Adobe Premiere Pro 22[.]5[.]0[.]62 Repack[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Adobe Premiere Pro 22.5.0.62 Repack.zip
Size

12.7MB
MD5

4ddf9c547dcce6576b1df23e3e6b3bf4
SHA1

a3cbc3a68571ef14b2380f78020f73b8a67d4fcf
SHA256

7a7549da24304e8ec47d75a94ee6a784f7b6449e5ca82ce4bdf3d46742d9f822
SHA512

fcde64f83a31332db46db6b83b50e741b3806885566374849d8edaa244f08b523ee2404545e727821ee7f7516e53bc5eb9768621fb3eee930267fad5ea89934b
SSDEEP

393216:AtPveFHf5qdoDFx3leGZgYnmYJl2XXrqH:A+FhqyDPcWXnmYJl2HrqH

Score

N/A

Malware Config

Signatures

Files

Adobe Premiere Pro 22.5.0.62 Repack.zip
.zip

Password: 7596
AUTORUN.inf
Adobe Premiere Pro 22.5.0.62 Repack.exe
.exe .vbs windows x86

Password: 7596
ReleaseInformation_en.rtf
.rtf
ReleaseInformation_ru.rtf
.rtf
config.ini
packages/ADC/Core/Core.pima
.zip

Password: 7596
AdobePIM.dll
.dll windows x86

Password: 7596

5db31f8d618577020d42520c53016c91

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f5:6d:38:a7:17:be:18:90:a3:ee:c4:e7:63:79:cb:46:b9:1c:78:22
Signer

Actual PE Digest

f5:6d:38:a7:17:be:18:90:a3:ee:c4:e7:63:79:cb:46:b9:1c:78:22

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

13/10/2016, 00:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord74
ord145
ord147

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules

shlwapi

PathAppendW
PathRemoveBackslashW
PathStripPathW
PathAppendA
PathFileExistsA
PathFindFileNameW
PathRemoveFileSpecW
PathIsDirectoryEmptyW
PathIsDirectoryA
PathRemoveFileSpecA
PathFileExistsW
PathRenameExtensionW
PathIsFileSpecW
PathAddExtensionW
PathIsDirectoryW
PathRemoveExtensionW

shell32

ord51
ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW

winhttp

WinHttpQueryAuthSchemes
WinHttpSetTimeouts
WinHttpSetOption
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpOpen
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest

kernel32

InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
IsDebuggerPresent
InterlockedFlushSList
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW
GetCPInfo
LoadLibraryExW
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExA
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
LocalAlloc
ReleaseMutex
Sleep
OpenSemaphoreW
CloseHandle
LocalFree
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
GetTempPathW
MultiByteToWideChar
SetEvent
ResetEvent
GetCommandLineW
CreateProcessW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
FindFirstFileW
FindNextFileW
TerminateProcess
FindClose
GetVersionExW
SetFileAttributesW
CreateEventW
GetDiskFreeSpaceExW
CopyFileW
lstrcmpiW
lstrcmpW
GetExitCodeProcess
AreFileApisANSI
FindNextFileA
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
GetFileSizeEx
lstrlenW
GetACP
SizeofResource
RemoveDirectoryW
GetModuleFileNameW
LockResource
LoadResource
FindResourceW
MoveFileExW
GetCurrentThreadId
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
DuplicateHandle
TerminateThread
GlobalAlloc
GlobalFree
CreateThread
FindResourceExW
lstrcpyW
QueryFullProcessImageNameW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
FileTimeToSystemTime
OpenMutexW
GetUserDefaultLCID
LCMapStringW
SetFilePointerEx
ResumeThread
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
QueryPerformanceFrequency
ReadFile
FlushFileBuffers

user32

wsprintfW
AllowSetForegroundWindow
EnumWindows
GetShellWindow
GetWindowThreadProcessId

advapi32

SetEntriesInAclW
SystemFunction036
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
FreeSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
CreateWellKnownSid
GetTokenInformation
LookupAccountSidW
DuplicateTokenEx
EqualSid
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

ole32

CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoUninitialize
OleRun
CLSIDFromString
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantCopy
SysStringLen
VariantChangeType
VariantClear
VariantInit
GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust

Exports

Exports

AAMIU_Uninstall
AAMIU_getDeploymentValidationStatus
AAMIU_preInstallPropertySet
pim_createLibraryRef
pim_freeLibraryRef
pim_freeLiraryRef
pim_freeString
pim_getAppletAndPackageInfo
pim_getAppletRegistrationInfo
pim_getAppletRelationshipInfo
pim_getCurrentCCVersion
pim_getCurrentPackagesVersion
pim_getInstallStatus
pim_getInstalledPackagesInfo
pim_launchACCCUninstallerExecutableAsAdmin
pim_selfUpdateCheck
pim_startWorkflow
pim_syncFromPathToACF
pim_syncFromPathToPath
pim_syncUSFToACF
pim_uninstallAAMFromAAMCleanerTool
pim_uninstallAAMUsingAAMCleanerTool
pim_uninstallACCCFromACCCCleanerTool
pim_uninstallADCUsingADCCleanerTool

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Core.dll
.dll windows x86

Password: 7596

fa2ad815abcab4fbe648e96fbfa29228

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:ad:ab:eb:33:86:63:fd:77:75:23:96:be:99:0b:f1:0d:fb:c6:99
Signer

Actual PE Digest

48:ad:ab:eb:33:86:63:fd:77:75:23:96:be:99:0b:f1:0d:fb:c6:99

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

13/10/2016, 00:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadId
ReadFile
WriteFile
CreateNamedPipeW
CreateFileW
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
FindClose
DeleteFileW
LocalFree
FlushFileBuffers
CreateMutexW
ReleaseMutex
WideCharToMultiByte
LCMapStringW
CreateEventW
SetEvent
ResetEvent
HeapFree
GetCurrentProcess
TerminateProcess
HeapSize
HeapReAlloc
HeapAlloc
CreateThread
GetProcessHeap
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
CloseHandle
GetCurrentThreadId
WaitForSingleObject
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
SetStdHandle
GetConsoleCP
SetEndOfFile
WriteConsoleW
UnhandledExceptionFilter
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
OutputDebugStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
EncodePointer
TlsAlloc
SetLastError

user32

PostMessageW
TranslateMessage
DispatchMessageW
ShowWindow
LoadCursorW
SetCursor
GetMessageW
CreateDialogParamW
SendMessageW
PostThreadMessageW

advapi32

GetUserNameW
SystemFunction036

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CLSIDFromString
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
OleRun
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantCopy
SysStringLen
VariantChangeType
VariantClear
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW

iphlpapi

GetIpForwardTable

Exports

Exports

finalize
initialize
processMessage

Sections

.text
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADC/Core/Core.pimx
packages/ADC/Core/Core.sig
.xml
packages/ADC/CoreExt/CoreExt.pimx
packages/ADC/CoreExt/CoreExt.sig
.xml
packages/ADC/ElevationManager/ElevationManager.pimx
packages/ADC/ElevationManager/ElevationManager.sig
.xml
packages/ADC/Runtime/Runtime.pima
.zip

Password: 7596
packages/ADC/SignInApp/SignInApp.pima
.zip

Password: 7596
SignInAppBL.dll
.dll windows x86

Password: 7596

24af19d58dfaf997803b99ad44b4956a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d1:56:b8:b1:ec:ec:1a:8a:db:41:e9:1a:77:7e:a1:43:52:de:06:84
Signer

