Identifying file and certificate reputations

For each file, include its known hash values (SHA-1, SHA-256, and MD5) in hexadecimal encoding. At least one hash value is required for each file. Include the file name to identify it in reports.

Example of importing a file

When you import a file, you can add a comment field to the XML file to describe the file or certificate to import. The <Comment> includes an appropriate comment to identify it on the reports.

<?xml version="1.0" encoding="UTF-8"?>
<TIEReputations>
    <FileReputation>
        <FileName>HackIt.exe</FileName>
        <SHA1Hash>0x98AF3632E17677A8A23739F720B1A2F215CB8836</SHA1Hash>
        <MD5Hash>0xDEF30CBEA881149C2AFFDF9A059FB751</MD5Hash>
        <SHA256Hash>0xEF127619BAC9E6790FBC925C339111806DA71FAA0CFA0A1E630BEF32B8B1DF91</SHA256Hash>
        <ReputationLevel>15</ReputationLevel>
    </FileReputation>
    <FileReputation>
        <FileName>trayMan.dll</FileName>
        <SHA1Hash>0x7F618396A910908019B5580B4DA9031AF4A433CA</SHA1Hash>
        <MD5Hash>0xB2B3DAE040F6B5AE1DF52B0CD7631A18</MD5Hash>
        <SHA256Hash>0xAF37EBACF8697B55A82E5FA0D742E65ABE0953BA6B09EABA6B35B5B1958F37EC</SHA256Hash>
        <ReputationLevel>15</ReputationLevel>
        <Comment>Comment for ALTTAB</Comment>
    </FileReputation>
</TIEReputations>

For each certificate, include its SHA-1 hash and Public Key SHA-1 values in hexadecimal encoding. Include the certificate name to identify it in reports.

Example of importing a certificate

<?xml version="1.0" encoding="UTF-8"?>
<TIEReputations>
    <CertReputation>
        <SHA1Hash>13D90CAC5FC2C5086E882B13B4BA8115C6F65D09</SHA1Hash>
        <PublicKeySha1>108F9887A4481B94F4C535A9097884F5E29123B8</PublicKeySha1>
        <ReputationLevel>15</ReputationLevel>
        <Comment>Fake ACME certificate</Comment>
    </CertReputation>
</TIEReputations>