General

Malware Config

Signatures

Files

• CRM_chat.zip

  .zip
• CRM_chat/CRM_chat_laucnher.exe

  .exe windows x64

  4cea7ae85c87ddc7295d39ff9cda31d1

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  08:a2:ec:4e:78:a0:9e:17:4b:19:2e:55:35:98:4b:59

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  03-07-2019 00:00

  Not After

  20-08-2021 12:00

  Subject

  CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:36:ab:08:05:ba:94:50:22:0f:86:5c:58:91:8f:52

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-05-2020 00:00

  Not After

  20-05-2022 12:00

  Subject

  SERIALNUMBER=5430750,CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  72:56:41:5f:c1:52:e9:a7:0c:21:5a:3a:d8:a2:a8:d3:ab:5a:dc:f4:7e:bc:e3:e7:17:59:87:96:71:8c:ff:ae

  Signer

  Actual PE Digest

  72:56:41:5f:c1:52:e9:a7:0c:21:5a:3a:d8:a2:a8:d3:ab:5a:dc:f4:7e:bc:e3:e7:17:59:87:96:71:8c:ff:ae

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=5430750,CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  15-02-2021 11:14

  Valid: true

  Chain 1

  SERIALNUMBER=5430750,CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  e7:0d:c4:88:8c:91:c2:eb:66:3d:5f:14:58:fe:d7:1e:f2:38:d5:43

  Signer

  Actual PE Digest

  e7:0d:c4:88:8c:91:c2:eb:66:3d:5f:14:58:fe:d7:1e:f2:38:d5:43

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US

  15-02-2021 11:13

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  GetTokenInformation

  RegDeleteValueA

  RegOpenKeyExA

  RegQueryInfoKeyA

  FreeSid

  OpenProcessToken

  RegSetValueExA

  RegCreateKeyExA

  LookupPrivilegeValueA

  AllocateAndInitializeSid

  RegQueryValueExA

  EqualSid

  RegCloseKey

  AdjustTokenPrivileges

  kernel32

  _lopen

  _llseek

  CompareStringA

  GetLastError

  GetFileAttributesA

  GetSystemDirectoryA

  LoadLibraryA

  DeleteFileA

  GlobalAlloc

  GlobalFree

  CloseHandle

  WritePrivateProfileStringA

  IsDBCSLeadByte

  GetWindowsDirectoryA

  SetFileAttributesA

  GetProcAddress

  GlobalLock

  LocalFree

  RemoveDirectoryA

  FreeLibrary

  _lclose

  CreateDirectoryA

  GetPrivateProfileIntA

  GetPrivateProfileStringA

  GlobalUnlock

  ReadFile

  SizeofResource

  WriteFile

  GetDriveTypeA

  LoadLibraryExA

  SetFileTime

  SetFilePointer

  FindResourceA

  CreateMutexA

  GetVolumeInformationA

  WaitForSingleObject

  GetCurrentDirectoryA

  FreeResource

  GetVersion

  SetCurrentDirectoryA

  GetTempPathA

  LocalFileTimeToFileTime

  CreateFileA

  SetEvent

  TerminateThread

  GetVersionExA

  LockResource

  GetSystemInfo

  CreateThread

  ResetEvent

  LoadResource

  ExitProcess

  GetModuleHandleW

  CreateProcessA

  FormatMessageA

  GetTempFileNameA

  DosDateTimeToFileTime

  CreateEventA

  GetExitCodeProcess

  ExpandEnvironmentStringsA

  LocalAlloc

  lstrcmpA

  FindNextFileA

  GetCurrentProcess

  FindFirstFileA

  GetModuleFileNameA

  GetShortPathNameA

  Sleep

  GetStartupInfoW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  GetTickCount

  EnumResourceLanguagesA

  GetDiskFreeSpaceA

  MulDiv

  FindClose

  gdi32

  GetDeviceCaps

  user32

  ShowWindow

  MsgWaitForMultipleObjects

  SetWindowPos

  GetDC

  GetWindowRect

  DispatchMessageA

  GetSystemMetrics

  CallWindowProcA

  SetWindowTextA

  MessageBoxA

  SendDlgItemMessageA

  SendMessageA

  GetDlgItem

  DialogBoxIndirectParamA

  GetWindowLongPtrA

  SetWindowLongPtrA

  SetForegroundWindow

  ReleaseDC

  EnableWindow

  CharNextA

  LoadStringA

  CharPrevA

  EndDialog

  MessageBeep

  ExitWindowsEx

  SetDlgItemTextA

  CharUpperA

  GetDesktopWindow

  PeekMessageA

  GetDlgItemTextA

  msvcrt

  ?terminate@@YAXXZ

  _commode

  _fmode

  _acmdln

  __C_specific_handler

  memset

  __setusermatherr

  _ismbblead

  _cexit

  _exit

  exit

  __set_app_type

  __getmainargs

  _amsg_exit

  _XcptFilter

  memcpy_s

  _vsnprintf

  _initterm

  memcpy

  comctl32

  ord17

  cabinet

  ord20

  ord21

  ord23

  ord22

  version

  VerQueryValueA

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  Sections

  .text

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 605KB - Virtual size: 608KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/docs/defaults.xml.example

  .xml
• CRM_chat/libgcc_s_seh-1.dll

  .dll windows x64

  dba1138574ae4813ca81835aae76e6cd

  
  

  Code Sign

  31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  18-02-2022 00:00

  Not After

  17-02-2025 23:59

  Subject

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  30-08-2022 00:00

  Not After

  29-08-2023 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  8e:10:a6:12:01:65:a3:86:52:e0:ed:90:3d:98:36:60:5f:9a:dc:6b:89:e2:be:9f:1d:00:71:e7:c7:2d:3a:5f

  Signer

  Actual PE Digest

  8e:10:a6:12:01:65:a3:86:52:e0:ed:90:3d:98:36:60:5f:9a:dc:6b:89:e2:be:9f:1d:00:71:e7:c7:2d:3a:5f

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  19-09-2022 09:20

  Valid: true

  Chain 1

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CloseHandle

  CreateSemaphoreW

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentThreadId

  GetLastError

  InitializeCriticalSection

  LeaveCriticalSection

  RaiseException

  ReleaseSemaphore

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlUnwindEx

  RtlVirtualUnwind

  SetLastError

  Sleep

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  VirtualProtect

  VirtualQuery

  WaitForSingleObject

  msvcrt

  __iob_func

  _amsg_exit

  _initterm

  _lock

  _unlock

  abort

  calloc

  free

  fwrite

  malloc

  memcpy

  memset

  realloc

  strlen

  strncmp

  vfprintf

  Exports

  Exports

  _GCC_specific_handler

  _Unwind_Backtrace

  _Unwind_DeleteException

  _Unwind_FindEnclosingFunction

  _Unwind_ForcedUnwind

  _Unwind_GetCFA

  _Unwind_GetDataRelBase

  _Unwind_GetGR

  _Unwind_GetIP

  _Unwind_GetIPInfo

  _Unwind_GetLanguageSpecificData

  _Unwind_GetRegionStart

  _Unwind_GetTextRelBase

  _Unwind_RaiseException

  _Unwind_Resume

  _Unwind_Resume_or_Rethrow

  _Unwind_SetGR

  _Unwind_SetIP

  __absvdi2

  __absvsi2

  __absvti2

  __addtf3

  __addvdi3

  __addvsi3

  __addvti3

  __ashlti3

  __ashrti3

  __bswapdi2

  __bswapsi2

  __clear_cache

  __clrsbdi2

  __clrsbti2

  __clzdi2

  __clzti2

  __cmpti2

  __ctzdi2

  __ctzti2

  __divdc3

  __divmodti4

  __divsc3

  __divtc3

  __divtf3

  __divti3

  __divxc3

  __emutls_get_address

  __emutls_register_common

  __enable_execute_stack

  __eqtf2

  __extenddftf2

  __extendsftf2

  __extendxftf2

  __ffsdi2

  __ffsti2

  __fixdfti

  __fixsfti

  __fixtfdi

  __fixtfsi

  __fixtfti

  __fixunsdfdi

  __fixunsdfti

  __fixunssfdi

  __fixunssfti

  __fixunstfdi

  __fixunstfsi

  __fixunstfti

  __fixunsxfdi

  __fixunsxfti

  __fixxfti

  __floatditf

  __floatsitf

  __floattidf

  __floattisf

  __floattitf

  __floattixf

  __floatunditf

  __floatunsitf

  __floatuntidf

  __floatuntisf

  __floatuntitf

  __floatuntixf

  __gcc_personality_seh0

  __getf2

  __gttf2

  __letf2

  __lshrti3

  __lttf2

  __modti3

  __muldc3

  __mulsc3

  __multc3

  __multf3

  __multi3

  __mulvdi3

  __mulvsi3

  __mulvti3

  __mulxc3

  __negtf2

  __negti2

  __negvdi2

  __negvsi2

  __negvti2

  __netf2

  __paritydi2

  __parityti2

  __popcountdi2

  __popcountti2

  __powidf2

  __powisf2

  __powitf2

  __powixf2

  __subtf3

  __subvdi3

  __subvsi3

  __subvti3

  __trunctfdf2

  __trunctfsf2

  __trunctfxf2

  __ucmpti2

  __udivmodti4

  __udivti3

  __umodti3

  __unordtf2

  Sections

  .text

  Size: 58KB - Virtual size: 58KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 304B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 96B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/libgmp-10.dll

  .dll windows x64

  50d3e0798b0b3d30fc332b48dda65861

  
  

  Code Sign

  31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  18-02-2022 00:00

  Not After

  17-02-2025 23:59

  Subject

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  30-08-2022 00:00

  Not After

  29-08-2023 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  93:8f:a8:f6:fa:33:15:d7:f9:f4:a9:a5:53:fd:8a:d8:79:97:c5:95:85:5d:35:a5:28:92:5a:81:2e:1a:19:15

  Signer

  Actual PE Digest

  93:8f:a8:f6:fa:33:15:d7:f9:f4:a9:a5:53:fd:8a:d8:79:97:c5:95:85:5d:35:a5:28:92:5a:81:2e:1a:19:15

