
fputwc
__stdio_common_vsnprintf_s
_sopen_s
_close
ungetwc
api-ms-win-crt-heap-l1-1-0
realloc
free
calloc
_callnewh
_aligned_malloc
malloc
_aligned_free
api-ms-win-crt-math-l1-1-0
cosf
_dsign
fmax
ldexp
coshf
tanhf
log10
nearbyint
rint
nearbyintf
round
scalbnf
floor
scalbn
_dclass
_ldclass
ceilf
llroundl
ilogb
_ldsign
tanf
sinhf
atanf
log2
ceil
floorf
sqrt
_fdclass
asinf
sqrtf
cos
sinf
powf
pow
sin
log
roundf
remainderf
rintf
_fdsign
log1pf
exp
expf
logf
tanh
acoshf
asinhf
atanhf
fmodf
frexp
fmod
acosf
ilogbf
api-ms-win-crt-locale-l1-1-0
_lock_locales
_free_locale
setlocale
__pctype_func
localeconv
_unlock_locales
___lc_collate_cp_func
_create_locale
___mb_cur_max_func
___lc_locale_name_func
___lc_codepage_func
api-ms-win-crt-convert-l1-1-0
atoi
strtol
strtod
strtoull
strtoll
atol
wcstoul
strtof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
remove
_unlock_file
_fstat64i32
api-ms-win-crt-time-l1-1-0
_W_Getmonths
_Gettnames
_Strftime
_Getdays
_difftime64
_W_Getdays
_mktime64
_W_Gettnames
_Wcsftime
wcsftime
_localtime64_s
_gmtime64_s
_Getmonths
dbghelp
SymFromAddr
ImageDirectoryEntryToData
OrtGetApiBase
OrtSessionOptionsAppendExecutionProviderEx_DML
OrtSessionOptionsAppendExecutionProvider_CPU
OrtSessionOptionsAppendExecutionProvider_DML
Name
.text
Size
12.9MB
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.3MB
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
528KB
Virtual Size
553KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
388KB
Virtual Size
388KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=33145,
count=10, id=260, version=35207,
count=34, id=259, version=35207,
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=33145,
count=3, id=260, version=33145,
count=107, id=261, version=35207,
count=364, id=1, productName=Unmarked objects,
count=15, id=260, version=35226,
count=37, id=259, version=35226,
count=790, id=261, version=35226,
count=1, id=256, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,
resources.pri
- SHA256 f23e8c44a068c7ce5a43bbbf972fab5303d8ecb8cf1fbe9859b6b0311d0f86e6
- MD5 6040fa8ce77286091ff35a161851914c
- SHA1 00ea728c38168291040fcefa31361f7c558d7846
- SHA512 0b5849b9333e6d56d379dfa4cf5574086afe011a2480a949cbd5b47697b8c8c6b4ac00009216a9c6c932be957b7a071daa6aa65c24cddf86e454d0f17169543c
- SSDEEP 192:WsGwTzdRmMAPVdwcVNdxYI8CU3cqB5oe+g:UOwgi4cWD
- TLSH T148F19D737F25EF06E1366F3B82D743612A347A46EB63950A15F8812408A0EB0ED75B69
- MD5 SHA1 SHA512 SSDEEP TLSH