Actual PE Digest

d1:56:b8:b1:ec:ec:1a:8a:db:41:e9:1a:77:7e:a1:43:52:de:06:84

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

13/10/2016, 00:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCrackUrl

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW

kernel32

GetModuleFileNameW
GetTempPathW
FindClose
WaitForSingleObject
SetFileAttributesW
MultiByteToWideChar
DeleteFileW
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
ReadFile
SetLastError
WriteFile
TerminateProcess
CreateMutexW
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
CreateEventW
Sleep
SetEvent
ResetEvent
LocalFree
MoveFileExW
GetFileSize
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
FlushFileBuffers
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetCurrentProcessId
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
CreateDirectoryW
ReleaseSemaphore
CreateSemaphoreW
InterlockedDecrement
GetCurrentThreadId
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
WaitForMultipleObjects
GlobalFree
lstrcpyW
GetCPInfo
GetUserDefaultLCID
LCMapStringW
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
IsValidLocale
lstrlenW
GetCurrentProcess
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleCP
SetStdHandle
WriteConsoleW
WaitForSingleObjectEx
CreateFileMappingA
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
EnumSystemLocalesW
GetStdHandle
GetFileType
GetLocaleInfoW
GetVersionExA
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
ReadConsoleW

user32

wsprintfW

advapi32

CredDeleteW
GetUserNameW
SystemFunction036
CredProtectW
CredWriteW
CredReadW
CredUnprotectW
CredFree

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CLSIDFromProgID
OleRun
CoTaskMemFree
CLSIDFromString

oleaut32

VariantClear
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantCopy
VariantInit
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

Exports

Exports

finalize
initialize
processMessage

Sections

.text
Size: 854KB - Virtual size: 853KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADC/SignInApp/SignInApp.pimx
packages/ADC/SignInApp/SignInApp.sig
.xml
packages/ApplicationInfo.xml
.xml
products/COMP/AdobeColor_MotionPicture_1_0-mul.zip
.zip

Password: 7596
1/AdobeColor_MotionPicture_1_0-mul/Profiles/FilmSceneUniversalPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ACES.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ACEScg.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_Look.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_Look_P3.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_Look_P3D65.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_1000.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_1280.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_160.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_1600.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_200.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_250.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_320.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_400.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_500.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_640.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/ARRI_WCG_800.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCDM_D55.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCDM_D60.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCDM_D65.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCDM_DCI.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCIP3_D55.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCIP3_D60.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCIP3_DCI.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamSceneAD20DLog.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamSceneAD20TLog.icc
.ps1
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamSceneDOriTLin.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamScenePGenTLog.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamSceneTVipFSDLog.icc
.ps1
1/AdobeColor_MotionPicture_1_0-mul/xplat/DCamSceneTVipFSTLog.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFE160PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFE250DPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFE250PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFE400PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFE500PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFF125PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFF64DPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneFR500DPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneK5205PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneK5218PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmSceneK5229PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterF3510RDIPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterF3513RDIPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterF3521RDIPD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterK2383PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterK2393PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/FilmTheaterK2395PD.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/HDR_P3_DCI_ST2084.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/SGamut3Cine_SLog3.icc
1/AdobeColor_MotionPicture_1_0-mul/xplat/SGamut3_SLog3.icc
AdobeColor_MotionPicture_1_0-mul.pimx
.xml
products/COMP/AdobeColor_VideoProfilesAE_1_0-mul.zip
.zip
products/COMP/Application.json
products/CORG/AdobeColorCommonSetRGB_1_0-mul.zip
.zip
products/CORG/Application.json
products/Driver.xml
.xml
resources/Config.xml
.xml
resources/Engine_x32.dll
.dll windows x86

2c8b6407e1519c6ac69e454ee4a811d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

supersub

ord1611
ord417
ord1610
ord984
ord1609
ord411
ord1725
ord1730
ord72

idb

ord1
ord12
ord15
ord13
ord9
ord4
ord6
ord7
ord8
ord5
ord3

synccore

?ConvertHostTagToLSTag@CSyncUtil@@SAJABVTString@@AAJPAU_SYNC_TAGS@@H@Z
??0CSyncHttp@@QAE@PBU_SYNC_TAGS@@HPAVCThreadSafeSocket@@@Z
??1CSyncHttp@@QAE@XZ
?ReadLine@CSyncUtil@@SAJAAKAAVTString@@PAVCSyncHttp@@@Z
?SyncSetHeader@CSyncHttp@@QAEKPAU_SYNCHEADERINFO@@@Z
?GetLValAndRVal@CSyncUtil@@SAJABVTString@@AAV2@1@Z
?GetHostOperEntryType@CSyncUtil@@SAJAAVTString@@0AAJ@Z
?ClearBuffer@CSyncUtil@@SAXPAVCSyncHttp@@@Z
?SyncGetFileSize@CSyncHttp@@QAEKPAK@Z
?SyncSetURLField@CSyncHttp@@QAEKHPAD@Z
?NeedToKillThread@CSyncUtil@@SA_NPAX@Z
nsUnescape
?SkipLine@CSyncUtil@@SAJAAKHAAVTString@@PAVCSyncHttp@@@Z
?SyncStartURLString@CSyncHttp@@QAEKHPAD@Z
?SyncGetServerResponse@CSyncHttp@@QAEPBDXZ
?SyncQuery@CSyncHttp@@QAEKPAD@Z
?SyncCloseAllHttpHandles@CSyncHttp@@QAEXXZ
?ValidHostType@CSyncUtil@@SA_NABJQBJH@Z

manager

??1ABDataStore@@UAE@XZ
ord368
ord372
ord342
?RemoveEntry@ABDataStore@@QAEHPBD000000@Z
?AddEntry@ABDataStore@@QAEHPBD000000@Z
?RemoveItem@CACDataStore@@QAEHPBD00K_N@Z
??0ABDataStore@@QAE@XZ
?AddItem@CACDataStore@@QAEHPBD00K@Z
ord393

msvcp71

?_Nomemory@std@@YAXXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z

msvcr71

_adjust_fdiv
__security_error_handler
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__lconv_init
__CppXcptFilter
_initterm
_callnewh
strtol
_strlwr
memset
_except_handler3
free
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??_V@YAXPAX@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
memmove
memcpy
strlen
sprintf
malloc
strncpy
rename
_purecall
realloc
strcmp
strcpy

user32

LoadStringA

kernel32

ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFullPathNameA
DeleteFileA
GetFileAttributesA
DisableThreadLibraryCalls
lstrlenA
CreateMutexA
CloseHandle
lstrcpynA
ReleaseMutex
WaitForSingleObject
lstrcmpA
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA

zlib

ord3

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/Engine_x64.dll
.dll regsvr32 windows x64

af73e392f837ef9eecbe7b6433c4dd6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcpy
memcmp
_CxxThrowException
wcsnlen
_wtof
isalpha
strtol
isxdigit
isdigit
_XcptFilter
_amsg_exit
__CxxFrameHandler3
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
memset
_onexit
??1type_info@@UEAA@XZ
_errno
realloc
strcmp
__C_specific_handler
free
malloc
_purecall
memmove_s
memcpy_s
calloc
_beginthreadex
wcsncpy_s
_wcsicmp
difftime
time
vswprintf_s
_vscwprintf
wcsspn
wcscspn
_wtol
wcschr
iswspace
wcsstr
_wtoi
wcsncmp
_wcslwr_s
_time64
_gmtime64_s
_wcsupr_s
vsprintf_s
_vscprintf
rand
wcsrchr
wcspbrk
_vsnprintf
_vsnwprintf
swprintf_s
_mbsinc
_wcsicoll
memmove
wcscmp

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW
DisableThreadLibraryCalls
SizeofResource
LockResource
LoadResource

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite
EventWriteTransfer
EventActivityIdControl
EventSetInformation

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapSize
GetProcessHeap

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
EnterCriticalSection
WaitForSingleObject
SetEvent
CreateEventW
AcquireSRWLockExclusive
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringEx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-synch-l1-2-0

Sleep
SleepConditionVariableSRW
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

