2026-11-03_5dc8a209364c7a23ba836186905d4dc4_amadey_elex_hellokitty_icedid_luca-stealer_njrat_vidar

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource
2026-11-03_5dc8a209364c7a23ba836186905d4dc4_amadey_elex_hellokitty_icedid_luca-stealer_njrat_vidar

resource	yara_rule
sample	costura

resource
unpack001/costura.dll

resource
2026-11-03_5dc8a209364c7a23ba836186905d4dc4_amadey_elex_hellokitty_icedid_luca-stealer_njrat_vidar

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7e46769e950de89b77f50dfb0e494acad527207f159f7d2643d5929120b10b3c
MD5 5dc8a209364c7a23ba836186905d4dc4
SHA1 9b0a865eaf5f161c220e8181a36b09c053aab1e3
SHA512 8c31cf9f517323be2b7905e0e7d7e0d5bea428ebdb847a71cb999d4c940bb333be518f94487bc757b7c443ad23ce23d5162be118cbbb879ee04e94601840d468
SSDEEP 98304:3S2Xa2miBwcu3ZF62Zz23QUFTKzEKBGqF:TVBkHBZS3Q0TKzDBG8
TLSH
T1DA260255F19878E1C4264D70D4B8A9B11A3AFB7799AC894B667431180E31FC3F93EE0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

16:ff:98:6d:b8:bc:f4:f8:29:66:51:af:1b:6d:5d:e0:64:36:b5:8f:1b:91:75:9b:76:8e:5f:92:aa:e9:4e:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91210103MA7CJ3C094,CN=NaisNet Technology Co.\, Ltd.,O=NaisNet Technology Co.\, Ltd.,L=Shenyang,ST=Liaoning,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e79616e67,1.3.6.1.4.1.311.60.2.1.2=#13084c69616f6e696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 16, 2026

SERIALNUMBER=91210103MA7CJ3C094,CN=NaisNet Technology Co.\, Ltd.,O=NaisNet Technology Co.\, Ltd.,L=Shenyang,ST=Liaoning,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e79616e67,1.3.6.1.4.1.311.60.2.1.2=#13084c69616f6e696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

SERIALNUMBER=91210103MA7CJ3C094,CN=NaisNet Technology Co.\, Ltd.,O=NaisNet Technology Co.\, Ltd.,L=Shenyang,ST=Liaoning,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085368656e79616e67,1.3.6.1.4.1.311.60.2.1.2=#13084c69616f6e696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

64:f3:a4:a8:69:44:eb:47:ef:45:7a:99:75:c6:1f:5c

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 15, 2026

Timespan

Apr 14, 2026 - Apr 14, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

0

Major OS version

4

Entry point

4007166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\weiwancheng\wangzhan\wangzhan\native-downloader\obj\Release\shell-template.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.web.webview2.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5e172b4f558723b7dbb7f568f301077c84d6571436fbe5a5f45bfa621c020403
MD5 9f9feedb05b87e1be1c7ab710655d0e8
SHA1 2886a398d065e13f667b974180589baff890d2b3
SHA512 397be2264710120f1f6c419fc7e6a95915eabd0b0586461fadf7335d3b3e0bc35ebca96acf5cb4002a46f6aef90c0238564519c47c7c62c995b1d7469158b287
SSDEEP 12288:qDrB322zh+iKsRFN/eA+imQ269pRFZNIEJdIEY0lxPrEIgcvLcglxMwCepM1SwU1:Zj
TLSH
T17DB46F1223FD462AF6F72FB5657416248AF6FCC6BD79E34D4598212D0D72B818AA0333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fb:42:ad:e5:78:ee:a0:6d:20:8d:33:a4:c6:0b:0a:5d:f8:13:cd:39:29:a1:c6:1f:01:eb:4d:57:be:0f:c7:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 4, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

531898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb

microsoft.web.webview2.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bef507a4ce7b6a848993bc504af7e2273cec22e77469787cb1d47d3f362164ed
MD5 d15bfc4c7cccc1e99466a1866ffc473d
SHA1 a4a6ce5968d346ca1da16bf9195eef8cdb07f570
SHA512 28461110891a9ba7af40df3de46d0937a52bdfcc4dbd88448672d7d34e2a4b4f68a5ba464051a5523ad172862d62caa8bccc2e780615722ce37ef1982a028f3b
SSDEEP 768:9FCniwqfU2Gm0bOVmW0etGjyf8ZDgcEST3p4Jjrjh2jJGSUyauTv1JKia5/Zi/WC:9Ijyf8ZDgcEST3p4JjrjaJGSUyau71JX
TLSH
T15A033A4142AC853BE6EF9FFC94B486631B7ABF837A61D3882D85B0E91D73390451076B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

58:7c:2f:80:ae:51:d1:8e:54:2f:76:03:90:e4:b6:7a:63:38:69:6a:42:28:21:69:af:a3:ec:9d:13:3d:bc:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 4, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

35578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.WinForms.pdb

microsoft.web.webview2.wpf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf8fd64fe7afbcf7646631baa160c3a6d85b8a51777e52fb471f0230950de754
MD5 2b4a31daa2e0af6a5fd7df0252cb3cab
SHA1 6d30ed7787bbf1e464050cce5169b978734dcb2c
SHA512 5fe91444803cae9cab98f5405eda3aacc6b677e57bd51cb82d5ea6e7712f5a7ffd133b8afbf7074215446938deb601bb10b0b97b43f72d187f2cd215deacfcde
SSDEEP 768:eV08pvSZjQIf1jlCPcePUO9w8aDP/ryEH0tBy4JjrD1h2j5hUURGvkq7FKKa5/Bw:t84jQW1jlOzP7w8aDP/ryEH0tBy4Jjrz
TLSH
T15F233AC047EE8527E5EE1FB870B091551B79BF43BA21F79917C0B1A90A373A089543EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

65:66:e6:39:6a:7b:a6:62:07:1e:c8:bd:e1:ee:f7:c6:c1:dd:f8:96:36:59:7a:89:bd:ab:1e:dc:cb:a0:5b:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 4, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

43154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.Wpf.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
TLSH
T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb