bd7f7bc085d41855f601e0c2f3b47c8a26cf86689dd261d659c9c6f660fd1002

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2050-Jul-19 05:30:49
Debug artifacts D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb
CompanyName Microsoft Corporation
FileDescription Store Installer
FileVersion 22608.817.2.0
InternalName StoreInstaller.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename StoreInstaller.exe
ProductName Store Installer
ProductVersion 22608.0817.02.0+11f729f9388beedd36e09d30a4d48b7eb5a61760
Assembly Version 22608.817.2.0

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
 Contains domain names:
  • apps.microsoft.com
  • bat.bing.com
  • displaycatalog.mp.microsoft.com
  • dsx.mp.microsoft.com
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/expression/blend/2008
  • http://schemas.microsoft.com/netfx/2009/xaml/presentation
  • http://schemas.microsoft.com/winfx/2006/xaml
  • http://schemas.microsoft.com/winfx/2006/xaml/presentation
  • http://schemas.openxmlformats.org
  • http://schemas.openxmlformats.org/markup-compatibility/2006
  • https://apps.microsoft.com
  • https://apps.microsoft.com/?client
  • https://apps.microsoft.com/store/detail/
  • https://bat.bing.com
  • https://bat.bing.com/action/0?ti
  • https://displaycatalog.mp.microsoft.com
  • https://displaycatalog.mp.microsoft.com/v7.0/ratings?market
  • https://sfdataservice.microsoft.com
  • https://sfdataservice.microsoft.com/package-retrieval/Packages
  • https://sfdataservice.microsoft.com/package-retrieval/Packages?productId
  • https://storeedge.microsoft.com
  • https://storeedge.microsoft.com/v9.0/pages/home?market
  • https://storesdk.dsx.mp.microsoft.com
  • https://storesdk.dsx.mp.microsoft.com/v8.0/Sdk/products/contentId?market
  • microsoft.com
  • mp.microsoft.com
  • openxmlformats.org
  • schemas.microsoft.com
  • schemas.openxmlformats.org
  • sfdataservice.microsoft.com
  • storeedge.microsoft.com
  • storesdk.dsx.mp.microsoft.com
Info The PE is digitally signed. Signer: Microsoft Corporation
Issuer: Microsoft Marketplace CA G 024
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 3465f5266c2dff80b7e1da5da2a465b7 🔍
SHA1 6f19e301b232c5e8dce0bdcb21faa7c827a28df8 🔍
SHA256 bd7f7bc085d41855f601e0c2f3b47c8a26cf86689dd261d659c9c6f660fd1002 🔍
SHA3 d2197ee6aef7858a46ad9235c7f1f72e7330f75f532c45be993efdcb698ae4e7 🔍
SSDeep 12288:hDVL+7JSjDPQ9khNcp3IjE/Y5C9+Xy34lYhOsfzGP3X:+7WIAcpYjgY492y3wMO06P3X 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2050-Jul-19 05:30:49
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0xb1200
SizeOfInitializedData 0xea00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000B3162 (Section: .text)
BaseOfCode 0x2000
BaseOfData 0xb4000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xc6000
SizeOfHeaders 0x200
Checksum 0xc6824
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a730e25020adf1e419c0f5d031d82353 🔍
SHA1 910e2fd626444610bd001910f8a2a6627e65173d 🔍
SHA256 3dbcd1c3550e5ca29de0e829e3f63d28549bf1d86f2d1e07dbd58f398f3896a0 🔍
SHA3 aecea603706cc820c0edca78bf3753318d76d92cc16708ee19bae4c137049978 🔍
VirtualSize 0xb1188
VirtualAddress 0x2000
SizeOfRawData 0xb1200
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.80522

.rsrc

MD5 5c10ad97346933fe3a083636d6bf1fc9 🔍
SHA1 6061cecbef042c446764ccdbe88ab36a091b210f 🔍
SHA256 7b7933f1fba429d3b8abfcaabbb376bcc94221ad74e182b034023a25f2e52458 🔍
SHA3 fe0b6e0aeb3212cc6c1cfc2c7692cbf368644af97450d56476e927336e988b0e 🔍
VirtualSize 0xe728
VirtualAddress 0xb4000
SizeOfRawData 0xe800
PointerToRawData 0xb1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 7.92172