SetThreadStackGuarantee
GetCurrentProcessId
SetThreadToken
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

ws2_32

GetAddrInfoW
WSACleanup
InetNtopW
FreeAddrInfoW
WSAStartup

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

StringFromGUID2

rpcrt4

UuidIsNil
RpcStringFreeW
UuidToStringW
NdrMesTypeFree3
NdrMesTypeDecode3
MesDecodeBufferHandleCreate
MesHandleFree
MesEncodeFixedBufferHandleCreate
UuidCreate
UuidFromStringW

api-ms-win-security-base-l1-1-0

FreeSid

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

sspicli

LsaRegisterLogonProcess
LsaLookupAuthenticationPackage
SeciFreeCallContext
LsaDeregisterLogonProcess
LsaLogonUser
LsaFreeReturnBuffer
SeciAllocateAndSetCallFlags

api-ms-win-security-cryptoapi-l1-1-0

CryptGetHashParam
CryptDestroyHash
CryptSignHashW
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
CryptHashData

api-ms-win-security-credentials-l1-1-0

CredUnprotectW
CredIsProtectedW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegCreateKeyExW
RegUnLoadKeyW
RegLoadKeyW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenCurrentUser

bcrypt

BCryptCreateHash
BCryptSetProperty
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptDestroyKey
BCryptDecrypt
BCryptGetProperty
BCryptExportKey

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

ntdll

RtlAllocateHeap
RtlImageNtHeader
NtAllocateLocallyUniqueId
RtlInitString
NtOpenThreadToken
NtClose
RtlEqualSid
RtlCopySid
NtQueryInformationToken
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlLengthRequiredSid
RtlLengthSid
RtlInitializeSid
RtlFreeHeap

lsasrv

LsapDbLookupGetDomainInfo

cryptxml

CryptXmlClose
CryptXmlEncode
CryptXmlSign
CryptXmlFindAlgorithmInfo
CryptXmlOpenToEncode
CryptXmlCreateReference

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CloudAPPluginInitialize
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/Extreme.Net.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/ccp64.dll
.dll windows x64

0626cfec1c6312ca25bf4a16d08d869d

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:55:db:cf:a2:75:1e:85:ba:b8:2f:2a:ea:1c:f2:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d6:da:1a:da:8f:d6:b3:69:a2:ea:e1:6a:07:31:ef
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:87:1d:1f:ca:4c:f7:73:71:87:89:fe:97:c5:3d:ee:81:9c:c6:1e:bd:cb:9c:a5:96:49:33:4d:bf:c8:81:48
Signer

Actual PE Digest

06:87:1d:1f:ca:4c:f7:73:71:87:89:fe:97:c5:3d:ee:81:9c:c6:1e:bd:cb:9c:a5:96:49:33:4d:bf:c8:81:48

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: true

Chain 1

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

25:cf:7c:bc:43:e6:9f:bb:14:60:0b:57:bc:37:54:fb:b1:ca:5d:39
Signer

Actual PE Digest

25:cf:7c:bc:43:e6:9f:bb:14:60:0b:57:bc:37:54:fb:b1:ca:5d:39

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateFileW
GetLastError
GetFileTime
CloseHandle
GetFileSize
ReadFile
SetEvent
OutputDebugStringW
GetCurrentThread
TerminateThread
Sleep
ResetEvent
GetExitCodeThread
CreateEventW
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcessId
ResumeThread
WideCharToMultiByte
MultiByteToWideChar
TlsGetValue
TlsSetValue
TlsAlloc
LocalFree
TlsFree
GetModuleFileNameW
GetModuleFileNameA
GetTickCount
GetThreadContext
VirtualQuery
GetCurrentProcess
GetModuleHandleW
VirtualFree
SetThreadPriority
FlushInstructionCache
GetProcAddress
VirtualAlloc
OpenThread
GetSystemInfo
GetThreadPriority
VirtualProtect
SuspendThread
WaitForSingleObject
LocalAlloc
CompareStringW
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
LoadLibraryW
FlushFileBuffers
SetEnvironmentVariableA
GetStartupInfoW
SetHandleCount
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteFile
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetFileAttributesW
WriteConsoleW
GetStdHandle
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
GetCPInfo
RtlLookupFunctionEntry
RtlUnwindEx
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
SetLastError
FlsAlloc
HeapSize
ExitProcess
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy

user32

PostMessageW

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathFindFileNameA
PathAddBackslashW

ws2_32

ntohs
ntohl
htons
inet_ntoa
inet_addr
getsockopt
send
WSASetLastError
__WSAFDIsSet
recv
socket
ioctlsocket
WSAGetLastError

Sections

.text
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 186KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/dbghelp.dll
.dll windows x86

f7cb4432172d116632abc77471a1a600

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:06:bf:fe:00:00:00:00:00:14
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/06/2007, 21:56

Not After

22/09/2008, 22:06

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

a1:03:2f:43:6a:f5:0c:26:23:9e:70:3c:b2:4f:25:d8:64:c5:09:6e
Signer

Actual PE Digest

a1:03:2f:43:6a:f5:0c:26:23:9e:70:3c:b2:4f:25:d8:64:c5:09:6e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/09/2007, 22:47
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_write
_lseeki64
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
isdigit
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
iswprint
atol
??3@YAXPAX@Z
__unDName
_CxxThrowException
bsearch
fread
fseek
_wfsopen
_fsopen
wcstol
_fullpath
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_isatty
fclose
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
_wsopen
_sopen

kernel32

ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
DeviceIoControl
DeleteFileA
CopyFileA
SetFileAttributesA
LCMapStringA
InterlockedIncrement
InterlockedDecrement
LocalFree
MapViewOfFileEx
FlushViewOfFile
GetFileType
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryA
Sleep
GetVersion
GetSystemInfo
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
CreateFileMappingA
MapViewOfFile
FindClose
LocalAlloc
SetLastError
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
FreeLibrary
HeapCreate
InitializeCriticalSection
GetVersionExA
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
SetFilePointer
GetCurrentProcess
UnmapViewOfFile
CreateDirectoryA
VirtualProtect
VirtualAlloc
DuplicateHandle
GetModuleHandleA

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

rpcrt4

UuidCreate

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 936KB - Virtual size: 935KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/dllhelper.dll
.dll windows x86

140ea1a2783378133a762a7bc41e492d

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:55:db:cf:a2:75:1e:85:ba:b8:2f:2a:ea:1c:f2:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d6:da:1a:da:8f:d6:b3:69:a2:ea:e1:6a:07:31:ef
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:cc:3f:24:46:44:ec:82:4c:c8:ff:34:cb:ef:f9:20:7c:34:66:7b:41:c8:18:03:20:b8:d3:93:79:97:95:11
Signer

Actual PE Digest

b0:cc:3f:24:46:44:ec:82:4c:c8:ff:34:cb:ef:f9:20:7c:34:66:7b:41:c8:18:03:20:b8:d3:93:79:97:95:11

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: true

Chain 1

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

7e:40:70:c7:0f:a0:fd:b3:ad:e9:f6:20:8d:ff:a9:47:b6:2a:88:4e
Signer

Actual PE Digest

7e:40:70:c7:0f:a0:fd:b3:ad:e9:f6:20:8d:ff:a9:47:b6:2a:88:4e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

EnterCriticalSection
GetACP
CloseHandle
LocalFree
TlsAlloc
GetTickCount
OpenFileMappingW
VirtualFree
GetStartupInfoW
ExitProcess
InitializeCriticalSection
VirtualAlloc
RtlUnwind
GetCPInfo
GetCommandLineW
GetSystemInfo
GetProcAddress
LeaveCriticalSection
EnumSystemLocalesW
GetStdHandle
GetVersionExW
VerifyVersionInfoW
GetModuleHandleW
FreeLibrary
GetDiskFreeSpaceW
VerSetConditionMask
GetUserDefaultUILanguage
FindFirstFileW
TlsFree
GetModuleFileNameW
GetLastError
lstrlenW
CompareStringA
CompareStringW
CreateThread
WideCharToMultiByte
MapViewOfFile
MultiByteToWideChar
FindClose
LoadLibraryW
LoadLibraryA
ResetEvent
SetEvent
GetLocaleInfoW
GetVersion
RaiseException
SwitchToThread
GetLocalTime
WaitForSingleObject
WriteFile
DeleteCriticalSection
TlsGetValue
IsValidLocale
TlsSetValue
LoadLibraryExW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
CreateEventW
GetThreadLocale
Sleep
SetThreadLocale

