Extracted

• 80b9c5ec798e7bbd71bbdfffab11653f36a7a30e51de3a72c5213eafe65965d9

  .dll windows x86

  85eed0ce4d44060adbf6f3c6ab6c2b5d

  
  

  Code Sign

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01/01/2004, 00:00

  Not After

  31/12/2028, 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25/05/2021, 00:00

  Not After

  31/12/2028, 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01/08/2022, 00:00

  Not After

  09/11/2031, 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22/03/2021, 00:00

  Not After

  21/03/2036, 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  07/10/2022, 00:00

  Not After

  07/10/2023, 23:59

  Subject

  CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23/03/2022, 00:00

  Not After

  22/03/2037, 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21/09/2022, 00:00

  Not After

  21/11/2033, 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  cf:59:df:f3:44:92:e0:1d:bf:dc:09:7c:4b:1e:af:12:03:1d:14:8b

  Signer

  Actual PE Digest

  cf:59:df:f3:44:92:e0:1d:bf:dc:09:7c:4b:1e:af:12:03:1d:14:8b

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU

  17/11/2022, 18:36

  Valid: true

  Chain 1

  CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVolumeInformationW

  GetOEMCP

  WriteProcessMemory

  HeapCreate

  EraseTape

  EnterCriticalSection

  GetCommandLineW

  EnumCalendarInfoExEx

  IsDBCSLeadByteEx

  GetCurrentProcess

  CreateWaitableTimerW

  RegisterWaitForSingleObject

  GetModuleHandleExW

  GetShortPathNameW

  OutputDebugStringA

  VirtualAlloc

  GetNumberOfConsoleMouseButtons

  GetConsoleAliasesLengthA

  GetGeoInfoW

  GetDynamicTimeZoneInformation

  GetFullPathNameA

  GetEnvironmentVariableW

  FlushProcessWriteBuffers

  CreateMutexW

  CreateHardLinkW

  DecodeSystemPointer

  GetVolumeInformationA

  WaitForSingleObject

  CreateBoundaryDescriptorA

  CreateFileW

  GetFileAttributesW

  GlobalDeleteAtom

  GetAtomNameW

  GetACP

  RtlCaptureStackBackTrace

  OpenProcess

  FindFirstVolumeMountPointA

  EnumResourceLanguagesExA

  GetDurationFormat

  GetLastError

  RemoveDirectoryTransactedA

  OutputDebugStringW

  DisableThreadLibraryCalls

  GetSystemDirectoryA

  GetTapeParameters

  ClearCommBreak

  GetFullPathNameTransactedW

  GlobalFlags

  DeleteFileA

  DeleteFileW

  GetCPInfoExW

  CreateThread

  DeleteProcThreadAttributeList

  VirtualProtectEx

  UnlockFile

  GetProcAddress

  LocalFree

  NeedCurrentDirectoryForExePathA

  SleepConditionVariableSRW

  GetComputerNameExA

  GetPrivateProfileIntA

  lstrcmpiW

  GetSystemPreferredUILanguages

  GetConsoleOriginalTitleA

  WriteConsoleOutputW

  GetProcessHandleCount

  IsWow64Process

  ReadConsoleOutputAttribute

  WriteFile

  lstrcatA

  CreateFileA

  ReadFile

  FindFirstFileA

  GetModuleHandleA

  GetVersionExA

  GetSystemInfo

  VerSetConditionMask

  GetModuleHandleW

  VerifyVersionInfoW

  VirtualFree

  Process32First

  Process32Next

  GlobalFree

  Wow64DisableWow64FsRedirection

  Wow64RevertWow64FsRedirection

  CreateProcessW

  TlsFree

  TlsSetValue

  TlsGetValue

  DecodePointer

  EncodePointer

  WriteConsoleW

  SetFilePointerEx

  TlsAlloc

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  SetStdHandle

  HeapReAlloc

  HeapSize

  GetStringTypeW

  GetFileType

  GetStdHandle

  GetProcessHeap

  lstrcpyA

  GlobalAlloc

  lstrlenA

  lstrcpyW

  ExitProcess

  CloseHandle

  lstrcatW

  LoadLibraryA

  GetSystemWow64DirectoryW

  Sleep

  CreateToolhelp32Snapshot

  GetSystemDirectoryW

  AllocateUserPhysicalPagesNuma

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  IsValidCodePage

  FindNextFileA

  FindFirstFileExA

  FindClose

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  SetLastError

  RtlUnwind

  LCMapStringW

  HeapAlloc

  HeapFree

  WideCharToMultiByte

  MultiByteToWideChar

  GetModuleFileNameA

  LoadLibraryExW

  InterlockedFlushSList

  RaiseException

  IsProcessorFeaturePresent

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  TerminateProcess

  FreeLibrary

  user32

  CallWindowProcA

  wsprintfA

  WindowFromPoint

  EnumChildWindows

  GetClipboardOwner

  GetMenuItemID

  wsprintfW

  GetParent

  FindWindowA

  RemovePropA

  CharNextA

  CharUpperA

  advapi32

  RegDeleteValueA

  GetUserNameW

  shell32

  SHGetSpecialFolderPathA

  ShellExecuteW

  ole32

  CoCreateGuid

  CoInitializeEx

  CoInitializeSecurity

  CoCreateInstance

  CoUninitialize

  CoInitialize

  oleaut32

  VariantInit

  SysFreeString

  VariantClear

  SysAllocString

  shlwapi

  StrStrA

  StrChrA

  ws2_32

  WSAStartup

  gethostbyname

  socket

  send

  recv

  WSACleanup

  htons

  connect

  closesocket

  netapi32

  NetApiBufferFree

  NetWkstaGetInfo

  Exports

  Exports

  ChkdskExs

  Sections

  .text

  Size: 232KB - Virtual size: 231KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 288B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