https://logit.io/docs/_next/static/chunks/pages/ecs-field-reference/1.12/dll-1c5a9c3741dce989.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[96399],{18434:function(e,d,n){(window.__NEXT_P=window.__NEXT_P||[]).push(["/ecs-field-reference/1.12/dll",function(){return n(64715)}])},64715:function(e,d,n){"use strict";n.r(d),n.d(d,{__toc:function(){return c}});var s=n(85893),r=n(31379),i=n(9575),l=n(67904),t=n(34908);let c=[{depth:2,value:"Fields",id:"fields"},{depth:3,value:"Field Summary",id:"field-summary"},{depth:2,value:"Field Details",id:"field-details"},{depth:3,value:"dll.code_signature.digest_algorithm",id:"dllcode_signaturedigest_algorithm"},{depth:3,value:"dll.code_signature.exists",id:"dllcode_signatureexists"},{depth:3,value:"dll.code_signature.signing_id",id:"dllcode_signaturesigning_id"},{depth:3,value:"dll.code_signature.status",id:"dllcode_signaturestatus"},{depth:3,value:"dll.code_signature.subject_name",id:"dllcode_signaturesubject_name"},{depth:3,value:"dll.code_signature.team_id",id:"dllcode_signatureteam_id"},{depth:3,value:"dll.code_signature.timestamp",id:"dllcode_signaturetimestamp"}

1,{depth:3,value:"dll.code_signature.trusted",id:"dllcode_signaturetrusted"},{depth:3,value:"dll.code_signature.valid",id:"dllcode_signaturevalid"},{depth:3,value:"dll.hash.md5",id:"dllhashmd5"},{depth:3,value:"dll.hash.sha1",id:"dllhashsha1"},{depth:3,value:"dll.hash.sha256",id:"dllhashsha256"},{depth:3,value:"dll.hash.sha512",id:"dllhashsha512"},{depth:3,value:"dll.hash.ssdeep",id:"dllhashssdeep"},{depth:3,value:"dll.name",id:"dllname"},{depth:3,value:"dll.path",id:"dllpath"},{depth:3,value:"dll.pe.architecture",id:"dllpearchitecture"},{depth:3,value:"dll.pe.company",id:"dllpecompany"},{depth:3,value:"dll.pe.description",id:"dllpedescription"},{depth:3,value:"dll.pe.file_version",id:"dllpefile_version"},{depth:3,value:"dll.pe.imphash",id:"dllpeimphash"},{depth:3,value:"dll.pe.original_file_name",id:"dllpeoriginal_file_name"},{depth:3,value:"dll.pe.product",id:"dllpeproduct"}];function h(e){let d=Object.assign({h1:"h1",blockquote:"blockquote",p:"p",h2:"h2",h3:"h3",table:"table",thead:"thead",tr:"tr",th:"th",tbody:"tbody",td:"td",a:"a",code:"code",strong:"strong"},(0,i.a)(),e.components);return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.Z,{structuredData:[{"@context":"https://schema.org","@type":"TechArticle",headline:"DLL Fields (23 fields) | Logit.io ECS DLL Field Set Reference",description:"Complete reference for dll fields in Logit.io ECS Schema (Elastic Common Schema). Includes 23 fields (3 core, 20 extended). These fields contain informa...",author:{"@type":"Organization",name:"Logit.io",url:"https://logit.io"},publisher:{"@type":"Organization",name:"Logit.io",logo:{"@type":"ImageObject",url:"https://logit.io/docs/logit-icon-125x125.png"}},datePublished:"2026-09-08T13:39:53.432Z",dateModified:"2026-09-08T13:39:53.432Z",mainEntityOfPage:{"@type":"WebPage","@id":"https://logit.io/docs/ecs-field-reference/dll"},about:{"@type":"Thing",name:"Elastic Common Schema (ECS)",description:"Open-source specification for field names and data types"}}],breadcrumbData:{"@context":"https://schema.org","@type":"BreadcrumbList",itemListElement:[{"@type":"ListItem",position:1,name:"Documentation",item:"https://logit.io/docs/"},{"@type":"ListItem",position:2,name:"ECS Field Reference",item:"https://logit.io/docs/ecs-field-reference/"},{"@type":"ListItem",position:3,name:"DLL",item:"https://logit.io/docs/ecs-field-reference/1.12/dll"}]},productVersion:"1.12",productName:"Logit.io ECS Schema",websiteArea:"documentation",isLatestVersion:!1}),"\n",(0,s.jsx)(l.Z,{id:"version-selector-dll",versions:["9.0","8.17","1.12"],currentVersion:"1.12",fieldSetName:"dll",isLatest:!1}),"\n",(0,s.jsx)(d.h1,{children:"DLL"}),"\n",(0,s.jsxs)(d.blockquote,{children:["\n",(0,s.jsx)(d.p,{children:"These fields contain information about code libraries dynamically loaded into processes."}),"\n"]}),"\n",(0,s.jsx)(d.h2,{id:"fields",children:"Fields"}),"\n",(0,s.jsx)(d.h3,{id:"field-summary",children:"Field Summary"}),"\n",(0,s.jsxs)(d.table,{children:[(0,s.jsx)(d.thead,{children:(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.th,{children:"Field"}),(0,s.jsx)(d.th,{children:"Type"}),(0,s.jsx)(d.th,{children:"Level"}),(0,s.jsx)(d.th,{children:"Description"})]})}),(0,s.jsxs)(d.tbody,{children:[(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-digest-algorithm",children:(0,s.jsx)(d.code,{children:"dll.code_signature.digest_algorithm"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Hashing algorithm used to sign the process."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-exists",children:(0,s.jsx)(d.code,{children:"dll.code_signature.exists"})})}),(0,s.jsx)(d.td,{children:"boolean"}),(0,s.jsx)(d.td,{children:(0,s.jsx)(d.strong,{children:"Core"})}),(0,s.jsx)(d.td,{children:"Boolean to capture if a signature is present."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-signing-id",children:(0,s.jsx)(d.code,{children:"dll.code_signature.signing_id"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"The identifier used to sign the process."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-status",children:(0,s.jsx)(d.code,{children:"dll.code_signature.status"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Additional information about the certificate status."