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CallNextHookEx
CharUpperBuffW
CharNextW
CharLowerBuffW
SetWindowsHookExW
UnhookWindowsHookEx
LoadStringW
CharUpperW
GetSystemMetrics
MessageBoxW

oleaut32

SysAllocStringLen
SysFreeString
SysReAllocStringLen

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

Exports

Exports

StartHook
StopHook

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 153B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
resources/dllhelper64.dll
.dll windows x64

c8820c92458429ac52b291ca51bad0e4

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:55:db:cf:a2:75:1e:85:ba:b8:2f:2a:ea:1c:f2:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d6:da:1a:da:8f:d6:b3:69:a2:ea:e1:6a:07:31:ef
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/04/2020, 00:00

Not After

16/06/2023, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:c2:ef:fc:08:27:a1:fb:4b:f8:58:8b:3e:f5:7e:3c:b5:71:4e:26:20:7b:ed:13:a8:4a:0f:30:7b:4b:50:94
Signer

Actual PE Digest

24:c2:ef:fc:08:27:a1:fb:4b:f8:58:8b:3e:f5:7e:3c:b5:71:4e:26:20:7b:ed:13:a8:4a:0f:30:7b:4b:50:94

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: true

Chain 1

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

37:3f:c6:23:c3:cf:ff:ba:35:17:70:cb:48:f8:d5:ed:57:d9:b5:83
Signer

Actual PE Digest

37:3f:c6:23:c3:cf:ff:ba:35:17:70:cb:48:f8:d5:ed:57:d9:b5:83

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,ST=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/03/2021, 05:27
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
RtlUnwindEx
GetACP
CloseHandle
LocalFree
TlsAlloc
GetTickCount
OpenFileMappingW
VirtualFree
GetStartupInfoW
ExitProcess
InitializeCriticalSection
VirtualAlloc
RtlUnwind
GetCPInfo
GetCommandLineW
GetSystemInfo
GetProcAddress
LeaveCriticalSection
EnumSystemLocalesW
GetStdHandle
GetVersionExW
VerifyVersionInfoW
GetModuleHandleW
FreeLibrary
GetDiskFreeSpaceW
VerSetConditionMask
GetUserDefaultUILanguage
FindFirstFileW
TlsFree
GetModuleFileNameW
GetLastError
lstrlenW
CompareStringA
CompareStringW
CreateThread
WideCharToMultiByte
MapViewOfFile
MultiByteToWideChar
FindClose
LoadLibraryW
LoadLibraryA
ResetEvent
SetEvent
GetLocaleInfoW
GetVersion
RaiseException
SwitchToThread
GetLocalTime
WaitForSingleObject
WriteFile
DeleteCriticalSection
TlsGetValue
IsValidLocale
TlsSetValue
LoadLibraryExW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
CreateEventW
GetThreadLocale
Sleep
SetThreadLocale

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CallNextHookEx
CharUpperBuffW
CharNextW
CharLowerBuffW
SetWindowsHookExW
UnhookWindowsHookEx
LoadStringW
CharUpperW
GetSystemMetrics
MessageBoxW

oleaut32

SysAllocStringLen
SysFreeString
SysReAllocStringLen

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

Exports

Exports

StartHook
StopHook

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 41KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 153B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
resources/dllinject32.dll
.dll windows x86

48506a583e848e3981fefc88787e9c19

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:c5:85:87:d0:f1:0c:f4:22:4e:20:9a:93:7c:ac:a5
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/06/2019, 00:00

Not After

16/06/2020, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:10:93:ba:dc:1b:5a:f1:ea:90:c4:9c:6b:6d:48:a1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/06/2019, 00:00

Not After

16/06/2020, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e6:6c:25:97:b7:3e:5a:b4:96:39:95:dc:ac:b5:0f:0a:2d:60:7b:af:cb:08:12:5f:dc:e0:a3:33:4a:8c:a2
Signer

Actual PE Digest

23:e6:6c:25:97:b7:3e:5a:b4:96:39:95:dc:ac:b5:0f:0a:2d:60:7b:af:cb:08:12:5f:dc:e0:a3:33:4a:8c:a2

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/09/2019, 11:16
Valid: true

Chain 1

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

b7:69:84:9b:a9:a7:9d:a0:03:8b:2d:11:74:7e:72:30:5c:32:9c:7a
Signer

Actual PE Digest

b7:69:84:9b:a9:a7:9d:a0:03:8b:2d:11:74:7e:72:30:5c:32:9c:7a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/09/2019, 11:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
InitializeCriticalSection
LeaveCriticalSection
CreateFileW
GetLastError
EnterCriticalSection
GetFileTime
DeleteCriticalSection
CloseHandle
GetFileSize
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetModuleFileNameW
WriteConsoleW
InterlockedExchange
SetFilePointer
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
EncodePointer
DecodePointer
HeapReAlloc
GetFileType
GetFileAttributesW
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetProcAddress
IsProcessorFeaturePresent
GetStringTypeW
RaiseException
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
Sleep
HeapSize
LCMapStringW
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
GetConsoleMode
SetStdHandle
SetHandleCount
GetStartupInfoW
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

ws2_32

inet_addr
ntohl

Exports

Exports

install
uninstall

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/dllinject64.dll
.dll windows x64

5fec2d1860d9473f4a551b47895ff1fb

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:c5:85:87:d0:f1:0c:f4:22:4e:20:9a:93:7c:ac:a5
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/06/2019, 00:00

Not After

16/06/2020, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:10:93:ba:dc:1b:5a:f1:ea:90:c4:9c:6b:6d:48:a1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/06/2019, 00:00

Not After

16/06/2020, 12:00

Subject

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c7:67:8b:cb:83:d1:e6:50:4a:4e:e4:f4:42:a8:41:8f:ec:90:f1:4e:e2:7a:68:5b:5a:c4:70:de:74:f8:44:f1
Signer

Actual PE Digest

c7:67:8b:cb:83:d1:e6:50:4a:4e:e4:f4:42:a8:41:8f:ec:90:f1:4e:e2:7a:68:5b:5a:c4:70:de:74:f8:44:f1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/09/2019, 11:16
Valid: true

Chain 1

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

fb:1c:5f:31:0c:c2:25:7b:d9:95:b9:3d:b4:75:bc:4b:8b:68:d0:95
Signer

Actual PE Digest

fb:1c:5f:31:0c:c2:25:7b:d9:95:b9:3d:b4:75:bc:4b:8b:68:d0:95

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=1962832,CN=International Media Ltd,O=International Media Ltd,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

14/09/2019, 11:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
InitializeCriticalSection
LeaveCriticalSection
CreateFileW
GetLastError
EnterCriticalSection
GetFileTime
DeleteCriticalSection
CloseHandle
GetFileSize
ReadFile
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetModuleFileNameW
WriteConsoleW
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapFree
HeapAlloc
EncodePointer
DecodePointer
HeapReAlloc
GetFileType
GetFileAttributesW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
SetLastError
FlsAlloc
GetStringTypeW
RaiseException
RtlPcToFileHeader
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
Sleep
HeapSize
RtlUnwindEx
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetStdHandle
SetHandleCount
GetStartupInfoW
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

ws2_32

inet_addr
ntohl

Exports

Exports

install
uninstall

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/ipcclientcerts.dll
.dll windows x64

89ca3b68ab6cd55c85347d9b6648f12a

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/04/2021, 00:00

Not After

19/06/2024, 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:5e:16:81:e1:27:49:12:71:60:f0:62:9e:77:e1:80:e6:60:a7:33
Signer

Actual PE Digest

66:5e:16:81:e1:27:49:12:71:60:f0:62:9e:77:e1:80:e6:60:a7:33

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

11/04/2022, 19:31
Valid: true

Chain 1

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CreateMutexA
DisableThreadLibraryCalls
FormatMessageW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObjectEx
WriteConsoleW
WriteFile

vcruntime140

__C_specific_handler
__CxxFrameHandler3
__std_type_info_destroy_list
memcmp
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-math-l1-1-0

cbrt

api-ms-win-crt-string-l1-1-0

strlen

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/lgpllibs.dll
.dll windows x64