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  19-09-2022 09:20

  Valid: true

  Chain 1

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  MultiByteToWideChar

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  msvcrt

  ___lc_codepage_func

  ___mb_cur_max_func

  __iob_func

  _amsg_exit

  _errno

  _initterm

  _lock

  _unlock

  abort

  calloc

  ferror

  fgetc

  fputc

  fread

  free

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcpy

  memmove

  memset

  putc

  raise

  realloc

  strchr

  strerror

  strlen

  strncmp

  strstr

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  wcslen

  Exports

  Exports

  __gmp_0

  __gmp_allocate_func

  __gmp_asprintf

  __gmp_asprintf_final

  __gmp_asprintf_funs

  __gmp_asprintf_memory

  __gmp_asprintf_reps

  __gmp_assert_fail

  __gmp_assert_header

  __gmp_binvert_limb_table

  __gmp_bits_per_limb

  __gmp_default_allocate

  __gmp_default_fp_limb_precision

  __gmp_default_free

  __gmp_default_reallocate

  __gmp_digit_value_tab

  __gmp_divide_by_zero

  __gmp_doprnt

  __gmp_doprnt_integer

  __gmp_doprnt_mpf2

  __gmp_doscan

  __gmp_errno

  __gmp_exception

  __gmp_extract_double

  __gmp_fac2cnt_table

  __gmp_fib_table

  __gmp_fprintf

  __gmp_fprintf_funs

  __gmp_free_func

  __gmp_fscanf

  __gmp_fscanf_funs

  __gmp_get_memory_functions

  __gmp_init_primesieve

  __gmp_invalid_operation

  __gmp_jacobi_table

  __gmp_junk

  __gmp_limbroots_table

  __gmp_mt_recalc_buffer

  __gmp_nextprime

  __gmp_odd2fac_table

  __gmp_oddfac_table

  __gmp_primesieve

  __gmp_printf

  __gmp_randclear

  __gmp_randclear_mt

  __gmp_randget_mt

  __gmp_randinit

  __gmp_randinit_default

  __gmp_randinit_lc_2exp

  __gmp_randinit_lc_2exp_size

  __gmp_randinit_mt

  __gmp_randinit_mt_noseed

  __gmp_randinit_set

  __gmp_randiset_mt

  __gmp_rands

  __gmp_rands_initialized

  __gmp_randseed

  __gmp_randseed_ui

  __gmp_reallocate_func

  __gmp_scanf

  __gmp_set_memory_functions

  __gmp_snprintf

  __gmp_snprintf_funs

  __gmp_sprintf

  __gmp_sprintf_funs

  __gmp_sqrt_of_negative

  __gmp_sscanf

  __gmp_sscanf_funs

  __gmp_tmp_reentrant_alloc

  __gmp_tmp_reentrant_free

  __gmp_urandomb_ui

  __gmp_urandomm_ui

  __gmp_vasprintf

  __gmp_version

  __gmp_vfprintf

  __gmp_vfscanf

  __gmp_vprintf

  __gmp_vscanf

  __gmp_vsnprintf

  __gmp_vsprintf

  __gmp_vsscanf

  __gmpf_abs

  __gmpf_add

  __gmpf_add_ui

  __gmpf_ceil

  __gmpf_clear

  __gmpf_clears

  __gmpf_cmp

  __gmpf_cmp_d

  __gmpf_cmp_si

  __gmpf_cmp_ui

  __gmpf_cmp_z

  __gmpf_div

  __gmpf_div_2exp

  __gmpf_div_ui

  __gmpf_dump

  __gmpf_eq

  __gmpf_fits_sint_p

  __gmpf_fits_slong_p

  __gmpf_fits_sshort_p

  __gmpf_fits_uint_p

  __gmpf_fits_ulong_p

  __gmpf_fits_ushort_p

  __gmpf_floor

  __gmpf_get_d

  __gmpf_get_d_2exp

  __gmpf_get_default_prec

  __gmpf_get_prec

  __gmpf_get_si

  __gmpf_get_str

  __gmpf_get_ui

  __gmpf_init

  __gmpf_init2

  __gmpf_init_set

  __gmpf_init_set_d

  __gmpf_init_set_si

  __gmpf_init_set_str

  __gmpf_init_set_ui

  __gmpf_inits

  __gmpf_inp_str

  __gmpf_integer_p

  __gmpf_mul

  __gmpf_mul_2exp

  __gmpf_mul_ui

  __gmpf_neg

  __gmpf_out_str

  __gmpf_pow_ui

  __gmpf_random2

  __gmpf_reldiff

  __gmpf_set

  __gmpf_set_d

  __gmpf_set_default_prec

  __gmpf_set_prec

  __gmpf_set_prec_raw

  __gmpf_set_q

  __gmpf_set_si

  __gmpf_set_str

  __gmpf_set_ui

  __gmpf_set_z

  __gmpf_size

  __gmpf_sqrt

  __gmpf_sqrt_ui

  __gmpf_sub

  __gmpf_sub_ui

  __gmpf_swap

  __gmpf_trunc

  __gmpf_ui_div

  __gmpf_ui_sub

  __gmpf_urandomb

  __gmpn_add

  __gmpn_add_1

  __gmpn_add_err1_n

  __gmpn_add_err2_n

  __gmpn_add_err3_n

  __gmpn_add_n

  __gmpn_add_n_atom

  __gmpn_add_n_bd1

  __gmpn_add_n_bt1

  __gmpn_add_n_core2

  __gmpn_add_n_coreihwl

  __gmpn_add_n_coreisbr

  __gmpn_add_n_goldmont

  __gmpn_add_n_init

  __gmpn_add_n_pentium4

  __gmpn_add_n_silvermont

  __gmpn_add_n_sub_n

  __gmpn_add_n_x86_64

  __gmpn_add_nc_atom

  __gmpn_add_nc_bd1

  __gmpn_add_nc_bt1

  __gmpn_add_nc_core2

  __gmpn_add_nc_coreihwl

  __gmpn_add_nc_coreisbr

  __gmpn_add_nc_goldmont

  __gmpn_add_nc_pentium4

  __gmpn_add_nc_silvermont

  __gmpn_add_nc_x86_64

  __gmpn_addlsh1_n

  __gmpn_addlsh1_n_atom

  __gmpn_addlsh1_n_bd1

  __gmpn_addlsh1_n_core2

  __gmpn_addlsh1_n_coreisbr

  __gmpn_addlsh1_n_init

  __gmpn_addlsh1_n_pentium4

  __gmpn_addlsh1_n_silvermont

  __gmpn_addlsh1_n_x86_64

  __gmpn_addlsh1_n_zen

  __gmpn_addlsh1_nc_atom

  __gmpn_addlsh1_nc_bd1

  __gmpn_addlsh1_nc_coreisbr

  __gmpn_addlsh1_nc_zen

  __gmpn_addlsh2_n

  __gmpn_addlsh2_n_atom

  __gmpn_addlsh2_n_core2

  __gmpn_addlsh2_n_coreisbr

  __gmpn_addlsh2_n_init

  __gmpn_addlsh2_n_pentium4

  __gmpn_addlsh2_n_silvermont

  __gmpn_addlsh2_n_x86_64

  __gmpn_addlsh2_nc_coreisbr

  __gmpn_addlsh_n

  __gmpn_addmul_1

  __gmpn_addmul_1_atom

  __gmpn_addmul_1_bd1

  __gmpn_addmul_1_bt1

  __gmpn_addmul_1_core2

  __gmpn_addmul_1_coreibwl

  __gmpn_addmul_1_coreihwl

  __gmpn_addmul_1_coreinhm

  __gmpn_addmul_1_coreisbr

  __gmpn_addmul_1_goldmont

  __gmpn_addmul_1_init

  __gmpn_addmul_1_pentium4

  __gmpn_addmul_1_silvermont

  __gmpn_addmul_1_x86_64

  __gmpn_addmul_1_zen

  __gmpn_addmul_1c_core2

  __gmpn_addmul_1c_silvermont

  __gmpn_addmul_2

  __gmpn_addmul_2_atom

  __gmpn_addmul_2_bd1

  __gmpn_addmul_2_coreihwl

  __gmpn_addmul_2_coreisbr

  __gmpn_addmul_2_fat

  __gmpn_addmul_2_init

  __gmpn_addmul_2_k8

  __gmpn_addmul_2_pentium4

  __gmpn_and_n

  __gmpn_andn_n

  __gmpn_bases

  __gmpn_bc_mulmod_bnm1

  __gmpn_bc_set_str

  __gmpn_bdiv_dbm1c

  __gmpn_bdiv_dbm1c_init

  __gmpn_bdiv_dbm1c_x86_64

  __gmpn_bdiv_q

  __gmpn_bdiv_q_1

  __gmpn_bdiv_q_itch

  __gmpn_bdiv_qr

  __gmpn_bdiv_qr_itch

  __gmpn_binvert

  __gmpn_binvert_itch

  __gmpn_broot

  __gmpn_broot_invm1

  __gmpn_brootinv

  __gmpn_bsqrt

  __gmpn_bsqrtinv

  __gmpn_cmp

  __gmpn_cnd_add_n

  __gmpn_cnd_add_n_atom

  __gmpn_cnd_add_n_coreisbr

  __gmpn_cnd_add_n_init

  __gmpn_cnd_add_n_x86_64

  __gmpn_cnd_sub_n

  __gmpn_cnd_sub_n_atom

  __gmpn_cnd_sub_n_coreisbr

  __gmpn_cnd_sub_n_init

  __gmpn_cnd_sub_n_x86_64

  __gmpn_cnd_swap

  __gmpn_com

  __gmpn_com_atom

  __gmpn_com_bd1

  __gmpn_com_bt2

  __gmpn_com_core2

  __gmpn_com_init

  __gmpn_com_x86_64

  __gmpn_com_zen

  __gmpn_compute_powtab

  __gmpn_copyd

  __gmpn_copyd_atom

  __gmpn_copyd_bd1

  __gmpn_copyd_bt1

  __gmpn_copyd_bt2

  __gmpn_copyd_core2

  __gmpn_copyd_init

  __gmpn_copyd_nano

  __gmpn_copyd_x86_64

  __gmpn_copyd_zen

  __gmpn_copyi

  __gmpn_copyi_atom

  __gmpn_copyi_bd1

  __gmpn_copyi_bt1

  __gmpn_copyi_bt2

  __gmpn_copyi_core2

  __gmpn_copyi_init

  __gmpn_copyi_nano

  __gmpn_copyi_x86_64

  __gmpn_copyi_zen

  __gmpn_cpuid

  __gmpn_cpuvec

  __gmpn_cpuvec_init

  __gmpn_cpuvec_initialized

  __gmpn_dc_set_str

  __gmpn_dcpi1_bdiv_q

  __gmpn_dcpi1_bdiv_qr

  __gmpn_dcpi1_bdiv_qr_n

  __gmpn_dcpi1_bdiv_qr_n_itch

  __gmpn_dcpi1_div_q

  __gmpn_dcpi1_div_qr

  __gmpn_dcpi1_div_qr_n

  __gmpn_dcpi1_divappr_q

  __gmpn_div_q

  __gmpn_div_qr_1

  __gmpn_div_qr_1n_pi1

  __gmpn_div_qr_2

  __gmpn_div_qr_2n_pi1

  __gmpn_div_qr_2u_pi1

  __gmpn_divexact

  __gmpn_divexact_1

  __gmpn_divexact_1_atom

  __gmpn_divexact_1_init

  __gmpn_divexact_1_nano

  __gmpn_divexact_1_x86_64

  __gmpn_divexact_by3

  __gmpn_divexact_by3c

  __gmpn_divisible_p

  __gmpn_divmod_1

  __gmpn_divrem

  __gmpn_divrem_1

  __gmpn_divrem_1_core2

  __gmpn_divrem_1_coreisbr

  __gmpn_divrem_1_init

  __gmpn_divrem_1_x86_64

  __gmpn_divrem_2

  __gmpn_dump

  __gmpn_fft_best_k

  __gmpn_fft_next_size

  __gmpn_fib2_ui

  __gmpn_fib2m

  __gmpn_gcd

  __gmpn_gcd_1

  __gmpn_gcd_11

  __gmpn_gcd_11_bd1

  __gmpn_gcd_11_bt1

  __gmpn_gcd_11_bt2

  __gmpn_gcd_11_core2

  __gmpn_gcd_11_coreisbr

  __gmpn_gcd_11_init

  __gmpn_gcd_11_k10

  __gmpn_gcd_11_nano

  __gmpn_gcd_11_x86_64

  __gmpn_gcd_11_zen

  __gmpn_gcd_22

  __gmpn_gcd_subdiv_step

  __gmpn_gcdext

  __gmpn_gcdext_1

  __gmpn_gcdext_hook

  __gmpn_gcdext_lehmer_n

  __gmpn_get_d

  __gmpn_get_str

  __gmpn_hamdist

  __gmpn_hgcd

  __gmpn_hgcd2

  __gmpn_hgcd2_jacobi

  __gmpn_hgcd_appr

  __gmpn_hgcd_appr_itch

  __gmpn_hgcd_itch

  __gmpn_hgcd_jacobi

  __gmpn_hgcd_matrix_adjust

  __gmpn_hgcd_matrix_init

  __gmpn_hgcd_matrix_mul

  __gmpn_hgcd_matrix_mul_1

  __gmpn_hgcd_matrix_update_q

  __gmpn_hgcd_mul_matrix1_vector

  __gmpn_hgcd_reduce

  __gmpn_hgcd_reduce_itch

  __gmpn_hgcd_step

  __gmpn_invert

  __gmpn_invert_limb

  __gmpn_invert_limb_table

  __gmpn_invertappr

  __gmpn_ior_n

  __gmpn_iorn_n

  __gmpn_jacobi_2

  __gmpn_jacobi_base

  __gmpn_jacobi_n

  __gmpn_lshift

  __gmpn_lshift_atom

  __gmpn_lshift_core2

  __gmpn_lshift_coreisbr

  __gmpn_lshift_init

  __gmpn_lshift_k10

  __gmpn_lshift_pentium4

  __gmpn_lshift_silvermont

  __gmpn_lshift_x86_64

  __gmpn_lshift_zen

  __gmpn_lshiftc

  __gmpn_lshiftc_atom

  __gmpn_lshiftc_core2

  __gmpn_lshiftc_coreisbr

  __gmpn_lshiftc_init

  __gmpn_lshiftc_k10

  __gmpn_lshiftc_pentium4

  __gmpn_lshiftc_silvermont

  __gmpn_lshiftc_x86_64

  __gmpn_lshiftc_zen

  __gmpn_matrix22_mul

  __gmpn_matrix22_mul1_inverse_vector

  __gmpn_matrix22_mul_itch

  __gmpn_mod_1

  __gmpn_mod_1_1p

  __gmpn_mod_1_1p_cps

  __gmpn_mod_1_1p_cps_init

  __gmpn_mod_1_1p_cps_x86_64

  __gmpn_mod_1_1p_init

  __gmpn_mod_1_1p_x86_64

  __gmpn_mod_1_fat

  __gmpn_mod_1_init

  __gmpn_mod_1s_2p

  __gmpn_mod_1s_2p_cps

  __gmpn_mod_1s_2p_cps_init

  __gmpn_mod_1s_2p_cps_x86_64

  __gmpn_mod_1s_2p_init

  __gmpn_mod_1s_2p_x86_64

  __gmpn_mod_1s_3p

  __gmpn_mod_1s_3p_cps

  __gmpn_mod_1s_4p

  __gmpn_mod_1s_4p_cps

  __gmpn_mod_1s_4p_cps_init

  __gmpn_mod_1s_4p_cps_x86_64

  __gmpn_mod_1s_4p_init

  __gmpn_mod_1s_4p_x86_64

  __gmpn_mod_34lsub1

  __gmpn_mod_34lsub1_init

  __gmpn_mod_34lsub1_pentium4

  __gmpn_mod_34lsub1_x86_64

  __gmpn_modexact_1_odd_x86_64

  __gmpn_modexact_1c_odd

  __gmpn_modexact_1c_odd_init

  __gmpn_modexact_1c_odd_x86_64

  __gmpn_mu_bdiv_q

  __gmpn_mu_bdiv_q_itch

  __gmpn_mu_bdiv_qr

  __gmpn_mu_bdiv_qr_itch

  __gmpn_mu_div_q

  __gmpn_mu_div_q_itch

  __gmpn_mu_div_qr

  __gmpn_mu_div_qr_itch

  __gmpn_mu_divappr_q

  __gmpn_mu_divappr_q_itch

  __gmpn_mul

  __gmpn_mul_1

  __gmpn_mul_1_atom

  __gmpn_mul_1_bd1

  __gmpn_mul_1_bt1

  __gmpn_mul_1_coreihwl

  __gmpn_mul_1_coreisbr

  __gmpn_mul_1_goldmont

  __gmpn_mul_1_init

  __gmpn_mul_1_pentium4

  __gmpn_mul_1_silvermont

  __gmpn_mul_1_x86_64

  __gmpn_mul_1_zen

  __gmpn_mul_1c_atom

  __gmpn_mul_1c_bd1

  __gmpn_mul_1c_bt1

  __gmpn_mul_1c_coreisbr

  __gmpn_mul_1c_goldmont

  __gmpn_mul_1c_pentium4

  __gmpn_mul_1c_silvermont

  __gmpn_mul_1c_x86_64

  __gmpn_mul_1c_zen

  __gmpn_mul_2

  __gmpn_mul_basecase

  __gmpn_mul_basecase_bd1

  __gmpn_mul_basecase_bt1

  __gmpn_mul_basecase_core2

  __gmpn_mul_basecase_coreibwl

  __gmpn_mul_basecase_coreihwl

  __gmpn_mul_basecase_coreisbr

  __gmpn_mul_basecase_fat

  __gmpn_mul_basecase_init

  __gmpn_mul_basecase_k8

  __gmpn_mul_basecase_pentium4

  __gmpn_mul_basecase_silvermont

  __gmpn_mul_basecase_zen

  __gmpn_mul_fft

  __gmpn_mul_n

  __gmpn_mullo_basecase

  __gmpn_mullo_basecase_core2

  __gmpn_mullo_basecase_coreibwl

  __gmpn_mullo_basecase_coreihwl

  __gmpn_mullo_basecase_coreisbr

  __gmpn_mullo_basecase_fat

  __gmpn_mullo_basecase_init

  __gmpn_mullo_basecase_k8

  __gmpn_mullo_basecase_pentium4

  __gmpn_mullo_basecase_silvermont

  __gmpn_mullo_basecase_zen

  __gmpn_mullo_n

  __gmpn_mulmid

  __gmpn_mulmid_basecase

  __gmpn_mulmid_n

  __gmpn_mulmod_bnm1

  __gmpn_mulmod_bnm1_next_size

  __gmpn_nand_n

  __gmpn_neg

  __gmpn_ni_invertappr

  __gmpn_nior_n

  __gmpn_nussbaumer_mul

  Sections

  .text

  Size: 501KB - Virtual size: 501KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 624B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 58KB - Virtual size: 57KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 3KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 496B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/libgnutls-30.dll