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-subject-name",children:(0,s.jsx)(d.code,{children:"dll.code_signature.subject_name"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:(0,s.jsx)(d.strong,{children:"Core"})}),(0,s.jsx)(d.td,{children:"Subject name of the code signer"})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-team-id",children:(0,s.jsx)(d.code,{children:"dll.code_signature.team_id"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"The team identifier used to sign the process."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-timestamp",children:(0,s.jsx)(d.code,{children:"dll.code_signature.timestamp"})})}),(0,s.jsx)(d.td,{children:"date"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"When the signature was generated and signed."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-trusted",children:(0,s.jsx)(d.code,{children:"dll.code_signature.trusted"})})}),(0,s.jsx)(d.td,{children:"boolean"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Stores the trust status of the certificate chain."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-code-signature-valid",children:(0,s.jsx)(d.code,{children:"dll.code_signature.valid"})})}),(0,s.jsx)(d.td,{children:"boolean"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Boolean to capture if the digital signature is verified against the binary content."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-hash-md5",children:(0,s.jsx)(d.code,{children:"dll.hash.md5"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"MD5 hash."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-hash-sha1",children:(0,s.jsx)(d.code,{children:"dll.hash.sha1"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"SHA1 hash."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-hash-sha256",children:(0,s.jsx)(d.code,{children:"dll.hash.sha256"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"SHA256 hash."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-hash-sha512",children:(0,s.jsx)(d.code,{children:"dll.hash.sha512"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"SHA512 hash."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-hash-ssdeep",children:(0,s.jsx)(d.code,{children:"dll.hash.ssdeep"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"SSDEEP hash."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-name",children:(0,s.jsx)(d.code,{children:"dll.name"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:(0,s.jsx)(d.strong,{children:"Core"})}),(0,s.jsx)(d.td,{children:"Name of the library."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-path",children:(0,s.jsx)(d.code,{children:"dll.path"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Full file path of the library."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-architecture",children:(0,s.jsx)(d.code,{children:"dll.pe.architecture"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"CPU architecture target for the file."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-company",children:(0,s.jsx)(d.code,{children:"dll.pe.company"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}

1),(0,s.jsx)(d.td,{children:"Internal company name of the file, provided at compile-time."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-description",children:(0,s.jsx)(d.code,{children:"dll.pe.description"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Internal description of the file, provided at compile-time."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-file-version",children:(0,s.jsx)(d.code,{children:"dll.pe.file_version"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Process name."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-imphash",children:(0,s.jsx)(d.code,{children:"dll.pe.imphash"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"A hash of the imports in a PE file."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-original-file-name",children:(0,s.jsx)(d.code,{children:"dll.pe.original_file_name"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Internal name of the file, provided at compile-time."})]}),(0,s.jsxs)(d.tr,{children:[(0,s.jsx)(d.td,{children:(0,s.jsx)(d.a,{href:"#dll-pe-product",children:(0,s.jsx)(d.code,{children:"dll.pe.product"})})}),(0,s.jsx)(d.td,{children:"keyword"}),(0,s.jsx)(d.td,{children:"Extended"}),(0,s.jsx)(d.td,{children:"Internal product name of the file, provided at compile-time."})]})]})]}),"\n",(0,s.jsx)(d.h2,{id:"field-details",children:"Field Details"}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-digest-algorithm","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturedigest_algorithm",children:(0,s.jsx)(d.code,{children:"dll.code_signature.digest_algorithm"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Hashing algorithm used to sign the process."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"sha256"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-exists","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signatureexists",children:(0,s.jsx)(d.code,{children:"dll.code_signature.exists"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"boolean"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," ",(0,s.jsx)(d.strong,{children:"Core"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Boolean to capture if a signature is present."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"true"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-signing-id","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturesigning_id",children:(0,s.jsx)(d.code,{children:"dll.code_signature.signing_id"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," The identifier used to sign the process."