451aecea9f58042e76d96a82be2804fa

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/04/2021, 00:00

Not After

19/06/2024, 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4a:3b:90:da:c2:ec:bd:f2:73:49:3f:a1:d6:9e:62:a9:55:da:15:1a
Signer

Actual PE Digest

4a:3b:90:da:c2:ec:bd:f2:73:49:3f:a1:d6:9e:62:a9:55:da:15:1a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

11/04/2022, 19:31
Valid: true

Chain 1

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mozglue

??2@YAPEAX_K@Z
??3@YAXPEAX@Z
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z

kernel32

DisableThreadLibraryCalls
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
_purecall
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-math-l1-1-0

cos
exp
ldexp
sin
sqrt

Exports

Exports

??0SoundTouch@soundtouch@@QEAA@AEBV01@@Z
??0SoundTouch@soundtouch@@QEAA@XZ
??1SoundTouch@soundtouch@@UEAA@XZ
??4SoundTouch@soundtouch@@QEAAAEAV01@AEBV01@@Z
??_7SoundTouch@soundtouch@@6B@
?calcEffectiveRateAndTempo@SoundTouch@soundtouch@@AEAAXXZ
?clear@SoundTouch@soundtouch@@UEAAXXZ
?createSoundTouchObj@soundtouch@@YAPEAVSoundTouch@1@XZ
?destroySoundTouchObj@soundtouch@@YAXPEAVSoundTouch@1@@Z
?flush@SoundTouch@soundtouch@@QEAAXXZ
?getInputOutputSampleRatio@SoundTouch@soundtouch@@QEAANXZ
?getSetting@SoundTouch@soundtouch@@QEBAHH@Z
?getVersionId@SoundTouch@soundtouch@@SAIXZ
?getVersionString@SoundTouch@soundtouch@@SAPEBDXZ
?numChannels@SoundTouch@soundtouch@@QEBAIXZ
?numUnprocessedSamples@SoundTouch@soundtouch@@UEBAIXZ
?putSamples@SoundTouch@soundtouch@@UEAAXPEBMI@Z
?receiveSamples@SoundTouch@soundtouch@@UEAAII@Z
?receiveSamples@SoundTouch@soundtouch@@UEAAIPEAMI@Z
?setChannels@SoundTouch@soundtouch@@QEAAXI@Z
?setPitch@SoundTouch@soundtouch@@QEAAXN@Z
?setPitchOctaves@SoundTouch@soundtouch@@QEAAXN@Z
?setPitchSemiTones@SoundTouch@soundtouch@@QEAAXH@Z
?setPitchSemiTones@SoundTouch@soundtouch@@QEAAXN@Z
?setRate@SoundTouch@soundtouch@@QEAAXN@Z
?setRateChange@SoundTouch@soundtouch@@QEAAXN@Z
?setSampleRate@SoundTouch@soundtouch@@QEAAXI@Z
?setSetting@SoundTouch@soundtouch@@QEAA_NHH@Z
?setTempo@SoundTouch@soundtouch@@QEAAXN@Z
?setTempoChange@SoundTouch@soundtouch@@QEAAXN@Z

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/libEGL.dll
.dll windows x64

733fea540c63883bb80910cfcf25367e

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/04/2021, 00:00

Not After

19/06/2024, 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a6:34:64:16:a9:76:95:77:5e:ed:d6:4f:87:24:44:73:2b:ae:0e:51
Signer

Actual PE Digest

a6:34:64:16:a9:76:95:77:5e:ed:d6:4f:87:24:44:73:2b:ae:0e:51

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

11/04/2022, 19:31
Valid: true

Chain 1

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mozglue

??3@YAXPEAX_K@Z
free
moz_xmalloc

kernel32

CloseHandle
CreateEventW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
QueryPerformanceCounter
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObjectEx

vcruntime140

__C_specific_handler
__CxxFrameHandler3
__std_terminate
__std_type_info_destroy_list
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

cosf
exp2f
logf
sinf
sqrtf

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_crt_atexit
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
_seh_filter_dll

Exports

Exports

eglBindAPI
eglBindTexImage
eglChooseConfig
eglClientWaitSync
eglClientWaitSyncKHR
eglCopyBuffers
eglCreateContext
eglCreateDeviceANGLE
eglCreateImage
eglCreateImageKHR
eglCreateNativeClientBufferANDROID
eglCreatePbufferFromClientBuffer
eglCreatePbufferSurface
eglCreatePixmapSurface
eglCreatePlatformPixmapSurface
eglCreatePlatformPixmapSurfaceEXT
eglCreatePlatformWindowSurface
eglCreatePlatformWindowSurfaceEXT
eglCreateStreamKHR
eglCreateStreamProducerD3DTextureANGLE
eglCreateSync
eglCreateSyncKHR
eglCreateWindowSurface
eglDebugMessageControlKHR
eglDestroyContext
eglDestroyImage
eglDestroyImageKHR
eglDestroyStreamKHR
eglDestroySurface
eglDestroySync
eglDestroySyncKHR
eglDupNativeFenceFDANDROID
eglGetCompositorTimingANDROID
eglGetCompositorTimingSupportedANDROID
eglGetConfigAttrib
eglGetConfigs
eglGetCurrentContext
eglGetCurrentDisplay
eglGetCurrentSurface
eglGetDisplay
eglGetError
eglGetFrameTimestampSupportedANDROID
eglGetFrameTimestampsANDROID
eglGetMscRateANGLE
eglGetNativeClientBufferANDROID
eglGetNextFrameIdANDROID
eglGetPlatformDisplay
eglGetPlatformDisplayEXT
eglGetProcAddress
eglGetSyncAttrib
eglGetSyncAttribKHR
eglGetSyncValuesCHROMIUM
eglHandleGPUSwitchANGLE
eglInitialize
eglLabelObjectKHR
eglMakeCurrent
eglPostSubBufferNV
eglPresentationTimeANDROID
eglProgramCacheGetAttribANGLE
eglProgramCachePopulateANGLE
eglProgramCacheQueryANGLE
eglProgramCacheResizeANGLE
eglQueryAPI
eglQueryContext
eglQueryDebugKHR
eglQueryDeviceAttribEXT
eglQueryDeviceStringEXT
eglQueryDisplayAttribANGLE
eglQueryDisplayAttribEXT
eglQueryStreamKHR
eglQueryStreamu64KHR
eglQueryString
eglQueryStringiANGLE
eglQuerySurface
eglQuerySurfacePointerANGLE
eglReacquireHighPowerGPUANGLE
eglReleaseDeviceANGLE
eglReleaseHighPowerGPUANGLE
eglReleaseTexImage
eglReleaseThread
eglSetBlobCacheFuncsANDROID
eglSignalSyncKHR
eglStreamAttribKHR
eglStreamConsumerAcquireKHR
eglStreamConsumerGLTextureExternalAttribsNV
eglStreamConsumerGLTextureExternalKHR
eglStreamConsumerReleaseKHR
eglStreamPostD3DTextureANGLE
eglSurfaceAttrib
eglSwapBuffers
eglSwapBuffersWithDamageKHR
eglSwapBuffersWithFrameTokenANGLE
eglSwapInterval
eglTerminate
eglWaitClient
eglWaitGL
eglWaitNative
eglWaitSync
eglWaitSyncKHR

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/libGLESv2.dll
.dll windows x64

d3b9f773b719611cb85d579c179cbf68

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/04/2021, 00:00

Not After

19/06/2024, 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

92:56:07:cc:28:e5:34:2e:3b:04:21:bc:a1:22:4d:2c:ed:d8:f6:44
Signer

Actual PE Digest

92:56:07:cc:28:e5:34:2e:3b:04:21:bc:a1:22:4d:2c:ed:d8:f6:44

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

11/04/2022, 19:31
Valid: true

Chain 1

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mozglue

??3@YAXPEAX_K@Z
free
malloc
moz_xmalloc
realloc

dxgi

CreateDXGIFactory1

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_SetMarker
Direct3DCreate9

kernel32

CloseHandle
CreateEventW
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
WaitForSingleObjectEx

user32

CreateWindowExW
DestroyWindow
GetClientRect
InvalidateRect
IsIconic
IsWindow
WindowFromDC