  .dll windows x64

  291bf80a623dd34eb1c465735dd3467f

  
  

  Code Sign

  31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  18-02-2022 00:00

  Not After

  17-02-2025 23:59

  Subject

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  30-08-2022 00:00

  Not After

  29-08-2023 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  51:4d:d8:01:b2:24:df:30:35:bb:5d:dd:61:b6:28:2a:dc:1a:30:5b:05:87:bd:ab:76:dc:44:b0:5d:e9:8f:09

  Signer

  Actual PE Digest

  51:4d:d8:01:b2:24:df:30:35:bb:5d:dd:61:b6:28:2a:dc:1a:30:5b:05:87:bd:ab:76:dc:44:b0:5d:e9:8f:09

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  19-09-2022 09:20

  Valid: true

  Chain 1

  CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  libgmp-10

  __gmp_get_memory_functions

  __gmp_set_memory_functions

  __gmpn_cnd_add_n

  __gmpn_copyi

  __gmpn_rshift

  __gmpn_sub_n

  __gmpn_zero

  __gmpz_add

  __gmpz_add_ui

  __gmpz_cdiv_q

  __gmpz_clear

  __gmpz_cmp

  __gmpz_cmp_ui

  __gmpz_export

  __gmpz_fdiv_q

  __gmpz_fdiv_q_2exp

  __gmpz_fdiv_r

  __gmpz_fdiv_r_2exp

  __gmpz_gcd

  __gmpz_import

  __gmpz_init

  __gmpz_init_set_str

  __gmpz_invert

  __gmpz_lcm

  __gmpz_limbs_finish

  __gmpz_limbs_read

  __gmpz_limbs_write

  __gmpz_mod

  __gmpz_mul

  __gmpz_mul_2exp

  __gmpz_mul_ui

  __gmpz_powm

  __gmpz_probab_prime_p

  __gmpz_set

  __gmpz_set_ui

  __gmpz_sizeinbase

  __gmpz_sqrt

  __gmpz_sub

  __gmpz_sub_ui

  __gmpz_tdiv_q_2exp

  __gmpz_tdiv_r_2exp

  __gmpz_tstbit

  libhogweed-6

  nettle_curve25519_mul

  nettle_curve25519_mul_g

  nettle_curve448_mul

  nettle_curve448_mul_g

  nettle_dsa_generate_params

  nettle_dsa_params_clear

  nettle_dsa_params_init

  nettle_dsa_sign

  nettle_dsa_signature_clear

  nettle_dsa_signature_init

  nettle_dsa_verify

  nettle_ecc_bit_size

  nettle_ecc_point_clear

  nettle_ecc_point_get

  nettle_ecc_point_init

  nettle_ecc_point_mul

  nettle_ecc_point_mul_g

  nettle_ecc_point_set

  nettle_ecc_scalar_clear

  nettle_ecc_scalar_get

  nettle_ecc_scalar_init

  nettle_ecc_scalar_set

  nettle_ecc_size

  nettle_ecc_size_a

  nettle_ecdsa_generate_keypair

  nettle_ecdsa_sign

  nettle_ecdsa_verify

  nettle_ed25519_sha512_public_key

  nettle_ed25519_sha512_sign

  nettle_ed25519_sha512_verify

  nettle_ed448_shake256_public_key

  nettle_ed448_shake256_sign

  nettle_ed448_shake256_verify

  nettle_get_gost_gc256b

  nettle_get_gost_gc512a

  nettle_get_secp_192r1

  nettle_get_secp_224r1

  nettle_get_secp_256r1

  nettle_get_secp_384r1

  nettle_get_secp_521r1

  nettle_gostdsa_sign

  nettle_gostdsa_verify

  nettle_gostdsa_vko

  nettle_mpz_get_str_256

  nettle_mpz_random

  nettle_mpz_random_size

  nettle_mpz_set_str_256_s

  nettle_mpz_set_str_256_u

  nettle_mpz_sizeinbase_256_s

  nettle_mpz_sizeinbase_256_u

  nettle_pkcs1_rsa_digest_encode

  nettle_pss_encode_mgf1

  nettle_rsa_decrypt_tr

  nettle_rsa_encrypt

  nettle_rsa_generate_keypair

  nettle_rsa_pkcs1_sign_tr

  nettle_rsa_pkcs1_verify

  nettle_rsa_private_key_clear

  nettle_rsa_private_key_init

  nettle_rsa_private_key_prepare

  nettle_rsa_pss_sha256_sign_digest_tr

  nettle_rsa_pss_sha256_verify_digest

  nettle_rsa_pss_sha384_sign_digest_tr

  nettle_rsa_pss_sha384_verify_digest

  nettle_rsa_pss_sha512_sign_digest_tr

  nettle_rsa_pss_sha512_verify_digest

  nettle_rsa_public_key_clear

  nettle_rsa_public_key_init

  nettle_rsa_public_key_prepare

  nettle_rsa_sec_decrypt

  libnettle-8

  nettle_aes128_decrypt

  nettle_aes128_encrypt

  nettle_aes128_set_decrypt_key

  nettle_aes128_set_encrypt_key

  nettle_aes192_decrypt

  nettle_aes192_encrypt

  nettle_aes192_set_decrypt_key

  nettle_aes192_set_encrypt_key

  nettle_aes256_decrypt

  nettle_aes256_encrypt

  nettle_aes256_set_decrypt_key

  nettle_aes256_set_encrypt_key

  nettle_arcfour128_set_key

  nettle_arcfour_crypt

  nettle_arcfour_set_key

  nettle_arctwo40_set_key

  nettle_arctwo_decrypt

  nettle_arctwo_encrypt

  nettle_base64_decode_final

  nettle_base64_decode_init

  nettle_base64_decode_update

  nettle_base64_encode_raw

  nettle_camellia128_crypt

  nettle_camellia128_set_encrypt_key

  nettle_camellia192_set_decrypt_key

  nettle_camellia192_set_encrypt_key

  nettle_camellia256_crypt

  nettle_camellia256_set_decrypt_key

  nettle_camellia256_set_encrypt_key

  nettle_camellia_set_decrypt_key

  nettle_cbc_decrypt

  nettle_cbc_encrypt

  nettle_ccm_decrypt_message

  nettle_ccm_encrypt_message

  nettle_cfb8_decrypt

  nettle_cfb8_encrypt

  nettle_cfb_decrypt

  nettle_cfb_encrypt

  nettle_chacha_crypt

  nettle_chacha_crypt32

  nettle_chacha_poly1305_decrypt

  nettle_chacha_poly1305_digest

  nettle_chacha_poly1305_encrypt

  nettle_chacha_poly1305_set_key

  nettle_chacha_poly1305_set_nonce

  nettle_chacha_poly1305_update

  nettle_chacha_set_counter

  nettle_chacha_set_counter32

  nettle_chacha_set_key

  nettle_chacha_set_nonce

  nettle_chacha_set_nonce96

  nettle_cmac128_digest

  nettle_cmac128_init

  nettle_cmac128_set_key

  nettle_cmac128_update

  nettle_cmac64_digest

  nettle_cmac64_init

  nettle_cmac64_set_key

  nettle_cmac64_update

  nettle_cmac_aes128_digest

  nettle_cmac_aes128_set_key

  nettle_cmac_aes128_update

  nettle_cmac_aes256_digest

  nettle_cmac_aes256_set_key

  nettle_cmac_aes256_update

  nettle_ctr_crypt

  nettle_des3_decrypt

  nettle_des3_encrypt

  nettle_des3_set_key

  nettle_des_decrypt

  nettle_des_encrypt

  nettle_des_set_key

  nettle_gcm_aes128_digest

  nettle_gcm_aes128_set_iv

  nettle_gcm_aes128_set_key

  nettle_gcm_aes128_update

  nettle_gcm_aes192_digest

  nettle_gcm_aes192_set_iv

  nettle_gcm_aes192_set_key

  nettle_gcm_aes192_update

  nettle_gcm_aes256_digest

  nettle_gcm_aes256_set_iv

  nettle_gcm_aes256_set_key

  nettle_gcm_aes256_update

  nettle_gcm_camellia128_digest

  nettle_gcm_camellia128_set_iv

  nettle_gcm_camellia128_set_key

  nettle_gcm_camellia128_update

  nettle_gcm_camellia256_digest

  nettle_gcm_camellia256_set_iv

  nettle_gcm_camellia256_set_key

  nettle_gcm_camellia256_update

  nettle_gcm_decrypt

  nettle_gcm_digest

  nettle_gcm_encrypt

  nettle_gcm_set_iv

  nettle_gcm_set_key

  nettle_gcm_update

  nettle_gosthash94_init

  nettle_gosthash94cp_digest

  nettle_gosthash94cp_update

  nettle_hkdf_expand

  nettle_hkdf_extract

  nettle_hmac_digest

  nettle_hmac_gosthash94cp_digest

  nettle_hmac_gosthash94cp_set_key

  nettle_hmac_gosthash94cp_update

  nettle_hmac_md5_digest

  nettle_hmac_md5_set_key

  nettle_hmac_md5_update

  nettle_hmac_set_key

  nettle_hmac_sha1_digest

  nettle_hmac_sha1_set_key

  nettle_hmac_sha1_update

  nettle_hmac_sha224_digest

  nettle_hmac_sha224_set_key

  nettle_hmac_sha256_digest

  nettle_hmac_sha256_set_key

  nettle_hmac_sha256_update

  nettle_hmac_sha384_digest

  nettle_hmac_sha384_set_key

  nettle_hmac_sha512_digest

  nettle_hmac_sha512_set_key

  nettle_hmac_sha512_update

  nettle_hmac_streebog256_digest

  nettle_hmac_streebog256_set_key

  nettle_hmac_streebog512_digest

  nettle_hmac_streebog512_set_key

  nettle_hmac_streebog512_update

  nettle_md2_digest

  nettle_md2_init

  nettle_md2_update

  nettle_md5_digest

  nettle_md5_init

  nettle_md5_update

  nettle_memeql_sec

  nettle_memxor

  nettle_memxor3

  nettle_pbkdf2

  nettle_salsa20_256_set_key

  nettle_salsa20_crypt

  nettle_salsa20r12_crypt

  nettle_sha1_digest

  nettle_sha1_init

  nettle_sha1_update

  nettle_sha224_digest

  nettle_sha224_init

  nettle_sha256

  nettle_sha256_digest

  nettle_sha256_init

  nettle_sha256_update

  nettle_sha384

  nettle_sha384_digest

  nettle_sha384_init

  nettle_sha3_224_digest

  nettle_sha3_224_init

  nettle_sha3_224_update

  nettle_sha3_256_digest

  nettle_sha3_256_init

  nettle_sha3_256_update

  nettle_sha3_384_digest

  nettle_sha3_384_init

  nettle_sha3_384_update

  nettle_sha3_512_digest

  nettle_sha3_512_init

  nettle_sha3_512_update

  nettle_sha512

  nettle_sha512_digest

  nettle_sha512_init

  nettle_sha512_update

  nettle_siv_cmac_aes128_decrypt_message

  nettle_siv_cmac_aes128_encrypt_message

  nettle_siv_cmac_aes128_set_key

  nettle_siv_cmac_aes256_decrypt_message

  nettle_siv_cmac_aes256_encrypt_message

  nettle_siv_cmac_aes256_set_key

  nettle_streebog256_digest

  nettle_streebog256_init

  nettle_streebog512_digest

  nettle_streebog512_init

  nettle_streebog512_update

  nettle_umac128_digest

  nettle_umac128_set_key

  nettle_umac128_set_nonce

  nettle_umac128_update

  nettle_umac96_digest

  nettle_umac96_set_key

  nettle_umac96_set_nonce

  nettle_umac96_update

  nettle_xts_aes128_decrypt_message

  nettle_xts_aes128_encrypt_message

  nettle_xts_aes128_set_decrypt_key

  nettle_xts_aes128_set_encrypt_key

  nettle_xts_aes256_decrypt_message

  nettle_xts_aes256_encrypt_message

  nettle_xts_aes256_set_decrypt_key

  nettle_xts_aes256_set_encrypt_key

  zlib1

  compress

  compressBound

  uncompress

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptDecrypt

  CryptDestroyHash

  CryptGetHashParam

  CryptGetProvParam

  CryptReleaseContext

  CryptSetHashParam

  CryptSetProvParam

  CryptSignHashA

  crypt32

  CertCloseStore

  CertDeleteCertificateFromStore

  CertEnumCRLsInStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  CertOpenStore