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"com.apple.xpc.proxy"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-status","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturestatus",children:(0,s.jsx)(d.code,{children:"dll.code_signature.status"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Additional information about the certificate status."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"ERROR_UNTRUSTED_ROOT"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-subject-name","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturesubject_name",children:(0,s.jsx)(d.code,{children:"dll.code_signature.subject_name"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," ",(0,s.jsx)(d.strong,{children:"Core"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Subject name of the code signer"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"Microsoft Corporation"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-team-id","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signatureteam_id",children:(0,s.jsx)(d.code,{children:"dll.code_signature.team_id"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," The team identifier used to sign the process."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"EQHXZ8M8AV"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-timestamp","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturetimestamp",children:(0,s.jsx)(d.code,{children:"dll.code_signature.timestamp"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"date"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," When the signature was generated and signed."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"2021-01-01T12:10:30Z"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-trusted","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturetrusted",children:(0,s.jsx)(d.code,{children:"dll.code_signature.trusted"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"boolean"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Stores the trust status of the certificate chain."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"true"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-code-signature-valid","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllcode_signaturevalid",children:(0,s.jsx)(d.code,{children:"dll.code_signature.valid"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"boolean"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Boolean to capture if the digital signature is verified against the binary content."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"true"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-hash-md5","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllhashmd5",children:(0,s.jsx)(d.code,{children:"dll.hash.md5"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," MD5 hash."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-hash-sha1","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllhashsha1",children:(0,s.jsx)(d.code,{children:"dll.hash.sha1"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," SHA1 hash."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-hash-sha256","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllhashsha256",children:(0,s.jsx)(d.code,{children:"dll.hash.sha256"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," SHA256 hash."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-hash-sha512","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllhashsha512",children:(0,s.jsx)(d.code,{children:"dll.hash.sha512"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," SHA512 hash."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-hash-ssdeep","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllhashssdeep",children:(0,s.jsx)(d.code,{children:"dll.hash.ssdeep"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," SSDEEP hash."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-name","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllname",children:(0,s.jsx)(d.code,{children:"dll.name"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," ",(0,s.jsx)(d.strong,{children:"Core"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Name of the library."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"kernel32.dll"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-path","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpath",children:(0,s.jsx)(d.code,{children:"dll.path"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Full file path of the library."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"C:\\Windows\\System32\\kernel32.dll"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-architecture","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpearchitecture",children:(0,s.jsx)(d.code,{children:"dll.pe.architecture"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," CPU architecture target for the file."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"x64"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-company","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpecompany",children:(0,s.jsx)(d.code,{children:"dll.pe.company"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"}