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0ios_base@std@@IEAA@XZ
??0task_continuation_context@Concurrency@@AEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1ios_base@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_XGetLastError@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?classic@locale@std@@SAAEBV12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?fail@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Cnd_register_at_thread_exit
_Cnd_timedwait
_Cnd_unregister_at_thread_exit
_Cnd_wait
_Mtx_current_owns
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock
_Thrd_hardware_concurrency
_Thrd_id
_Xtime_get_ticks

vcruntime140

__C_specific_handler
__CxxFrameHandler3
__std_terminate
__std_type_info_destroy_list
_purecall
memchr
memcmp
memcpy
memmove
memset
strrchr
strstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
fwrite

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_seh_filter_dll
exit

api-ms-win-crt-math-l1-1-0

_fdsign
acosf
acoshf
asinf
asinhf
atan2f
atanf
atanhf
ceilf
cosf
coshf
exp2f
expf
floorf
ldexp
logf
modff
pow
powf
round
roundf
sinf
sinhf
sqrtf
tanf
tanhf
truncf

api-ms-win-crt-convert-l1-1-0

atoi
mbsrtowcs
strtoul
wcstombs

api-ms-win-crt-string-l1-1-0

strcmp
strlen
strncmp
tolower
wcslen

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong

Exports

Exports

??0PlatformMethods@angle@@QEAA@XZ
??4PlatformMethods@angle@@QEAAAEAU01@$$QEAU01@@Z
??4PlatformMethods@angle@@QEAAAEAU01@AEBU01@@Z
ANGLEGetDisplayPlatform
ANGLEResetDisplayPlatform
EGL_BindAPI
EGL_BindTexImage
EGL_ChooseConfig
EGL_ClientWaitSync
EGL_ClientWaitSyncKHR
EGL_CopyBuffers
EGL_CreateContext
EGL_CreateDeviceANGLE
EGL_CreateImage
EGL_CreateImageKHR
EGL_CreateNativeClientBufferANDROID
EGL_CreatePbufferFromClientBuffer
EGL_CreatePbufferSurface
EGL_CreatePixmapSurface
EGL_CreatePlatformPixmapSurface
EGL_CreatePlatformPixmapSurfaceEXT
EGL_CreatePlatformWindowSurface
EGL_CreatePlatformWindowSurfaceEXT
EGL_CreateStreamKHR
EGL_CreateStreamProducerD3DTextureANGLE
EGL_CreateSync
EGL_CreateSyncKHR
EGL_CreateWindowSurface
EGL_DebugMessageControlKHR
EGL_DestroyContext
EGL_DestroyImage
EGL_DestroyImageKHR
EGL_DestroyStreamKHR
EGL_DestroySurface
EGL_DestroySync
EGL_DestroySyncKHR
EGL_DupNativeFenceFDANDROID
EGL_GetCompositorTimingANDROID
EGL_GetCompositorTimingSupportedANDROID
EGL_GetConfigAttrib
EGL_GetConfigs
EGL_GetCurrentContext
EGL_GetCurrentDisplay
EGL_GetCurrentSurface
EGL_GetDisplay
EGL_GetError
EGL_GetFrameTimestampSupportedANDROID
EGL_GetFrameTimestampsANDROID
EGL_GetMscRateANGLE
EGL_GetNativeClientBufferANDROID
EGL_GetNextFrameIdANDROID
EGL_GetPlatformDisplay
EGL_GetPlatformDisplayEXT
EGL_GetProcAddress
EGL_GetSyncAttrib
EGL_GetSyncAttribKHR
EGL_GetSyncValuesCHROMIUM
EGL_HandleGPUSwitchANGLE
EGL_Initialize
EGL_LabelObjectKHR
EGL_MakeCurrent
EGL_PostSubBufferNV
EGL_PresentationTimeANDROID
EGL_ProgramCacheGetAttribANGLE
EGL_ProgramCachePopulateANGLE
EGL_ProgramCacheQueryANGLE
EGL_ProgramCacheResizeANGLE
EGL_QueryAPI
EGL_QueryContext
EGL_QueryDebugKHR
EGL_QueryDeviceAttribEXT
EGL_QueryDeviceStringEXT
EGL_QueryDisplayAttribANGLE
EGL_QueryDisplayAttribEXT
EGL_QueryStreamKHR
EGL_QueryStreamu64KHR
EGL_QueryString
EGL_QueryStringiANGLE
EGL_QuerySurface
EGL_QuerySurfacePointerANGLE
EGL_ReacquireHighPowerGPUANGLE
EGL_ReleaseDeviceANGLE
EGL_ReleaseHighPowerGPUANGLE
EGL_ReleaseTexImage
EGL_ReleaseThread
EGL_SetBlobCacheFuncsANDROID
EGL_SignalSyncKHR
EGL_StreamAttribKHR
EGL_StreamConsumerAcquireKHR
EGL_StreamConsumerGLTextureExternalAttribsNV
EGL_StreamConsumerGLTextureExternalKHR
EGL_StreamConsumerReleaseKHR
EGL_StreamPostD3DTextureANGLE
EGL_SurfaceAttrib
EGL_SwapBuffers
EGL_SwapBuffersWithDamageKHR
EGL_SwapBuffersWithFrameTokenANGLE
EGL_SwapInterval
EGL_Terminate
EGL_WaitClient
EGL_WaitGL
EGL_WaitNative
EGL_WaitSync
EGL_WaitSyncKHR
GL_ActiveShaderProgram
GL_ActiveShaderProgramContextANGLE
GL_ActiveShaderProgramEXT
GL_ActiveShaderProgramEXTContextANGLE
GL_ActiveTexture
GL_ActiveTextureContextANGLE
GL_AlphaFunc
GL_AlphaFuncContextANGLE
GL_AlphaFuncx
GL_AlphaFuncxContextANGLE
GL_AttachShader
GL_AttachShaderContextANGLE
GL_BeginQuery
GL_BeginQueryContextANGLE
GL_BeginQueryEXT
GL_BeginQueryEXTContextANGLE
GL_BeginTransformFeedback
GL_BeginTransformFeedbackContextANGLE
GL_BindAttribLocation
GL_BindAttribLocationContextANGLE
GL_BindBuffer
GL_BindBufferBase
GL_BindBufferBaseContextANGLE
GL_BindBufferContextANGLE
GL_BindBufferRange
GL_BindBufferRangeContextANGLE
GL_BindFragDataLocationEXT
GL_BindFragDataLocationEXTContextANGLE
GL_BindFragDataLocationIndexedEXT
GL_BindFragDataLocationIndexedEXTContextANGLE
GL_BindFramebuffer
GL_BindFramebufferContextANGLE
GL_BindFramebufferOES
GL_BindFramebufferOESContextANGLE
GL_BindImageTexture
GL_BindImageTextureContextANGLE
GL_BindProgramPipeline
GL_BindProgramPipelineContextANGLE
GL_BindProgramPipelineEXT
GL_BindProgramPipelineEXTContextANGLE
GL_BindRenderbuffer
GL_BindRenderbufferContextANGLE
GL_BindRenderbufferOES
GL_BindRenderbufferOESContextANGLE
GL_BindSampler
GL_BindSamplerContextANGLE
GL_BindTexture
GL_BindTextureContextANGLE
GL_BindTransformFeedback
GL_BindTransformFeedbackContextANGLE
GL_BindUniformLocationCHROMIUM
GL_BindUniformLocationCHROMIUMContextANGLE
GL_BindVertexArray
GL_BindVertexArrayContextANGLE
GL_BindVertexArrayOES
GL_BindVertexArrayOESContextANGLE
GL_BindVertexBuffer
GL_BindVertexBufferContextANGLE
GL_BlendBarrier
GL_BlendBarrierContextANGLE
GL_BlendBarrierKHR
GL_BlendBarrierKHRContextANGLE
GL_BlendColor
GL_BlendColorContextANGLE
GL_BlendEquation
GL_BlendEquationContextANGLE
GL_BlendEquationSeparate
GL_BlendEquationSeparateContextANGLE
GL_BlendEquationSeparatei
GL_BlendEquationSeparateiContextANGLE
GL_BlendEquationSeparateiEXT
GL_BlendEquationSeparateiEXTContextANGLE
GL_BlendEquationSeparateiOES
GL_BlendEquationSeparateiOESContextANGLE
GL_BlendEquationi
GL_BlendEquationiContextANGLE
GL_BlendEquationiEXT
GL_BlendEquationiEXTContextANGLE
GL_BlendEquationiOES
GL_BlendEquationiOESContextANGLE
GL_BlendFunc
GL_BlendFuncContextANGLE
GL_BlendFuncSeparate
GL_BlendFuncSeparateContextANGLE
GL_BlendFuncSeparatei
GL_BlendFuncSeparateiContextANGLE
GL_BlendFuncSeparateiEXT
GL_BlendFuncSeparateiEXTContextANGLE
GL_BlendFuncSeparateiOES
GL_BlendFuncSeparateiOESContextANGLE
GL_BlendFunci
GL_BlendFunciContextANGLE
GL_BlendFunciEXT
GL_BlendFunciEXTContextANGLE
GL_BlendFunciOES
GL_BlendFunciOESContextANGLE
GL_BlitFramebuffer
GL_BlitFramebufferANGLE
GL_BlitFramebufferANGLEContextANGLE
GL_BlitFramebufferContextANGLE
GL_BlitFramebufferNV
GL_BlitFramebufferNVContextANGLE
GL_BufferData
GL_BufferDataContextANGLE
GL_BufferStorageEXT
GL_BufferStorageEXTContextANGLE
GL_BufferStorageExternalEXT
GL_BufferStorageExternalEXTContextANGLE
GL_BufferStorageMemEXT
GL_BufferStorageMemEXTContextANGLE
GL_BufferSubData
GL_BufferSubDataContextANGLE
GL_CheckFramebufferStatus
GL_CheckFramebufferStatusContextANGLE
GL_CheckFramebufferStatusOES
GL_CheckFramebufferStatusOESContextANGLE
GL_Clear
GL_ClearBufferfi
GL_ClearBufferfiContextANGLE
GL_ClearBufferfv
GL_ClearBufferfvContextANGLE
GL_ClearBufferiv
GL_ClearBufferivContextANGLE
GL_ClearBufferuiv
GL_ClearBufferuivContextANGLE
GL_ClearColor
GL_ClearColorContextANGLE
GL_ClearColorx
GL_ClearColorxContextANGLE
GL_ClearContextANGLE
GL_ClearDepthf
GL_ClearDepthfContextANGLE
GL_ClearDepthx
GL_ClearDepthxContextANGLE
GL_ClearStencil