  PFXImportCertStore

  kernel32

  CloseHandle

  CreateEventA

  CreateFileA

  DeleteCriticalSection

  DuplicateHandle

  EnterCriticalSection

  FindClose

  FindFirstFileA

  FreeLibrary

  GetCurrentProcess

  GetCurrentThreadId

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileType

  GetFinalPathNameByHandleA

  GetHandleInformation

  GetLastError

  GetProcAddress

  GetSystemTimeAsFileTime

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  PeekNamedPipe

  RtlVirtualUnwind

  SetEvent

  Sleep

  TlsGetValue

  TryEnterCriticalSection

  VirtualProtect

  VirtualQuery

  WaitForSingleObject

  WideCharToMultiByte

  msvcrt

  ___lc_codepage_func

  ___mb_cur_max_func

  __iob_func

  _amsg_exit

  _close

  _dup2

  _errno

  _fdopen

  _fileno

  _findclose

  _get_osfhandle

  _getmaxstdio

  _gmtime64

  _initterm

  _localtime64

  _lock

  _lseeki64

  _mkdir

  _open

  _open_osfhandle

  _read

  _setmaxstdio

  _setmode

  _stricmp

  _time64

  _unlock

  _wassert

  _wfindfirst64

  _wfindnext64

  _wfullpath

  abort

  atoi

  atol

  calloc

  exit

  fclose

  ferror

  fflush

  fgetpos

  fgets

  fopen

  fputc

  fread

  free

  fseek

  fwrite

  getc

  getenv

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memchr

  memcmp

  memcpy

  memmove

  memset

  qsort

  realloc

  setvbuf

  strcat

  strchr

  strcmp

  strcpy

  strerror

  strftime

  strlen

  strncat

  strncmp

  strncpy

  strpbrk

  strrchr

  strstr

  strtol

  strtoul

  vfprintf

  wcscat

  wcscpy

  wcslen

  ncrypt

  BCryptCloseAlgorithmProvider

  BCryptGenRandom

  BCryptOpenAlgorithmProvider

  NCryptDecrypt

  NCryptDeleteKey

  NCryptFreeObject

  NCryptGetProperty

  NCryptOpenKey

  NCryptOpenStorageProvider

  NCryptSignHash

  libwinpthread-1

  pthread_mutex_destroy

  pthread_mutex_init

  pthread_mutex_lock

  pthread_mutex_unlock

  pthread_mutexattr_destroy

  pthread_mutexattr_init

  pthread_mutexattr_settype

  pthread_once

  pthread_rwlock_rdlock

  pthread_rwlock_unlock

  pthread_rwlock_wrlock

  ws2_32

  WSAGetLastError

  WSASend

  WSASetLastError

  connect

  inet_ntop

  inet_pton

  recv

  select

  send

  setsockopt

  libgcc_s_seh-1

  __emutls_get_address

  Exports

  Exports

  _dsa_generate_dss_g

  _dsa_generate_dss_pq

  _dsa_validate_dss_g

  _dsa_validate_dss_pq

  _gnutls13_psk_ext_iter_next_binder

  _gnutls13_psk_ext_iter_next_identity

  _gnutls13_psk_ext_parser_init

  _gnutls_anti_replay_check

  _gnutls_bin2hex

  _gnutls_buffer_append_str

  _gnutls_buffer_clear

  _gnutls_buffer_init

  _gnutls_buffer_pop_datum

  _gnutls_buffer_to_datum

  _gnutls_buffer_unescape

  _gnutls_cidr_to_string

  _gnutls_cipher_get_iv

  _gnutls_cipher_to_entry

  _gnutls_crypto_register_cipher

  _gnutls_decode_ber_rs_raw

  _gnutls_default_priority_string

  _gnutls_digest_exists

  _gnutls_ecc_curve_is_supported

  _gnutls_encode_ber_rs_raw

  _gnutls_global_set_gettime_function

  _gnutls_global_version

  _gnutls_hello_set_default_version

  _gnutls_iov_iter_init

  _gnutls_iov_iter_next

  _gnutls_iov_iter_sync

  _gnutls_ip_to_string

  _gnutls_lib_force_operational

  _gnutls_lib_simulate_error

  _gnutls_log

  _gnutls_log_level

  _gnutls_mac_to_entry

  _gnutls_mpi_log

  _gnutls_mpi_ops

  _gnutls_pkcs12_string_to_key

  _gnutls_prf_raw

  _gnutls_record_overhead

  _gnutls_record_set_default_version

  _gnutls_resolve_priorities

  _gnutls_rsa_pms_set_version

  _gnutls_server_name_set_raw

  _gnutls_set_session_ticket_key_rotation_callback

  _gnutls_supplemental_deinit

  _gnutls_ucs2_to_utf8

  _gnutls_utcTime2gtime

  _gnutls_utf8_to_ucs2

  _gnutls_version_to_entry

  _gnutls_x509_generalTime2gtime

  _gnutls_x509_name_constraints_merge

  _rsa_generate_fips186_4_keypair

  dsa_generate_dss_keypair

  gnutls_aead_cipher_decrypt

  gnutls_aead_cipher_decryptv2

  gnutls_aead_cipher_deinit

  gnutls_aead_cipher_encrypt

  gnutls_aead_cipher_encryptv

  gnutls_aead_cipher_encryptv2

  gnutls_aead_cipher_init

  gnutls_aead_cipher_set_key

  gnutls_alert_get

  gnutls_alert_get_name

  gnutls_alert_get_strname

  gnutls_alert_send

  gnutls_alert_send_appropriate

  gnutls_alert_set_read_function

  gnutls_alpn_get_selected_protocol

  gnutls_alpn_set_protocols

  gnutls_anti_replay_deinit

  gnutls_anti_replay_enable

  gnutls_anti_replay_init

  gnutls_anti_replay_set_add_function

  gnutls_anti_replay_set_ptr

  gnutls_anti_replay_set_window

  gnutls_auth_client_get_type

  gnutls_auth_get_type

  gnutls_auth_server_get_type

  gnutls_base64_decode2

  gnutls_base64_encode2

  gnutls_buffer_append_data

  gnutls_bye

  gnutls_calloc

  gnutls_certificate_activation_time_peers

  gnutls_certificate_allocate_credentials

  gnutls_certificate_client_get_request_status

  gnutls_certificate_expiration_time_peers

  gnutls_certificate_free_ca_names

  gnutls_certificate_free_cas

  gnutls_certificate_free_credentials

  gnutls_certificate_free_crls

  gnutls_certificate_free_keys

  gnutls_certificate_get_crt_raw

  gnutls_certificate_get_issuer

  gnutls_certificate_get_ocsp_expiration

  gnutls_certificate_get_openpgp_crt

  gnutls_certificate_get_openpgp_key

  gnutls_certificate_get_ours

  gnutls_certificate_get_peers

  gnutls_certificate_get_peers_subkey_id

  gnutls_certificate_get_trust_list

  gnutls_certificate_get_verify_flags

  gnutls_certificate_get_x509_crt

  gnutls_certificate_get_x509_key

  gnutls_certificate_send_x509_rdn_sequence

  gnutls_certificate_server_set_request

  gnutls_certificate_set_dh_params

  gnutls_certificate_set_flags

  gnutls_certificate_set_key

  gnutls_certificate_set_known_dh_params

  gnutls_certificate_set_ocsp_status_request_file

  gnutls_certificate_set_ocsp_status_request_file2

  gnutls_certificate_set_ocsp_status_request_function

  gnutls_certificate_set_ocsp_status_request_function2

  gnutls_certificate_set_ocsp_status_request_mem

  gnutls_certificate_set_openpgp_key

  gnutls_certificate_set_openpgp_key_file

  gnutls_certificate_set_openpgp_key_file2

  gnutls_certificate_set_openpgp_key_mem

  gnutls_certificate_set_openpgp_key_mem2

  gnutls_certificate_set_openpgp_keyring_file

  gnutls_certificate_set_openpgp_keyring_mem

  gnutls_certificate_set_params_function

  gnutls_certificate_set_pin_function

  gnutls_certificate_set_rawpk_key_file

  gnutls_certificate_set_rawpk_key_mem

  gnutls_certificate_set_retrieve_function

  gnutls_certificate_set_retrieve_function2

  gnutls_certificate_set_retrieve_function3

  gnutls_certificate_set_trust_list

  gnutls_certificate_set_verify_flags

  gnutls_certificate_set_verify_function

  gnutls_certificate_set_verify_limits

  gnutls_certificate_set_x509_crl

  gnutls_certificate_set_x509_crl_file

  gnutls_certificate_set_x509_crl_mem

  gnutls_certificate_set_x509_key

  gnutls_certificate_set_x509_key_file

  gnutls_certificate_set_x509_key_file2

  gnutls_certificate_set_x509_key_mem

  gnutls_certificate_set_x509_key_mem2

  gnutls_certificate_set_x509_simple_pkcs12_file

  gnutls_certificate_set_x509_simple_pkcs12_mem

  gnutls_certificate_set_x509_system_trust

  gnutls_certificate_set_x509_trust

  gnutls_certificate_set_x509_trust_dir

  gnutls_certificate_set_x509_trust_file

  gnutls_certificate_set_x509_trust_mem

  gnutls_certificate_type_get

  gnutls_certificate_type_get2

  gnutls_certificate_type_get_id

  gnutls_certificate_type_get_name

  gnutls_certificate_type_list

  gnutls_certificate_verification_profile_get_id

  gnutls_certificate_verification_profile_get_name

  gnutls_certificate_verification_status_print

  gnutls_certificate_verify_peers

  gnutls_certificate_verify_peers2

  gnutls_certificate_verify_peers3

  gnutls_check_version

  gnutls_cipher_add_auth

  gnutls_cipher_decrypt

  gnutls_cipher_decrypt2

  gnutls_cipher_decrypt3

  gnutls_cipher_deinit

  gnutls_cipher_encrypt

  gnutls_cipher_encrypt2

  gnutls_cipher_encrypt3

  gnutls_cipher_get

  gnutls_cipher_get_block_size

  gnutls_cipher_get_id

  gnutls_cipher_get_iv_size

  gnutls_cipher_get_key_size

  gnutls_cipher_get_name

  gnutls_cipher_get_tag_size

  gnutls_cipher_init

  gnutls_cipher_list

  gnutls_cipher_self_test

  gnutls_cipher_set_iv

  gnutls_cipher_suite_get_name

  gnutls_cipher_suite_info

  gnutls_cipher_tag

  gnutls_ciphersuite_get

  gnutls_compress_certificate_get_selected_method

  gnutls_compress_certificate_set_methods

  gnutls_compression_get

  gnutls_compression_get_id

  gnutls_compression_get_name

  gnutls_compression_list

  gnutls_credentials_clear

  gnutls_credentials_get

  gnutls_credentials_set

  gnutls_crypto_register_aead_cipher

  gnutls_crypto_register_cipher

  gnutls_crypto_register_digest

  gnutls_crypto_register_mac

  gnutls_db_check_entry

  gnutls_db_check_entry_expire_time

  gnutls_db_check_entry_time

  gnutls_db_get_default_cache_expiration

  gnutls_db_get_ptr

  gnutls_db_remove_session

  gnutls_db_set_cache_expiration

  gnutls_db_set_ptr

  gnutls_db_set_remove_function

  gnutls_db_set_retrieve_function

  gnutls_db_set_store_function

  gnutls_decode_ber_digest_info

  gnutls_decode_gost_rs_value

  gnutls_decode_rs_value

  gnutls_deinit

  gnutls_dh_get_group

  gnutls_dh_get_peers_public_bits

  gnutls_dh_get_prime_bits

  gnutls_dh_get_pubkey

  gnutls_dh_get_secret_bits

  gnutls_dh_params_cpy

  gnutls_dh_params_deinit

  gnutls_dh_params_export2_pkcs3

  gnutls_dh_params_export_pkcs3

  gnutls_dh_params_export_raw

  gnutls_dh_params_generate2

  gnutls_dh_params_import_dsa

  gnutls_dh_params_import_pkcs3

  gnutls_dh_params_import_raw

  gnutls_dh_params_import_raw2

  gnutls_dh_params_import_raw3

  gnutls_dh_params_init

  gnutls_dh_set_prime_bits

  gnutls_digest_get_id

  gnutls_digest_get_name

  gnutls_digest_get_oid

  gnutls_digest_list

  gnutls_digest_self_test

  gnutls_digest_set_secure

  gnutls_dtls_cookie_send

  gnutls_dtls_cookie_verify

  gnutls_dtls_get_data_mtu

  gnutls_dtls_get_mtu

  gnutls_dtls_get_timeout

  gnutls_dtls_prestate_set

  gnutls_dtls_set_data_mtu

  gnutls_dtls_set_mtu

  gnutls_dtls_set_timeouts

  gnutls_early_cipher_get

  gnutls_early_prf_hash_get

  gnutls_ecc_curve_get

  gnutls_ecc_curve_get_id

  gnutls_ecc_curve_get_name

  gnutls_ecc_curve_get_oid

  gnutls_ecc_curve_get_pk

  gnutls_ecc_curve_get_size

  gnutls_ecc_curve_list

  gnutls_ecc_curve_set_enabled

  gnutls_encode_ber_digest_info

  gnutls_encode_gost_rs_value

  gnutls_encode_rs_value

  gnutls_error_is_fatal

  gnutls_error_to_alert

  gnutls_est_record_overhead_size

  gnutls_ext_get_current_msg

  gnutls_ext_get_data