.reloc

MD5 0073395714a485e0a1f92dfd49491c9c 🔍
SHA1 18c897b1f355aafc7f76f4bcb2a4fe69e0764bad 🔍
SHA256 c314368d241f0c40eb3f8aae6ccfb8fb10f76c7528906ef32ffcc00295de322d 🔍
SHA3 7a27fcf8841e281528d72fb5bf1c0d45f9c59d377714b683f49b93b90ee8ca5b 🔍
VirtualSize 0xc
VirtualAddress 0xc4000
SizeOfRawData 0x200
PointerToRawData 0xbfc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xa8be
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.98622
Detected Filetype PNG graphic file
MD5 e1920b2d2c32e5fd9de1996223af1b86 🔍
SHA1 c2ff30c0335162ec41ce79041317a67580a2227b 🔍
SHA256 b3c2a1444d2e675822bedde154c84496c7aac4bd09111ca27db724f03dce32ce 🔍
SHA3 00e9e4f4adef554f2ddd92ca1db75de2de64c6451a248103371e1430bd3c846b 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x1110
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92954
Detected Filetype PNG graphic file
MD5 da8e3e80c3aeaeb40dfb975721c7e5f1 🔍
SHA1 8e5816f9b64d1c06503fc19cad937f757d60b8b3 🔍
SHA256 35132f70b7efed596bfceb50ba22bc9818755562ad01757a70906047575ac629 🔍
SHA3 fe81cc3f91968b6228b021eccb44230a39c2ebc069692289e0f43d029c480cc6 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0xb1d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.87134
Detected Filetype PNG graphic file
MD5 f1462b94ae6ecee09348ebf67c9abc2d 🔍
SHA1 2b668ba76d02532900aecc7279e1c4d793417323 🔍
SHA256 f16fc0e4d4c0cc2a229ed3ef56d76307ee6eed8beb91b4200f5a45f535e6b75f 🔍
SHA3 ac1fca33d3f4974f603c4ec15eaa593a74ea6e697784a9788da17809eec555f8 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x8a6
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.83827
Detected Filetype PNG graphic file
MD5 7c74cc4f7aa204d18d173d8eb13df1ef 🔍
SHA1 4df08ea8d55d7905fd345a8aa43f6b4643155327 🔍
SHA256 cc5302c98d91a1adabd26b366025e724326b62885d3ecc498383f9d47b37821e 🔍
SHA3 7314786a7a7366bd16ecff7ecfbc12502f13128237897f0113e69ba5f37e3033 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x604
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.7652
Detected Filetype PNG graphic file
MD5 52f19b6a6037ecfe89165f6d1db58293 🔍
SHA1 3419496554326cf45450eadb63fee7d3fe346eeb 🔍
SHA256 e00b2e694d6f130866723df09075eeebb64c7643dc2f9fac888eb4eddb0e83ad 🔍
SHA3 61d6500c416a0255ceb1ad4f53e7cd4b4f891304cb2ccc6da3337c1d56aef285 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x41d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.62317
Detected Filetype PNG graphic file
MD5 02230dc49d5acdc7272b03d67b58a262 🔍
SHA1 02b7461bfe9af73fd04f62a4090d9615fdc40f93 🔍
SHA256 bef4e63981b44a29694ad23e6535f6924ba33ae6ddd4923cbaec6f04507be0a9 🔍
SHA3 572160b6c85d7c807f88b8453cd63459f1636ee89b9787ac1051d6c5bd3d990a 🔍

7

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x338
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.6268
Detected Filetype PNG graphic file
MD5 e630a12af57b2182dfd1702a89b37119 🔍
SHA1 4bb2221effaef02339d6c3c21aa69950f0c4d5b8 🔍
SHA256 68009bc47c108c92ff6b1f709ddba349bf787870b4a5e44f0fe40fec616288f7 🔍
SHA3 56b07a570a77eb66bf47fcc8336930d2240046094f7e16b2d4ef60cd42de24e1 🔍

8

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.4057
Detected Filetype PNG graphic file
MD5 e9469e7ee9736b85222533448e06624d 🔍
SHA1 3a608c306d778a322f74d165d04bddef7c82cc78 🔍
SHA256 3446a65994584932fff8ca47afe9d78e85a34384f7e758cb68ed50dfe2511f27 🔍
SHA3 9782b7f3cf21541d4cb0b5e42e5ec4654b0852f2c7c8d39ec1984175ae7e776e 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9177
Detected Filetype Icon file
MD5 2153ee5e6942dd2478c68c9966f15ab7 🔍
SHA1 562a9df2a878487928dcc464d6c30b3532d741d9 🔍
SHA256 a1c9128cb07351f7ad154ce70d01ec05d5bc1f427157116e118295f3951ab077 🔍
SHA3 d6bee9f6fd2087030ab77e6ec8c7d597f80c0177bb061257ff723a88a5e0e147 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x3e0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.47586
MD5 6f1c6274732df850d8e1ddb27f21d124 🔍
SHA1 de5903b3ec3a911d48dfb0fc2e2e80dcccb2ac46 🔍
SHA256 d7eeb9a7d4cccae4dbbcca3694f9cb97a5a47d86e69ee4bc029f1521d7a4d3a3 🔍
SHA3 f29d904635a6c74c17353461e366f001ada2e19910eeb66c50f4c9abc968339d 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x2fa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.27243
MD5 b60ae02ef2f22d7edd5c14f4d6f91ec6 🔍
SHA1 47508833f43f4abb2152c2361af06f010e4d4b1d 🔍
SHA256 eb9c33360d0f85d35d0bf5b7114c76766836ba50e3067cdb25ae43c39a183489 🔍
SHA3 094996d8aec3c6641357b9cbd83762c73bdfce0b8dda9c0a7ecd0332423c6541 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 22608.817.2.0
ProductVersion 22608.817.2.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Microsoft Corporation
FileDescription Store Installer
FileVersion (#2) 22608.817.2.0
InternalName StoreInstaller.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename StoreInstaller.exe
ProductName Store Installer
ProductVersion (#2) 22608.0817.02.0+11f729f9388beedd36e09d30a4d48b7eb5a61760
Assembly Version 22608.817.2.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2091-Jul-16 10:42:39
Version 256.20557
SizeofData 96
AddressOfRawData 0xb3088
PointerToRawData 0xb1288
Referenced File D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 1.0
SizeofData 39
AddressOfRawData 0xb30e8
PointerToRawData 0xb12e8

UNKNOWN (#2)

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.