GL_ClearStencilContextANGLE
GL_ClientActiveTexture
GL_ClientActiveTextureContextANGLE
GL_ClientWaitSync
GL_ClientWaitSyncContextANGLE
GL_ClipControlEXT
GL_ClipControlEXTContextANGLE
GL_ClipPlanef
GL_ClipPlanefContextANGLE
GL_ClipPlanex
GL_ClipPlanexContextANGLE
GL_Color4f
GL_Color4fContextANGLE
GL_Color4ub
GL_Color4ubContextANGLE
GL_Color4x
GL_Color4xContextANGLE
GL_ColorMask
GL_ColorMaskContextANGLE
GL_ColorMaski
GL_ColorMaskiContextANGLE
GL_ColorMaskiEXT
GL_ColorMaskiEXTContextANGLE
GL_ColorMaskiOES
GL_ColorMaskiOESContextANGLE
GL_ColorPointer
GL_ColorPointerContextANGLE
GL_CompileShader
GL_CompileShaderContextANGLE
GL_CompressedCopyTextureCHROMIUM
GL_CompressedCopyTextureCHROMIUMContextANGLE
GL_CompressedTexImage2D
GL_CompressedTexImage2DContextANGLE
GL_CompressedTexImage2DRobustANGLE
GL_CompressedTexImage2DRobustANGLEContextANGLE
GL_CompressedTexImage3D
GL_CompressedTexImage3DContextANGLE
GL_CompressedTexImage3DOES
GL_CompressedTexImage3DOESContextANGLE
GL_CompressedTexImage3DRobustANGLE
GL_CompressedTexImage3DRobustANGLEContextANGLE
GL_CompressedTexSubImage2D
GL_CompressedTexSubImage2DContextANGLE
GL_CompressedTexSubImage2DRobustANGLE
GL_CompressedTexSubImage2DRobustANGLEContextANGLE
GL_CompressedTexSubImage3D
GL_CompressedTexSubImage3DContextANGLE
GL_CompressedTexSubImage3DOES
GL_CompressedTexSubImage3DOESContextANGLE
GL_CompressedTexSubImage3DRobustANGLE
GL_CompressedTexSubImage3DRobustANGLEContextANGLE
GL_CopyBufferSubData
GL_CopyBufferSubDataContextANGLE
GL_CopyImageSubData
GL_CopyImageSubDataContextANGLE
GL_CopyImageSubDataEXT
GL_CopyImageSubDataEXTContextANGLE
GL_CopyImageSubDataOES
GL_CopyImageSubDataOESContextANGLE
GL_CopySubTexture3DANGLE
GL_CopySubTexture3DANGLEContextANGLE
GL_CopySubTextureCHROMIUM
GL_CopySubTextureCHROMIUMContextANGLE
GL_CopyTexImage2D
GL_CopyTexImage2DContextANGLE
GL_CopyTexSubImage2D
GL_CopyTexSubImage2DContextANGLE
GL_CopyTexSubImage3D
GL_CopyTexSubImage3DContextANGLE
GL_CopyTexSubImage3DOES
GL_CopyTexSubImage3DOESContextANGLE
GL_CopyTexture3DANGLE
GL_CopyTexture3DANGLEContextANGLE
GL_CopyTextureCHROMIUM
GL_CopyTextureCHROMIUMContextANGLE
GL_CoverageModulationCHROMIUM
GL_CoverageModulationCHROMIUMContextANGLE
GL_CreateMemoryObjectsEXT
GL_CreateMemoryObjectsEXTContextANGLE
GL_CreateProgram
GL_CreateProgramContextANGLE
GL_CreateShader
GL_CreateShaderContextANGLE
GL_CreateShaderProgramv
GL_CreateShaderProgramvContextANGLE
GL_CreateShaderProgramvEXT
GL_CreateShaderProgramvEXTContextANGLE
GL_CullFace
GL_CullFaceContextANGLE
GL_CurrentPaletteMatrixOES
GL_CurrentPaletteMatrixOESContextANGLE
GL_DebugMessageCallback
GL_DebugMessageCallbackContextANGLE
GL_DebugMessageCallbackKHR
GL_DebugMessageCallbackKHRContextANGLE
GL_DebugMessageControl
GL_DebugMessageControlContextANGLE
GL_DebugMessageControlKHR
GL_DebugMessageControlKHRContextANGLE
GL_DebugMessageInsert
GL_DebugMessageInsertContextANGLE
GL_DebugMessageInsertKHR
GL_DebugMessageInsertKHRContextANGLE
GL_DeleteBuffers
GL_DeleteBuffersContextANGLE
GL_DeleteFencesNV
GL_DeleteFencesNVContextANGLE
GL_DeleteFramebuffers
GL_DeleteFramebuffersContextANGLE
GL_DeleteFramebuffersOES
GL_DeleteFramebuffersOESContextANGLE
GL_DeleteMemoryObjectsEXT
GL_DeleteMemoryObjectsEXTContextANGLE
GL_DeleteProgram
GL_DeleteProgramContextANGLE
GL_DeleteProgramPipelines
GL_DeleteProgramPipelinesContextANGLE
GL_DeleteProgramPipelinesEXT
GL_DeleteProgramPipelinesEXTContextANGLE
GL_DeleteQueries
GL_DeleteQueriesContextANGLE
GL_DeleteQueriesEXT
GL_DeleteQueriesEXTContextANGLE
GL_DeleteRenderbuffers
GL_DeleteRenderbuffersContextANGLE
GL_DeleteRenderbuffersOES
GL_DeleteRenderbuffersOESContextANGLE
GL_DeleteSamplers
GL_DeleteSamplersContextANGLE
GL_DeleteSemaphoresEXT
GL_DeleteSemaphoresEXTContextANGLE
GL_DeleteShader
GL_DeleteShaderContextANGLE
GL_DeleteSync
GL_DeleteSyncContextANGLE
GL_DeleteTextures
GL_DeleteTexturesContextANGLE
GL_DeleteTransformFeedbacks
GL_DeleteTransformFeedbacksContextANGLE
GL_DeleteVertexArrays
GL_DeleteVertexArraysContextANGLE
GL_DeleteVertexArraysOES
GL_DeleteVertexArraysOESContextANGLE
GL_DepthFunc
GL_DepthFuncContextANGLE
GL_DepthMask
GL_DepthMaskContextANGLE
GL_DepthRangef
GL_DepthRangefContextANGLE
GL_DepthRangex
GL_DepthRangexContextANGLE
GL_DetachShader
GL_DetachShaderContextANGLE
GL_Disable
GL_DisableClientState
GL_DisableClientStateContextANGLE
GL_DisableContextANGLE
GL_DisableExtensionANGLE
GL_DisableExtensionANGLEContextANGLE
GL_DisableVertexAttribArray
GL_DisableVertexAttribArrayContextANGLE
GL_Disablei
GL_DisableiContextANGLE
GL_DisableiEXT
GL_DisableiEXTContextANGLE
GL_DisableiOES
GL_DisableiOESContextANGLE
GL_DiscardFramebufferEXT
GL_DiscardFramebufferEXTContextANGLE
GL_DispatchCompute
GL_DispatchComputeContextANGLE
GL_DispatchComputeIndirect
GL_DispatchComputeIndirectContextANGLE
GL_DrawArrays
GL_DrawArraysContextANGLE
GL_DrawArraysIndirect
GL_DrawArraysIndirectContextANGLE
GL_DrawArraysInstanced
GL_DrawArraysInstancedANGLE
GL_DrawArraysInstancedANGLEContextANGLE
GL_DrawArraysInstancedBaseInstanceANGLE
GL_DrawArraysInstancedBaseInstanceANGLEContextANGLE
GL_DrawArraysInstancedContextANGLE
GL_DrawArraysInstancedEXT
GL_DrawArraysInstancedEXTContextANGLE
GL_DrawBuffers
GL_DrawBuffersContextANGLE
GL_DrawBuffersEXT
GL_DrawBuffersEXTContextANGLE
GL_DrawElements
GL_DrawElementsBaseVertex
GL_DrawElementsBaseVertexContextANGLE
GL_DrawElementsBaseVertexEXT
GL_DrawElementsBaseVertexEXTContextANGLE
GL_DrawElementsBaseVertexOES
GL_DrawElementsBaseVertexOESContextANGLE
GL_DrawElementsContextANGLE
GL_DrawElementsIndirect
GL_DrawElementsIndirectContextANGLE
GL_DrawElementsInstanced
GL_DrawElementsInstancedANGLE
GL_DrawElementsInstancedANGLEContextANGLE
GL_DrawElementsInstancedBaseVertex
GL_DrawElementsInstancedBaseVertexBaseInstanceANGLE
GL_DrawElementsInstancedBaseVertexBaseInstanceANGLEContextANGLE
GL_DrawElementsInstancedBaseVertexContextANGLE
GL_DrawElementsInstancedBaseVertexEXT
GL_DrawElementsInstancedBaseVertexEXTContextANGLE
GL_DrawElementsInstancedBaseVertexOES
GL_DrawElementsInstancedBaseVertexOESContextANGLE
GL_DrawElementsInstancedContextANGLE
GL_DrawElementsInstancedEXT
GL_DrawElementsInstancedEXTContextANGLE
GL_DrawRangeElements
GL_DrawRangeElementsBaseVertex
GL_DrawRangeElementsBaseVertexContextANGLE
GL_DrawRangeElementsBaseVertexEXT
GL_DrawRangeElementsBaseVertexEXTContextANGLE
GL_DrawRangeElementsBaseVertexOES
GL_DrawRangeElementsBaseVertexOESContextANGLE
GL_DrawRangeElementsContextANGLE
GL_DrawTexfOES
GL_DrawTexfOESContextANGLE
GL_DrawTexfvOES
GL_DrawTexfvOESContextANGLE
GL_DrawTexiOES
GL_DrawTexiOESContextANGLE
GL_DrawTexivOES
GL_DrawTexivOESContextANGLE
GL_DrawTexsOES
GL_DrawTexsOESContextANGLE
GL_DrawTexsvOES
GL_DrawTexsvOESContextANGLE
GL_DrawTexxOES
GL_DrawTexxOESContextANGLE
GL_DrawTexxvOES
GL_DrawTexxvOESContextANGLE
GL_EGLImageTargetRenderbufferStorageOES
GL_EGLImageTargetRenderbufferStorageOESContextANGLE
GL_EGLImageTargetTexture2DOES
GL_EGLImageTargetTexture2DOESContextANGLE
GL_Enable
GL_EnableClientState
GL_EnableClientStateContextANGLE
GL_EnableContextANGLE
GL_EnableVertexAttribArray
GL_EnableVertexAttribArrayContextANGLE
GL_Enablei
GL_EnableiContextANGLE
GL_EnableiEXT
GL_EnableiEXTContextANGLE
GL_EnableiOES
GL_EnableiOESContextANGLE
GL_EndQuery
GL_EndQueryContextANGLE
GL_EndQueryEXT
GL_EndQueryEXTContextANGLE
GL_EndTransformFeedback
GL_EndTransformFeedbackContextANGLE
GL_FenceSync
GL_FenceSyncContextANGLE