  gnutls_ext_get_name

  gnutls_ext_get_name2

  gnutls_ext_raw_parse

  gnutls_ext_register

  gnutls_ext_set_data

  gnutls_ffdhe_2048_group_generator

  gnutls_ffdhe_2048_group_prime

  gnutls_ffdhe_2048_group_q

  gnutls_ffdhe_2048_key_bits

  gnutls_ffdhe_3072_group_generator

  gnutls_ffdhe_3072_group_prime

  gnutls_ffdhe_3072_group_q

  gnutls_ffdhe_3072_key_bits

  gnutls_ffdhe_4096_group_generator

  gnutls_ffdhe_4096_group_prime

  gnutls_ffdhe_4096_group_q

  gnutls_ffdhe_4096_key_bits

  gnutls_ffdhe_6144_group_generator

  gnutls_ffdhe_6144_group_prime

  gnutls_ffdhe_6144_group_q

  gnutls_ffdhe_6144_key_bits

  gnutls_ffdhe_8192_group_generator

  gnutls_ffdhe_8192_group_prime

  gnutls_ffdhe_8192_group_q

  gnutls_ffdhe_8192_key_bits

  gnutls_fingerprint

  gnutls_fips140_context_deinit

  gnutls_fips140_context_init

  gnutls_fips140_get_operation_state

  gnutls_fips140_mode_enabled

  gnutls_fips140_pop_context

  gnutls_fips140_push_context

  gnutls_fips140_run_self_tests

  gnutls_fips140_set_mode

  gnutls_free

  gnutls_get_library_config

  gnutls_get_system_config_file

  gnutls_global_deinit

  gnutls_global_init

  gnutls_global_set_audit_log_function

  gnutls_global_set_log_function

  gnutls_global_set_log_level

  gnutls_global_set_mem_functions

  gnutls_global_set_mutex

  gnutls_global_set_time_function

  gnutls_gost_paramset_get_name

  gnutls_gost_paramset_get_oid

  gnutls_group_get

  gnutls_group_get_id

  gnutls_group_get_name

  gnutls_group_list

  gnutls_handshake

  gnutls_handshake_description_get_name

  gnutls_handshake_get_last_in

  gnutls_handshake_get_last_out

  gnutls_handshake_set_hook_function

  gnutls_handshake_set_max_packet_length

  gnutls_handshake_set_post_client_hello_function

  gnutls_handshake_set_private_extensions

  gnutls_handshake_set_random

  gnutls_handshake_set_read_function

  gnutls_handshake_set_secret_function

  gnutls_handshake_set_timeout

  gnutls_handshake_write

  gnutls_hash

  gnutls_hash_copy

  gnutls_hash_deinit

  gnutls_hash_fast

  gnutls_hash_get_len

  gnutls_hash_init

  gnutls_hash_output

  gnutls_heartbeat_allowed

  gnutls_heartbeat_enable

  gnutls_heartbeat_get_timeout

  gnutls_heartbeat_ping

  gnutls_heartbeat_pong

  gnutls_heartbeat_set_timeouts

  gnutls_hex2bin

  gnutls_hex_decode

  gnutls_hex_decode2

  gnutls_hex_encode

  gnutls_hex_encode2

  gnutls_hkdf_expand

  gnutls_hkdf_extract

  gnutls_hkdf_self_test

  gnutls_hmac

  gnutls_hmac_copy

  gnutls_hmac_deinit

  gnutls_hmac_fast

  gnutls_hmac_get_key_size

  gnutls_hmac_get_len

  gnutls_hmac_init

  gnutls_hmac_output

  gnutls_hmac_set_nonce

  gnutls_idna_map

  gnutls_idna_reverse_map

  gnutls_init

  gnutls_key_generate

  gnutls_kx_get

  gnutls_kx_get_id

  gnutls_kx_get_name

  gnutls_kx_list

  gnutls_load_file

  gnutls_mac_get

  gnutls_mac_get_id

  gnutls_mac_get_key_size

  gnutls_mac_get_name

  gnutls_mac_get_nonce_size

  gnutls_mac_list

  gnutls_mac_self_test

  gnutls_malloc

  gnutls_memcmp

  gnutls_memset

  gnutls_ocsp_req_add_cert

  gnutls_ocsp_req_add_cert_id

  gnutls_ocsp_req_deinit

  gnutls_ocsp_req_export

  gnutls_ocsp_req_get_cert_id

  gnutls_ocsp_req_get_extension

  gnutls_ocsp_req_get_nonce

  gnutls_ocsp_req_get_version

  gnutls_ocsp_req_import

  gnutls_ocsp_req_init

  gnutls_ocsp_req_print

  gnutls_ocsp_req_randomize_nonce

  gnutls_ocsp_req_set_extension

  gnutls_ocsp_req_set_nonce

  gnutls_ocsp_resp_check_crt

  gnutls_ocsp_resp_deinit

  gnutls_ocsp_resp_export

  gnutls_ocsp_resp_export2

  gnutls_ocsp_resp_get_certs

  gnutls_ocsp_resp_get_extension

  gnutls_ocsp_resp_get_nonce

  gnutls_ocsp_resp_get_produced

  gnutls_ocsp_resp_get_responder

  gnutls_ocsp_resp_get_responder2

  gnutls_ocsp_resp_get_responder_raw_id

  gnutls_ocsp_resp_get_response

  gnutls_ocsp_resp_get_signature

  gnutls_ocsp_resp_get_signature_algorithm

  gnutls_ocsp_resp_get_single

  gnutls_ocsp_resp_get_status

  gnutls_ocsp_resp_get_version

  gnutls_ocsp_resp_import

  gnutls_ocsp_resp_import2

  gnutls_ocsp_resp_init

  gnutls_ocsp_resp_list_import2

  gnutls_ocsp_resp_print

  gnutls_ocsp_resp_verify

  gnutls_ocsp_resp_verify_direct

  gnutls_ocsp_status_request_enable_client

  gnutls_ocsp_status_request_get

  gnutls_ocsp_status_request_get2

  gnutls_ocsp_status_request_is_checked

  gnutls_oid_to_digest

  gnutls_oid_to_ecc_curve

  gnutls_oid_to_gost_paramset

  gnutls_oid_to_mac

  gnutls_oid_to_pk

  gnutls_oid_to_sign

  gnutls_openpgp_crt_check_email

  gnutls_openpgp_crt_check_hostname

  gnutls_openpgp_crt_check_hostname2

  gnutls_openpgp_crt_deinit

  gnutls_openpgp_crt_export

  gnutls_openpgp_crt_export2

  gnutls_openpgp_crt_get_auth_subkey

  gnutls_openpgp_crt_get_creation_time

  gnutls_openpgp_crt_get_expiration_time

  gnutls_openpgp_crt_get_fingerprint

  gnutls_openpgp_crt_get_key_id

  gnutls_openpgp_crt_get_key_usage

  gnutls_openpgp_crt_get_name

  gnutls_openpgp_crt_get_pk_algorithm

  gnutls_openpgp_crt_get_pk_dsa_raw

  gnutls_openpgp_crt_get_pk_rsa_raw

  gnutls_openpgp_crt_get_preferred_key_id

  gnutls_openpgp_crt_get_revoked_status

  gnutls_openpgp_crt_get_subkey_count

  gnutls_openpgp_crt_get_subkey_creation_time

  gnutls_openpgp_crt_get_subkey_expiration_time

  gnutls_openpgp_crt_get_subkey_fingerprint

  gnutls_openpgp_crt_get_subkey_id

  gnutls_openpgp_crt_get_subkey_idx

  gnutls_openpgp_crt_get_subkey_pk_algorithm

  gnutls_openpgp_crt_get_subkey_pk_dsa_raw

  gnutls_openpgp_crt_get_subkey_pk_rsa_raw

  gnutls_openpgp_crt_get_subkey_revoked_status

  gnutls_openpgp_crt_get_subkey_usage

  gnutls_openpgp_crt_get_version

  gnutls_openpgp_crt_import

  gnutls_openpgp_crt_init

  gnutls_openpgp_crt_print

  gnutls_openpgp_crt_set_preferred_key_id

  gnutls_openpgp_crt_verify_ring

  gnutls_openpgp_crt_verify_self

  gnutls_openpgp_keyring_check_id

  gnutls_openpgp_keyring_deinit

  gnutls_openpgp_keyring_get_crt

  gnutls_openpgp_keyring_get_crt_count

  gnutls_openpgp_keyring_import

  gnutls_openpgp_keyring_init

  gnutls_openpgp_privkey_deinit

  gnutls_openpgp_privkey_export

  gnutls_openpgp_privkey_export2

  gnutls_openpgp_privkey_export_dsa_raw

  gnutls_openpgp_privkey_export_rsa_raw

  gnutls_openpgp_privkey_export_subkey_dsa_raw

  gnutls_openpgp_privkey_export_subkey_rsa_raw

  gnutls_openpgp_privkey_get_fingerprint

  gnutls_openpgp_privkey_get_key_id

  gnutls_openpgp_privkey_get_pk_algorithm

  gnutls_openpgp_privkey_get_preferred_key_id

  gnutls_openpgp_privkey_get_revoked_status

  gnutls_openpgp_privkey_get_subkey_count

  gnutls_openpgp_privkey_get_subkey_creation_time

  gnutls_openpgp_privkey_get_subkey_expiration_time

  gnutls_openpgp_privkey_get_subkey_fingerprint

  gnutls_openpgp_privkey_get_subkey_id

  gnutls_openpgp_privkey_get_subkey_idx

  gnutls_openpgp_privkey_get_subkey_pk_algorithm

  gnutls_openpgp_privkey_get_subkey_revoked_status

  gnutls_openpgp_privkey_import

  gnutls_openpgp_privkey_init

  gnutls_openpgp_privkey_sec_param

  gnutls_openpgp_privkey_set_preferred_key_id

  gnutls_openpgp_privkey_sign_hash

  gnutls_openpgp_send_cert

  gnutls_openpgp_set_recv_key_function

  gnutls_packet_deinit

  gnutls_packet_get

  gnutls_pbkdf2

  gnutls_pbkdf2_self_test

  gnutls_pcert_deinit

  gnutls_pcert_export_openpgp

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 687KB - Virtual size: 686KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 34KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 34KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 11KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 46KB - Virtual size: 46KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/locales/MemoryDiagnostic.dll

  .dll regsvr32 windows x64

  c539f5fac8e8357033ae954f9286a2ee

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  _wcsdup

  memset

  memcpy

  __C_specific_handler

  _initterm

  _amsg_exit

  _XcptFilter

  _callnewh

  malloc

  free

  bsearch

  qsort

  wcscmp

  ntdll

  NtQuerySystemInformation

  WinSqmSetIfMaxDWORD

  NtSetSystemInformation

  WinSqmSetDWORD

  WinSqmIncrementDWORD

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  kernel32

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  Sleep

  SetUnhandledExceptionFilter

  TerminateProcess

  GetCurrentProcess

  GetModuleHandleExW

  WaitForSingleObject

  FreeLibraryAndExitThread

  ResumeThread

  CreateEventW

  GetTickCount64

  GetLastError

  SetEvent

  DisableThreadLibraryCalls

  CloseHandle

  GetSystemInfo

  CreateThread

  FreeLibrary

  GetSystemTimeAsFileTime

  UnhandledExceptionFilter

  ole32

  CoCreateInstance

  oleaut32

  SysFreeString

  SysAllocString

  VariantClear

  VariantInit

  advapi32

  EventWrite

  RegCloseKey

  EventRegister

  TraceMessage

  GetTraceLoggerHandle

  GetTraceEnableFlags

  RegSetValueExW

  GetTraceEnableLevel

  OpenProcessToken

  RegisterTraceGuidsW

  UnregisterTraceGuids

  RegOpenKeyExW

  EventUnregister

  RegQueryValueExW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  wevtapi

  EvtClose

  EvtCreateRenderContext

  EvtRender

  EvtNext

  EvtQuery

  bcd

  BcdOpenObject

  BcdSetElementData

  BcdCloseStore

  BcdOpenSystemStore

  BcdCloseObject

  BcdGetElementData

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  Sections

  .text

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 732B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/locales/MessagingDataModel2.dll

  .dll windows x64

  7993a0c7d9c117435c3aafec5a60abec

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  memcmp

  _wtoi64

  __C_specific_handler

  _onexit

  memmove

  __CxxFrameHandler3

  __dllonexit

  memcpy

  _wtoi

  realloc

  _lock

  _initterm

  _amsg_exit

  _XcptFilter

  wcscpy_s

  _callnewh

  malloc

  free

  wcstok_s

  wcstoul

  toupper

  memset

  _errno

  _vsnwprintf_s

  towlower

  memmove_s

  _wcslwr_s

  wcsncmp

  iswdigit

  _wgetenv

  _wcsicmp

  wcsrchr

  swscanf_s

  _wcstoui64

  wcschr

  _unlock

  _vsnwprintf

  memcpy_s

  _wcsnicmp

  _purecall

  wcsftime

  wcscmp

  api-ms-win-core-libraryloader-l1-2-0

  LoadLibraryExW

  GetProcAddress

  FreeLibraryAndExitThread

  GetModuleHandleExW

  FreeLibrary

  LoadStringW

  GetModuleFileNameA

  GetModuleHandleW

  DisableThreadLibraryCalls

  api-ms-win-core-synch-l1-1-0

  ReleaseSRWLockExclusive

  SetEvent

  InitializeCriticalSection

  CreateMutexExW

  CreateEventW

  ReleaseSemaphore

  CreateSemaphoreExW

  AcquireSRWLockShared

  EnterCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  AcquireSRWLockExclusive