1)," Internal company name of the file, provided at compile-time."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"Microsoft Corporation"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-description","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpedescription",children:(0,s.jsx)(d.code,{children:"dll.pe.description"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Internal description of the file, provided at compile-time."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"Paint"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-file-version","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpefile_version",children:(0,s.jsx)(d.code,{children:"dll.pe.file_version"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Process name."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"6.3.9600.17415"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-imphash","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpeimphash",children:(0,s.jsx)(d.code,{children:"dll.pe.imphash"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," A hash of the imports in a PE file."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"0c6803c4e922103c4dca5963aad36ddf"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-original-file-name","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpeoriginal_file_name",children:(0,s.jsx)(d.code,{children:"dll.pe.original_file_name"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Internal name of the file, provided at compile-time."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"MSPAINT.EXE"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]}),"\n",(0,s.jsx)("a",{id:"dll-pe-product","aria-hidden":"true"}),"\n",(0,s.jsx)(d.h3,{id:"dllpeproduct",children:(0,s.jsx)(d.code,{children:"dll.pe.product"})}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Type:"})," ",(0,s.jsx)(d.code,{children:"keyword"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Level:"})," Extended"]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Description:"})," Internal product name of the file, provided at compile-time."]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Example:"})," ",(0,s.jsx)(d.code,{children:"Microsoft\xae Windows\xae Operating System"})]}),"\n",(0,s.jsxs)(d.p,{children:[(0,s.jsx)(d.strong,{children:"Indexed:"})," true"]})]})}d.default=(0,r.j)({MDXContent:function(e={}){let{wrapper:d}=Object.assign({},(0,i.a)(),e.components);return d?(0,s.jsx)(d,{...e,children:(0,s.jsx)(h,{...e})}):h(e)},pageOpts:{filePath:"src/pages/ecs-field-reference/1.12/dll.mdx",route:"/ecs-field-reference/1.12/dll",frontMatter:{metaTitle:"DLL Fields (23 fields) | Logit.io ECS DLL Field Set Reference",description:"Complete reference for dll fields in Logit.io ECS Schema (Elastic Common Schema). Includes 23 fields (3 core, 20 extended). These fields contain informa...",productVersion:"1.12",productName:"Logit.io ECS Schema"},title:"DLL",headings:c},pageNextRoute:"/ecs-field-reference/1.12/dll"})},34908:function(e,d,n){"use strict";n.d(d,{Z:function(){return r}});var s=n(67294);function r({structuredData:e=[],breadcrumbData:d,productVersion:n,productName:r,websiteArea:i,isLatestVersion:l=!0}){return(0,s.useEffect)(()=>{let s=document.head;if(Array.from(s.querySelectorAll('script[id^="ecs-structured-data-"]')).forEac

1h(e=>e.remove()),e.forEach((e,d)=>{let n=`ecs-structured-data-${d}`,r=document.createElement("script");r.id=n,r.type="application/ld+json",r.textContent=JSON.stringify(e),s.appendChild(r)}),d){let e="ecs-breadcrumb-data",n=document.getElementById(e);n&&n.remove();let r=document.createElement("script");r.id=e,r.type="application/ld+json",r.textContent=JSON.stringify(d),s.appendChild(r)}["product_version","product_name","website_area"].forEach(e=>{let d=document.getElementById(`ecs-meta-${e}`);d&&d.remove()});let l=(e,d,n=!1)=>{let r=`ecs-meta-${e}`,i=document.createElement("meta");i.id=r,n?i.setAttribute("property",e):i.setAttribute("name",e),i.setAttribute("content",d),s.appendChild(i)};return n&&l("product_version",n),r&&l("product_name",r),i&&l("website_area",i),()=>{Array.from(s.querySelectorAll('script[id^="ecs-structured-data-"]')).forEach(e=>e.remove());let e=document.getElementById("ecs-breadcrumb-data");e&&e.remove(),["product_version","product_name","website_area"].forEach(e=>{let d=document.getElementById(`ecs-meta-${e}`);d&&d.remove()})}},[e,d,n,r,i,l]),null}},67904:function(e,d,n){"use strict";n.d(d,{Z:function(){return o}});var s=n(85893),r=n(67294),i=n(11163),l=n(41664),t=n.n(l),c=n(94364),h=n.n(c);function o({id:e,versions:d,currentVersion:n,fieldSetName:l=null,isLatest:c=!1}){let o=(0,i.useRouter)();(0,r.useEffect)(()=>{let d=document.getElementById(e);if(d){let e=e=>{let d=e.target;o.push(d.value)};return d.addEventListener("change",e),()=>{d.removeEventListener("change",e)}}},[e,o]);let a="/ecs-field-reference",x=d[0],j=l?`${a}/${l}`:`${a}/`;return(0,s.jsxs)(s.Fragment,{children:[!c&&(0,s.jsxs)("div",{className:h().alertBanner,children:[(0,s.jsx)("strong",{children:"⚠️ Outdated Version:"})," You are viewing ECS version"," ",n,", which is outdated."," ",(0,s.jsxs)(t(),{href:j,className:h().alertLink,children:["View the latest version (",x,")"]})]}),(0,s.jsxs)("div",{className:h().selectorContainer,children:[(0,s.jsx)("strong",{className:h().selectorLabel,children:"ECS Version:"})," ",(0,s.jsx)("select",{id:e,defaultValue:c?l?`${a}/${l}`:`${a}/`:l?`${a}/${n}/${l}`:`${a}/${n}/`,className:h().selectElement,children:d.map((e,d)=>{let n=0===d,r=n?l?`${a}/${l}`:`${a}/`:l?`${a}/${e}/${l}`:`${a}/${e}/`,i=n?`${e} (Latest)`:e;return(0,s.jsx)("option",{value:r,children:i},e)})})]})]})}},94364:function(e){e.exports={alertBanner:"ecs-version-selector_alertBanner__LPiH_",alertLink:"ecs-version-selector_alertLink__wQ26d",selectorContainer:"ecs-version-selector_selectorContainer__ZdR0e",selectorLabel:"ecs-version-selector_selectorLabel__7SICs",selectElement:"ecs-version-selector_selectElement__xtog5"}}},function(e){e.O(0,[31379,92888,49774,40179],function(){return e(e.s=18434)}),_N_E=e.O()}]);