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 7596

Password: 7596

Password: 7596

Password: 7596

5db31f8d618577020d42520c53016c91

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87Certificate

Extended Key Usages

Key Usages

f5:6d:38:a7:17:be:18:90:a3:ee:c4:e7:63:79:cb:46:b9:1c:78:22Signer

Signature Validations

Verification

13/10/2016, 00:18 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msi

psapi

shlwapi

shell32

winhttp

kernel32

user32

advapi32

ole32

oleaut32

crypt32

wintrust

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 310KB - Virtual size: 310KB

.data Size: 18KB - Virtual size: 26KB

.gfids Size: 1024B - Virtual size: 548B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 56KB - Virtual size: 56KB

Password: 7596

fa2ad815abcab4fbe648e96fbfa29228

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87Certificate

Extended Key Usages

Key Usages

48:ad:ab:eb:33:86:63:fd:77:75:23:96:be:99:0b:f1:0d:fb:c6:99Signer

Signature Validations

Verification

13/10/2016, 00:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

f5:6d:38:a7:17:be:18:90:a3:ee:c4:e7:63:79:cb:46:b9:1c:78:22
Signer

13/10/2016, 00:18
Valid: false

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 310KB - Virtual size: 310KB

.data
Size: 18KB - Virtual size: 26KB

.gfids
Size: 1024B - Virtual size: 548B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 56KB - Virtual size: 56KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

48:ad:ab:eb:33:86:63:fd:77:75:23:96:be:99:0b:f1:0d:fb:c6:99
Signer

13/10/2016, 00:20
Valid: false

.text
Size: 254KB - Virtual size: 253KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 3KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 340B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

d1:56:b8:b1:ec:ec:1a:8a:db:41:e9:1a:77:7e:a1:43:52:de:06:84
Signer

13/10/2016, 00:24
Valid: false

.text
Size: 854KB - Virtual size: 853KB

.rdata
Size: 174KB - Virtual size: 174KB

.data
Size: 15KB - Virtual size: 36KB

.gfids
Size: 1024B - Virtual size: 668B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 37KB - Virtual size: 36KB