  InitializeSRWLock

  LeaveCriticalSection

  CreateEventExW

  WaitForSingleObjectEx

  ReleaseSRWLockShared

  WaitForSingleObject

  ResetEvent

  ReleaseMutex

  OpenSemaphoreW

  oleaut32

  SysStringLen

  SysAllocStringLen

  SysFreeString

  SysStringByteLen

  SysAllocStringByteLen

  SysAllocString

  VariantInit

  VarBstrFromUI8

  VarBstrCat

  api-ms-win-core-errorhandling-l1-1-0

  UnhandledExceptionFilter

  SetLastError

  GetLastError

  RaiseException

  SetUnhandledExceptionFilter

  api-ms-win-core-heap-l2-1-0

  LocalAlloc

  LocalFree

  api-ms-win-eventing-provider-l1-1-0

  EventUnregister

  EventWriteTransfer

  EventSetInformation

  EventRegister

  EventProviderEnabled

  api-ms-win-core-debug-l1-1-0

  OutputDebugStringW

  DebugBreak

  IsDebuggerPresent

  api-ms-win-core-com-l1-1-0

  CoCreateInstance

  CoWaitForMultipleObjects

  StringFromGUID2

  CLSIDFromString

  StringFromCLSID

  CoTaskMemFree

  CoWaitForMultipleHandles

  CoCreateFreeThreadedMarshaler

  CoCreateGuid

  CoTaskMemAlloc

  api-ms-win-core-shlwapi-legacy-l1-1-0

  PathFindFileNameW

  PathSkipRootW

  PathGetDriveNumberW

  PathFindExtensionW

  api-ms-win-core-path-l1-1-0

  PathCchRenameExtension

  PathCchCanonicalize

  api-ms-win-core-sysinfo-l1-1-0

  GetVersionExW

  GetSystemTimeAsFileTime

  GetSystemInfo

  GetTickCount

  api-ms-win-core-processthreads-l1-1-0

  SetThreadPriority

  CreateProcessW

  TerminateProcess

  GetCurrentProcess

  GetCurrentThreadId

  GetCurrentThread

  CreateThread

  GetThreadPriority

  GetCurrentProcessId

  api-ms-win-core-registry-l1-1-0

  RegOpenKeyExW

  RegNotifyChangeKeyValue

  RegQueryValueExW

  RegSetValueExW

  RegCreateKeyExW

  RegCloseKey

  RegDeleteValueW

  RegGetValueW

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-threadpool-legacy-l1-1-0

  UnregisterWaitEx

  api-ms-win-core-kernel32-legacy-l1-1-0

  RegisterWaitForSingleObject

  api-ms-win-core-file-l1-1-0

  GetFileSizeEx

  DeleteFileW

  CompareFileTime

  CreateFileW

  FileTimeToLocalFileTime

  api-ms-win-core-localization-l1-2-0

  GetUserGeoID

  GetGeoInfoW

  FormatMessageW

  GetUserDefaultLocaleName

  GetLocaleInfoW

  GetThreadUILanguage

  api-ms-win-core-heap-l1-1-0

  HeapFree

  GetProcessHeap

  HeapAlloc

  api-ms-win-security-cryptoapi-l1-1-0

  CryptReleaseContext

  CryptGetHashParam

  CryptDestroyHash

  CryptCreateHash

  CryptHashData

  CryptAcquireContextW

  api-ms-win-core-timezone-l1-1-0

  FileTimeToSystemTime

  SystemTimeToFileTime

  api-ms-win-core-shlwapi-obsolete-l1-1-0

  StrStrIW

  api-ms-win-core-threadpool-l1-2-0

  WaitForThreadpoolWaitCallbacks

  SetThreadpoolWait

  CloseThreadpoolWait

  CreateThreadpoolWork

  CloseThreadpool

  SubmitThreadpoolWork

  CreateThreadpoolCleanupGroup

  CloseThreadpoolCleanupGroup

  CreateThreadpool

  WaitForThreadpoolWorkCallbacks

  CloseThreadpoolCleanupGroupMembers

  CreateThreadpoolWait

  CloseThreadpoolWork

  SetThreadpoolThreadMaximum

  xmllite

  CreateXmlReader

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  api-ms-win-core-processenvironment-l1-1-0

  ExpandEnvironmentStringsW

  GetCurrentDirectoryW

  api-ms-win-core-synch-l1-2-0

  SleepConditionVariableSRW

  WakeAllConditionVariable

  Sleep

  api-ms-win-core-rtlsupport-l1-1-0

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlCaptureContext

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  phoneutil

  CellularApiHelper_FreeCountedSlotCanAssociationArray

  GetDialStringFromTelUri

  MaskPhoneUri

  Phone_FmtText_NonDialerFormat

  IsDialableChar

  IsNumberDialable

  GetCchTailMin

  CellularApiHelper_CreateInstance

  MaskPhoneNumber

  OneShotTimer_CreateInstance

  GetTelUriFromDialString

  ComparePhoneNumbers

  pimstore

  FindAllMatchingContactsEx

  FindMatchingContactEx

  cemapi

  MAPIAllocateBuffer

  CreateMAPITableWalker

  MAPIInitialize

  MAPILogonEx

  FreeProws

  GetNamedPropTag

  HrSetOneProp

  MAPIFreeBuffer

  HrGetOneProp

  MAPI_CompareEntryIDs

  MAPIUninitialize

  userdataplatformhelperutil

  CreateKnownFolderPath

  StartAndWaitForServiceForUser

  IsCommsSystemService

  SetThreadIOPriority

  GetThreadIOPriority

  GetUserTokenFromContext

  GetFileExtensionFromContentType

  GetContentTypeFromFilePath

  userdatatypehelperutil

  BytesToDigits

  ReadStreamContent

  CreateWrapFileNameStm

  StringToBytes

  CreateWrapFileStreamFromDssToken

  CopyStream

  StreamFromStringW

  FormatPoomIdToString

  ntdll

  RtlSubscribeWnfStateChangeNotification

  RtlUnsubscribeWnfNotificationWaitForCompletion

  api-ms-win-core-winrt-l1-1-0

  RoActivateInstance

  RoGetActivationFactory

  api-ms-win-core-winrt-string-l1-1-0

  WindowsGetStringRawBuffer

  WindowsCreateString

  WindowsCreateStringReference

  WindowsCompareStringOrdinal

  WindowsDeleteString

  api-ms-win-core-winrt-error-l1-1-0

  RoTransformError

  RoOriginateError

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  api-ms-win-security-base-l1-1-0

  GetTokenInformation

  rpcrt4

  RpcBindingCreateW

  RpcExceptionFilter

  RpcBindingFree

  NdrClientCall2

  RpcBindingBind

  Exports

  Exports

  ?CommitAllAttachments@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z

  ?CommitDeferredContent@MessagingDeferredAttachment@@YAJPEAUIStream@@0@Z

  ?DeleteMessageAndTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z

  ?DeleteTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z

  ?GetData@MessagingDeferredAttachment@@YAJPEAUISmAttachment@@PEAPEAUIStream@@1@Z

  ?GetDeferredAttachmentFilePath@MessagingDeferredAttachment@@YAJPEAUISmMessage@@KPEAHPEAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z

  CellMessagingHelper_CreateInstance

  DllCanUnloadNow

  DllGetClassObject

  GetActiveMmsProfile

  GetDirectionalMarkerForCurrentLocale

  GetHasInternationalCapability

  GetMaxAuthorizedSizeOfMMS

  MOCloudCorrelation_CreateInstance

  MOCloudCorrelation_CreateInstance2

  MessagingAsyncDeletion_CreateInstance

  MessagingMultiSimConverter_CreateInstanceWithPhoneOM

  MessagingMultiSimConverter_CreateInstanceWithSimOM

  MessagingMultiSimConverter_CreateSynchronousInstanceWithSimOM

  MessagingRegistryGetDWORDFromPerSimMmsProfile

  MessagingRegistryGetDWORDPerSim

  MessagingRegistryGetStringFromPerSimMmsProfile

  MessagingRegistryGetStringPerSim

  MessagingRegistrySetDWORDPerSim

  MessagingRegistrySetDWORDToPerSimMmsProfile

  MessagingRegistrySetStringPerSim

  MessagingRegistrySetStringToPerSimMmsProfile

  Messaging_ChatTransportIdToStoreId

  Messaging_CreateMessageInConversation

  Messaging_CreateMessageInConversationWithRecipients

  Messaging_CreateMessageInConversationWithRecipientsAndRemoteId

  Messaging_FormatPhoneNumber

  Messaging_FormatRecipient

  Messaging_FormatRecipientFromAggregate

  Messaging_FormatStringWithLeftToRightMarkers

  Messaging_FormatStringWithLeftToRightMarkersIfPhoneNumber

  Messaging_GetAddressType

  Messaging_GetContentTypeFromFilePath

  Messaging_GetFileExtensionFromContentType

  Messaging_GetMediaTempFilePath

  Messaging_GetMediaTempFolder

  Messaging_GetMediaTypeFromMimeTag

  Messaging_GetMessageAttachmentText

  Messaging_GetMessagePreview

  Messaging_GetPlatformType

  Messaging_GetRecipientsPreviewWithBiDiMarkers

  Messaging_GetRecipientsString

  Messaging_GetSmsCharacterCount

  Messaging_GetUnFormattedMessagePreview

  Messaging_GetValidSimId

  Messaging_HasEmbeddedModem

  Messaging_InitializeRcsSlotMessagingSettings

  Messaging_IsContentSupported

  Messaging_IsCustomAppProviderId

  Messaging_IsDataRoamingRestrictionActive

  Messaging_IsFilterProviderId

  Messaging_IsMediaType

  Messaging_IsMmsMessage

  Messaging_IsRcsEnabled

  Messaging_IsRcsMessage

  Messaging_IsSIMMessage

  Messaging_IsThreadedByRemoteConversationId

  Messaging_IsUnderMediaTempFolder

  Messaging_IsVoiceRoamingRestrictionActive

  Messaging_MarkMessageAsFailed

  Messaging_MessagingOMStartupShutdown

  Messaging_MessagingOMStartupStoreScan

  Messaging_ResolveRecipientEx

  Messaging_RetryDownloadCloudServiceMessage

  Messaging_ShowToastForRcsEndUserMessage

  Messaging_ShutdownCloudServices

  Messaging_ShutdownMessageMaintenance

  Messaging_ShutdownNotification

  Messaging_SmEntryIdToUdmObjectId

  Messaging_StartCloudServiceSync

  Messaging_StartCloudServices

  Messaging_StartMessageMaintenance

  Messaging_StartNotification

  UnInitMessagingObjectModelModule

  WwanConnectionConfiguration_CreateInstance

  Sections

  .text

  Size: 831KB - Virtual size: 830KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 175KB - Virtual size: 174KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 30KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/locales/mcupdate_GenuineIntel.dll

  .exe windows x64

  a43a3e7c022b8819b72e9dd93ec10e0d

  
  

  Code Sign

  33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:24

  Not After

  02-05-2020 21:24

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b

  Signer

  Actual PE Digest

  32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  02-02-2023 17:57

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  ntoskrnl.exe

  RtlInitUnicodeString

  RtlCopyUnicodeString

  RtlIntegerToUnicodeString

  ZwClose

  ZwSetValueKey

  ZwOpenKey

  RtlAppendUnicodeStringToString

  Exports

  Exports

  McImageInfo

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 288B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 512B - Virtual size: 346B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  PAGEUPDT

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  PAGE

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .edata

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  INIT

  Size: 512B - Virtual size: 114B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  MCDATA

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  GFIDS

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 164B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/resources/MFMediaEngine.dll

  .dll windows x64

  96b5470fdc3fca149ad59c6032c2a796

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  _W_Gettnames

  abort

  ldexp

  _ismbblead

  _Wcsftime

  _vsnprintf

  _Gettnames

  _Strftime

  isspace

  ___lc_handle_func

  ___mb_cur_max_func

  setlocale

  _unlock

  _wcsdup

  _Getdays

  memchr

  _lock

  memmove

  memcpy

  _CxxThrowException

  islower

  _ltoa_s

  _i64toa_s

  _gcvt_s

  ___lc_collate_cp_func

  memcmp

  _wsetlocale

  strcspn

  isalnum

  localeconv

  sprintf_s

  ??0bad_cast@@QEAA@PEBD@Z

  ??1bad_cast@@UEAA@XZ

  ??0bad_cast@@QEAA@AEBV0@@Z

  _wtof

  wcstoul

  isdigit

  time

  ctime

  atoi

  wcstombs_s

  memmove_s

  calloc

  iswdigit

  iswalpha

  wcscspn

  swscanf

  strncmp

  strncpy_s

  strnlen

  wcstod

  __mb_cur_max

  ??0exception@@QEAA@AEBQEBD@Z

  _errno

  isxdigit

  strtol

  _strtoui64

  _XcptFilter

  _strnicmp

  _amsg_exit

  isalpha

  _wtoi

  _initterm

  __C_specific_handler

  wcsrchr

  wcsstr

  wcschr

  ??0exception@@QEAA@XZ

  _vsnprintf_s

  wcspbrk

  ??0exception@@QEAA@AEBQEBDH@Z

  ??0exception@@QEAA@AEBV0@@Z

  __dllonexit

  ??1exception@@UEAA@XZ

  ?what@exception@@UEBAPEBDXZ

  __CxxFrameHandler3

  wcscpy_s

  swscanf_s

  _onexit

  _wcsicmp

  _W_Getmonths

  memset

  _W_Getdays

  __uncaught_exception

  __pctype_func

  isupper

  _ui64toa_s

  ?terminate@@YAXXZ

  ??1type_info@@UEAA@XZ

  _ultow_s

  towlower

  tolower

  _ltow_s

  _ultoa_s

  realloc

  __crtLCMapStringA

  _stricmp

  isprint

  _finite

  _isnan

  __crtLCMapStringW

  _Getmonths

  __crtCompareStringA

  _vsnwprintf

  _wcsnicmp

  wcsncmp

  qsort

  memcpy_s

  towupper

  wcstok_s

  _callnewh

  malloc

  free

  _purecall

  __crtCompareStringW

  ___lc_codepage_func

  floor

  wcscmp

  api-ms-win-core-synch-l1-2-0

  SleepConditionVariableSRW

  Sleep

  InitOnceExecuteOnce

  WakeAllConditionVariable

  api-ms-win-core-errorhandling-l1-1-0

  SetUnhandledExceptionFilter

  SetLastError

  RaiseException

  UnhandledExceptionFilter

  GetLastError

  api-ms-win-core-synch-l1-1-0

  AcquireSRWLockExclusive

  LeaveCriticalSection

  CreateMutexW

  EnterCriticalSection

  ResetEvent

  SetWaitableTimer

  CreateWaitableTimerExW

  SetEvent

  CreateEventW

  WaitForSingleObject

  ReleaseSRWLockShared

  InitializeCriticalSection

  CreateSemaphoreExW

  ReleaseSemaphore

  CreateEventExW

  AcquireSRWLockShared

  ReleaseMutex

  InitializeSRWLock

  DeleteCriticalSection

  WaitForSingleObjectEx

  OpenSemaphoreW

  CreateMutexExW

  InitializeCriticalSectionEx

  ReleaseSRWLockExclusive

  WaitForMultipleObjectsEx

  api-ms-win-eventing-provider-l1-1-0

  EventSetInformation

  EventUnregister

  EventRegister

  EventWriteTransfer

  api-ms-win-core-util-l1-1-0

  EncodePointer

  DecodePointer

  api-ms-win-eventing-classicprovider-l1-1-0

  GetTraceLoggerHandle

  UnregisterTraceGuids

  GetTraceEnableFlags

  RegisterTraceGuidsW

  TraceMessage

  GetTraceEnableLevel

  api-ms-win-core-libraryloader-l1-2-0

  FreeLibrary

  LoadLibraryExW

  DisableThreadLibraryCalls

  GetModuleHandleExW

  GetModuleHandleW

  GetProcAddress

  LoadStringW

  GetModuleFileNameW

  GetModuleFileNameA

  api-ms-win-core-processthreads-l1-1-0

  TlsGetValue

  TerminateProcess

  CreateThread

  GetCurrentProcess

  OpenProcessToken

  GetCurrentProcessId

  GetCurrentThreadId

  TlsSetValue

  api-ms-win-core-shlwapi-obsolete-l1-1-0

  StrSpnW

  StrCmpNW

  StrCmpNIW

  StrStrW

  StrCmpW

  StrToIntW

  StrStrIW

  StrTrimW

  StrChrW

  StrCmpIW

  api-ms-win-core-string-l1-1-0

  GetStringTypeW

  WideCharToMultiByte

  MultiByteToWideChar

  CompareStringOrdinal

  api-ms-win-core-threadpool-l1-2-0

  CloseThreadpoolTimer

  SetThreadpoolTimer

  WaitForThreadpoolTimerCallbacks

  CreateThreadpoolTimer

  api-ms-win-core-heap-l1-1-0

  HeapAlloc

  GetProcessHeap

  HeapReAlloc

  HeapFree

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExA

  RegGetValueW

  RegOpenKeyExW

  RegEnumKeyExW

  RegCloseKey

  RegQueryValueExA

  RegSetValueExA

  api-ms-win-core-handle-l1-1-0

  DuplicateHandle

  CloseHandle

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  GetLocaleInfoW

  api-ms-win-core-debug-l1-1-0

  IsDebuggerPresent

  OutputDebugStringW

  DebugBreak

  OutputDebugStringA

  api-ms-win-core-console-l3-2-0

  GetConsoleWindow

  api-ms-win-security-base-l1-1-0

  GetTokenInformation

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemInfo

  GetSystemTimeAsFileTime

  GlobalMemoryStatusEx

  GetTickCount

  GetTickCount64

  api-ms-win-core-url-l1-1-0

  UrlHashW

  api-ms-win-core-path-l1-1-0

  PathCchFindExtension

  PathIsUNCEx

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceFrequency

  QueryPerformanceCounter

  api-ms-win-core-largeinteger-l1-1-0

  MulDiv

  api-ms-win-core-processthreads-l1-1-1

  GetProcessMitigationPolicy

  OpenProcess

  api-ms-win-power-base-l1-1-0

  PowerRegisterSuspendResumeNotification

  PowerUnregisterSuspendResumeNotification

  api-ms-win-core-heap-obsolete-l1-1-0

  GlobalLock

  GlobalUnlock

  api-ms-win-core-heap-l2-1-0

  LocalFree

  LocalAlloc

  GlobalFree

  xmllite

  CreateXmlReader

  api-ms-win-core-shlwapi-legacy-l1-1-0

  IsCharSpaceW

  api-ms-win-core-string-l2-1-0

  IsCharAlphaW

  api-ms-win-power-setting-l1-1-0

  PowerSettingRegisterNotification

  PowerSettingUnregisterNotification

  api-ms-win-core-kernel32-legacy-l1-1-0

  GetSystemPowerStatus

  api-ms-win-core-rtlsupport-l1-1-0

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  api-ms-win-appmodel-runtime-l1-1-2

  AppPolicyGetWindowingModel

  AppPolicyGetLifecycleManagement

  AppPolicyGetMediaFoundationCodecLoading

  api-ms-win-appmodel-runtime-l1-1-0

  GetPackagesByPackageFamily

  GetCurrentPackageFullName

  PackageIdFromFullName

  api-ms-win-dx-d3dkmt-l1-1-0

  GdiEntry13

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  api-ms-win-core-processenvironment-l1-1-0

  GetStdHandle

  api-ms-win-core-file-l1-1-0

  CreateFileA

  SetFilePointer

  FlushFileBuffers

  SetFilePointerEx

  WriteFile

  api-ms-win-core-timezone-l1-1-0

  FileTimeToSystemTime

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiA

  lstrcmpiW

  api-ms-win-core-console-l1-1-0

  AllocConsole

  api-ms-win-core-console-l2-2-0

  SetConsoleTitleW

  bcrypt

  BCryptEncrypt

  BCryptGenerateSymmetricKey

  BCryptSetProperty

  BCryptOpenAlgorithmProvider

  BCryptCloseAlgorithmProvider

  BCryptDestroyKey

  BCryptDecrypt

  api-ms-win-core-synch-l1-2-1

  WaitForMultipleObjects

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  rtworkq

  RtwqSetLongRunning

  Exports

  Exports

  DllCanUnloadNow

  DllGetActivationFactory

  DllGetClassObject

  Sections

  .text

  Size: 3.2MB - Virtual size: 3.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 731KB - Virtual size: 730KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 126KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 81KB - Virtual size: 81KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/resources/mfcore.dll

  .dll regsvr32 windows x64

  bb755df87764d426164a520063f1c78e

  
  

  Code Sign

  33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  05-05-2022 19:23

  Not After

  04-05-2023 19:23

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  97:48:79:65:00:db:cd:8b:21:4c:da:3c:cb:d2:00:19:82:c2:db:98:73:42:ed:ed:08:74:b1:a4:d7:32:5c:a9

  Signer

  Actual PE Digest

  97:48:79:65:00:db:cd:8b:21:4c:da:3c:cb:d2:00:19:82:c2:db:98:73:42:ed:ed:08:74:b1:a4:d7:32:5c:a9

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  02-02-2023 17:57

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  _unlock

  wcsncmp

  _lock

  strnlen

  sqrt

  sin

  strncpy_s

  _ultow_s

  wcsstr

  isprint

  qsort

  swscanf_s

  __dllonexit

  _wcslwr_s

  towlower

  srand

  time

  rand

  _wcsicmp

  _ui64tow_s

  _wcsnicmp

  towupper

  sqrtf

  _wsplitpath_s

  ?terminate@@YAXXZ

  _onexit

  _initterm

  _amsg_exit

  _XcptFilter

  _gcvt_s

  _ultoa_s

  __C_specific_handler

  realloc

  _errno

  _ltoa_s

  __CxxFrameHandler3

  memmove_s

  _callnewh

  _vsnprintf

  _i64toa_s

  _vsnwprintf

  wcsncpy_s

  iswdigit

  iswalpha

  malloc

  free

  _purecall

  memset

  memmove

  memcpy

  memcmp

  wcscat_s

  wcscpy_s

  memcpy_s

  _vscprintf

  ceil

  cos

  floor

  wcscmp

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleFileNameW

  FreeLibrary

  GetModuleHandleExW

  GetModuleHandleA

  LoadLibraryExW

  LoadLibraryExA

  GetProcAddress

  LoadResource

  GetModuleFileNameA

  FindResourceExW

  DisableThreadLibraryCalls

  GetModuleHandleW

  SizeofResource

  api-ms-win-core-synch-l1-1-0

  InitializeCriticalSection

  TryEnterCriticalSection

  InitializeSRWLock

  ReleaseMutex

  WaitForSingleObject

  OpenEventW

  AcquireSRWLockExclusive

  DeleteCriticalSection

  CreateEventW

  SetEvent

  ReleaseSemaphore

  WaitForMultipleObjectsEx

  CreateSemaphoreExW

  LeaveCriticalSection

  ReleaseSRWLockShared

  CreateMutexExW

  EnterCriticalSection

  ReleaseSRWLockExclusive

  ResetEvent

  CreateEventExW

  AcquireSRWLockShared

  WaitForSingleObjectEx

  OpenSemaphoreW

  api-ms-win-core-registry-l1-1-0

  RegGetValueW

  RegQueryValueExW

  RegCreateKeyExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegDeleteValueW

  RegCloseKey

  RegEnumKeyExW

  RegSetValueExW

  api-ms-win-eventing-provider-l1-1-0

  EventEnabled

  EventWriteTransfer

  EventUnregister

  EventSetInformation

  EventRegister

  api-ms-win-eventing-classicprovider-l1-1-0

  TraceMessage

  RegisterTraceGuidsW

  GetTraceEnableLevel

  GetTraceLoggerHandle

  GetTraceEnableFlags

  UnregisterTraceGuids

  api-ms-win-core-string-l2-1-0

  CharNextW

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  CompareStringOrdinal

  MultiByteToWideChar

  api-ms-win-core-errorhandling-l1-1-0

  SetLastError

  SetUnhandledExceptionFilter

  GetLastError

  RaiseException

  UnhandledExceptionFilter

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  api-ms-win-core-synch-l1-2-0

  WakeAllConditionVariable

  InitOnceExecuteOnce

  SleepConditionVariableSRW

  Sleep

  api-ms-win-core-util-l1-1-0

  EncodePointer

  DecodePointer

  api-ms-win-core-memory-l1-1-0

  OpenFileMappingW

  VirtualQueryEx

  CreateFileMappingW

  MapViewOfFile

  VirtualAlloc

  VirtualFree

  UnmapViewOfFile

  MapViewOfFileEx

  api-ms-win-core-processthreads-l1-1-0

  CreateThread

  GetCurrentThread

  GetCurrentProcess

  OpenProcessToken

  GetExitCodeProcess

  TerminateProcess

  ProcessIdToSessionId

  CreateProcessW

  TlsSetValue

  GetCurrentThreadId

  TlsGetValue

  GetCurrentProcessId

  api-ms-win-core-rtlsupport-l1-1-0

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  RtlDeleteFunctionTable

  RtlAddFunctionTable

  api-ms-win-core-errorhandling-l1-1-2

  RaiseFailFastException

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  DuplicateHandle

  api-ms-win-core-processthreads-l1-1-1

  GetProcessMitigationPolicy

  api-ms-win-core-heap-l1-1-0

  GetProcessHeap

  HeapFree

  HeapAlloc

  HeapSize

  api-ms-win-core-threadpool-l1-2-0

  CloseThreadpoolTimer

  WaitForThreadpoolTimerCallbacks

  CreateThreadpoolTimer

  SetThreadpoolTimer

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  IsValidLocaleName

  api-ms-win-core-debug-l1-1-0

  IsDebuggerPresent

  OutputDebugStringA

  DebugBreak

  OutputDebugStringW

  api-ms-win-security-sddl-l1-1-0

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertStringSidToSidW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalFree

  LocalAlloc

  GlobalAlloc

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetVersionExA

  GetSystemDirectoryW

  GetTickCount64

  GetSystemTimeAsFileTime

  api-ms-win-core-psapi-l1-1-0

  K32GetProcessMemoryInfo

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  QueryPerformanceFrequency

  api-ms-win-core-heap-obsolete-l1-1-0

  GlobalLock

  GlobalUnlock

  crypt32

  CryptBinaryToStringA

  api-ms-win-power-base-l1-1-0

  CallNtPowerInformation

  api-ms-win-core-processenvironment-l1-1-0

  ExpandEnvironmentStringsW

  GetEnvironmentVariableW

  api-ms-win-core-libraryloader-l1-2-1

  LoadLibraryW

  api-ms-win-core-wow64-l1-1-1

  IsWow64Process2

  api-ms-win-core-wow64-l1-1-0

  Wow64RevertWow64FsRedirection

  IsWow64Process

  Wow64DisableWow64FsRedirection

  api-ms-win-core-file-l1-1-0

  GetFileSize

  ReadFile

  CreateFileA

  CreateFileW

  GetFinalPathNameByHandleW

  GetFullPathNameW

  api-ms-win-core-kernel32-legacy-l1-1-0

  GetSystemPowerStatus

  api-ms-win-core-threadpool-legacy-l1-1-0

  QueueUserWorkItem

  api-ms-win-security-base-l1-1-0

  FreeSid

  CheckTokenMembership

  AllocateAndInitializeSid

  EqualSid

  PrivilegeCheck

  api-ms-win-core-debug-l1-1-1

  CheckRemoteDebuggerPresent

  api-ms-win-core-io-l1-1-0

  CancelIoEx

  DeviceIoControl

  GetOverlappedResult

  api-ms-win-core-synch-l1-2-1

  WaitForMultipleObjects

  api-ms-win-core-largeinteger-l1-1-0

  MulDiv

  ntdll

  RtlNtStatusToDosError

  NtQuerySystemInformation

  NtQueryInformationProcess

  cfgmgr32

  CM_Get_Device_Interface_AliasW

  ksuser

  KsCreateClock2

  KsCreatePin2

  api-ms-win-appmodel-runtime-l1-1-2

  AppPolicyGetLifecycleManagement

  AppPolicyGetWindowingModel

  AppPolicyGetMediaFoundationCodecLoading

  api-ms-win-security-systemfunctions-l1-1-0

  SystemFunction036

  bcrypt

  BCryptDestroyHash

  BCryptHashData

  BCryptCreateHash

  BCryptFinishHash

  BCryptOpenAlgorithmProvider

  BCryptGetProperty

  BCryptDestroyKey

  BCryptVerifySignature

  BCryptImportKeyPair

  BCryptCloseAlgorithmProvider

  api-ms-win-security-lsalookup-l2-1-0

  LookupPrivilegeValueW

  api-ms-win-core-file-l2-1-0

  CopyFileExW

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  Exports

  Exports

  AppendPropVariant

  ConvertPropVariant

  CopyPropertyStore

  CreateNamedPropertyStore

  DllCanUnloadNow

  DllGetActivationFactory

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  ExtractPropVariant

  MFCopyMFMetadata

  MFCopyPropertyStore

  MFCopyStreamMetadata

  MFCreateAggregateSource

  MFCreateAppSourceProxy

  MFCreateAudioRenderer

  MFCreateAudioRendererActivate

  MFCreateDeviceSource

  MFCreateDeviceSourceActivate

  MFCreateEncryptedMediaExtensionsStoreActivate

  MFCreateExtendedCameraIntrinsicModel

  MFCreateExtendedCameraIntrinsics

  MFCreateFileSchemePlugin

  MFCreateMFMetadataOnPropertyStore

  MFCreateMediaProcessor

  MFCreateMediaSession

  MFCreatePMPHost

  MFCreatePMPMediaSession

  MFCreatePMPServer

  MFCreatePresentationClock

  MFCreateSampleCopierMFT

  MFCreateSampleGrabberSinkActivate

  MFCreateSequencerSegmentOffset

  MFCreateSequencerSource

  MFCreateSequencerSourceRemoteStream

  MFCreateSimpleTypeHandler

  MFCreateSoundEventSchemePlugin

  MFCreateStandardQualityManager

  MFCreateTopoLoader

  MFCreateTopology

  MFCreateTopologyNode

  MFCreateTransformWrapper

  MFCreateWMAEncoderActivate

  MFCreateWMVEncoderActivate

  MFEnumDeviceSources

  MFGetMultipleServiceProviders

  MFGetService

  MFGetTopoNodeCurrentType

  MFReadSequencerSegmentOffset

  MFRequireProtectedEnvironment

  MFShutdownObject

  MergePropertyStore

  Sections

  .text

  Size: 3.8MB - Virtual size: 3.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  ?g_Encry

  Size: 512B - Virtual size: 256B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  ?g_Encry

  Size: 512B - Virtual size: 256B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 407KB - Virtual size: 407KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 156KB - Virtual size: 163KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 97KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 88KB - Virtual size: 87KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/resources/mfcsubs.dll

  .dll windows x64

  30c7cb39213bf552e9d5798b2c47de50

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  malloc

  free

  _amsg_exit

  __CxxFrameHandler3

  __C_specific_handler

  _XcptFilter

  _purecall

  iswspace

  ?terminate@@YAXXZ

  memmove

  _vsnwprintf

  iswdigit

  _wtoi

  wcsstr

  wcsrchr

  wcscspn

  wcsspn

  _wcsrev

  _wcslwr

  _wcsupr

  wcspbrk

  wcschr

  wcscoll

  _wcsicmp

  _initterm

  memcpy

  memset

  api-ms-win-core-synch-l1-1-0

  WaitForSingleObject

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  api-ms-win-core-com-l1-1-0

  CoTaskMemFree

  CoTaskMemAlloc

  api-ms-win-core-errorhandling-l1-1-0

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RaiseException

  api-ms-win-core-string-l1-1-0

  MultiByteToWideChar

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-processthreads-l1-1-0

  TerminateProcess

  GetCurrentProcess

  GetCurrentThreadId

  GetCurrentProcessId

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemTimeAsFileTime

  GetTickCount

  api-ms-win-core-rtlsupport-l1-1-0

  RtlLookupFunctionEntry

  RtlCaptureContext

  RtlVirtualUnwind

  Exports

  Exports

  ??$ConstructElements@VCString@@@@YAXPEAVCString@@H@Z

  ??$CopyElements@VCString@@@@YAXPEAVCString@@PEBV0@H@Z

  ??$DestructElements@VCString@@@@YAXPEAVCString@@H@Z

  ??$HashKey@AEBU_GUID@@@@YAIAEBU_GUID@@@Z

  ??$HashKey@PEBD@@YAIPEBD@Z

  ??$HashKey@PEBG@@YAIPEBG@Z

  ??0CCriticalSection@@QEAA@XZ

  ??0CMapStringToPtr@@QEAA@H@Z

  ??0CObject@@IEAA@XZ

  ??0CString@@QEAA@AEBV0@@Z

  ??0CString@@QEAA@GH@Z

  ??0CString@@QEAA@PEBD@Z

  ??0CString@@QEAA@PEBE@Z

  ??0CString@@QEAA@PEBG@Z

  ??0CString@@QEAA@PEBGH@Z

  ??0CString@@QEAA@XZ

  ??0CStringArray@@QEAA@XZ

  ??0CSyncObject@@QEAA@PEBG@Z

  ??1CCriticalSection@@UEAA@XZ

  ??1CMapStringToPtr@@UEAA@XZ

  ??1CObject@@UEAA@XZ

  ??1CString@@QEAA@XZ

  ??1CStringArray@@UEAA@XZ

  ??1CSyncObject@@UEAA@XZ

  ??4CPlex@@QEAAAEAU0@$$QEAU0@@Z

  ??4CPlex@@QEAAAEAU0@AEBU0@@Z

  ??4CString@@QEAAAEBV0@AEBV0@@Z

  ??4CString@@QEAAAEBV0@D@Z

  ??4CString@@QEAAAEBV0@G@Z

  ??4CString@@QEAAAEBV0@PEBD@Z

  ??4CString@@QEAAAEBV0@PEBE@Z

  ??4CString@@QEAAAEBV0@PEBG@Z

  ??8@YA_NAEBVCString@@0@Z

  ??8@YA_NAEBVCString@@PEBG@Z

  ??8@YA_NPEBGAEBVCString@@@Z

  ??9@YA_NAEBVCString@@0@Z

  ??9@YA_NAEBVCString@@PEBG@Z

  ??9@YA_NPEBGAEBVCString@@@Z

  ??ACMapStringToPtr@@QEAAAEAPEAXPEBG@Z

  ??ACString@@QEBAGH@Z

  ??ACStringArray@@QEAAAEAVCString@@H@Z

  ??ACStringArray@@QEBA?AVCString@@H@Z

  ??BCCriticalSection@@QEAAPEAU_RTL_CRITICAL_SECTION@@XZ

  ??BCString@@QEBAPEBGXZ

  ??BCSyncObject@@QEBAPEAXXZ

  ??H@YA?AVCString@@AEBV0@0@Z

  ??H@YA?AVCString@@AEBV0@D@Z

  ??H@YA?AVCString@@AEBV0@G@Z

  ??H@YA?AVCString@@AEBV0@PEBG@Z

  ??H@YA?AVCString@@DAEBV0@@Z

  ??H@YA?AVCString@@GAEBV0@@Z

  ??H@YA?AVCString@@PEBGAEBV0@@Z

  ??M@YA_NAEBVCString@@0@Z

  ??M@YA_NAEBVCString@@PEBG@Z

  ??M@YA_NPEBGAEBVCString@@@Z

  ??N@YA_NAEBVCString@@0@Z

  ??N@YA_NAEBVCString@@PEBG@Z

  ??N@YA_NPEBGAEBVCString@@@Z

  ??O@YA_NAEBVCString@@0@Z

  ??O@YA_NAEBVCString@@PEBG@Z

  ??O@YA_NPEBGAEBVCString@@@Z

  ??P@YA_NAEBVCString@@0@Z

  ??P@YA_NAEBVCString@@PEBG@Z

  ??P@YA_NPEBGAEBVCString@@@Z

  ??YCString@@QEAAAEBV0@AEBV0@@Z

  ??YCString@@QEAAAEBV0@D@Z

  ??YCString@@QEAAAEBV0@G@Z

  ??YCString@@QEAAAEBV0@PEBG@Z

  ??_7CCriticalSection@@6B@

  ??_7CMapStringToPtr@@6B@

  ??_7CObject@@6B@

  ??_7CStringArray@@6B@

  ??_7CSyncObject@@6B@

  ??_FCMapStringToPtr@@QEAAXXZ

  ?Add@CStringArray@@QEAAHPEBG@Z

  ?AfxExtractSubString@@YAHAEAVCString@@PEBGHG@Z

  ?AfxGetEmptyString@@YAAEBVCString@@XZ

  ?AfxLoadString@@YAHIPEAGI@Z

  ?AllocBeforeWrite@CString@@IEAAXH@Z

  ?AllocBuffer@CString@@IEAAXH@Z

  ?AllocCopy@CString@@IEBAXAEAV1@III@Z

  ?Append@CStringArray@@QEAAHAEBV1@@Z

  ?AssignCopy@CString@@IEAAXHPEBG@Z

  ?Collate@CString@@QEBAHPEBG@Z

  ?Compare@CString@@QEBAHPEBG@Z

  ?CompareNoCase@CString@@QEBAHPEBG@Z

  ?ConcatCopy@CString@@IEAAXHPEBGH0@Z

  ?ConcatInPlace@CString@@IEAAXHPEBG@Z

  ?Copy@CStringArray@@QEAAXAEBV1@@Z

  ?CopyBeforeWrite@CString@@IEAAXXZ

  ?Create@CPlex@@SAPEAU1@AEAPEAU1@II@Z

  ?ElementAt@CStringArray@@QEAAAEAVCString@@H@Z

  ?Empty@CString@@QEAAXXZ

  ?Find@CString@@QEBAHG@Z

  ?Find@CString@@QEBAHPEBG@Z

  ?FindOneOf@CString@@QEBAHPEBG@Z

  ?Format@CString@@QEAAXIZZ

  ?Format@CString@@QEAAXPEBGZZ

  ?FormatMessageW@CString@@QEAAXIZZ

  ?FormatMessageW@CString@@QEAAXPEBGZZ

  ?FormatV@CString@@IEAAXPEBGPEAD@Z

  ?FreeAssoc@CMapStringToPtr@@IEAAXPEAUCAssoc@1@@Z

  ?FreeDataChain@CPlex@@QEAAXXZ

  ?FreeExtra@CString@@QEAAXXZ

  ?FreeExtra@CStringArray@@QEAAXXZ

  ?GetAllocLength@CString@@QEBAHXZ

  ?GetAssocAt@CMapStringToPtr@@IEBAPEAUCAssoc@1@PEBGAEAI@Z

  ?GetAt@CString@@QEBAGH@Z

  ?GetAt@CStringArray@@QEBA?AVCString@@H@Z

  ?GetBuffer@CString@@QEAAPEAGH@Z

  ?GetBufferSetLength@CString@@QEAAPEAGH@Z

  ?GetCount@CMapStringToPtr@@QEBAHXZ

  ?GetData@CString@@IEBAPEAUCStringData@@XZ

  ?GetData@CStringArray@@QEAAPEAVCString@@XZ

  ?GetData@CStringArray@@QEBAPEBVCString@@XZ

  ?GetHashTableSize@CMapStringToPtr@@QEBAIXZ

  ?GetLength@CString@@QEBAHXZ

  ?GetNextAssoc@CMapStringToPtr@@QEBAXAEAPEAU__POSITION@@AEAVCString@@AEAPEAX@Z

  ?GetSize@CStringArray@@QEBAHXZ

  ?GetStartPosition@CMapStringToPtr@@QEBAPEAU__POSITION@@XZ

  ?GetUpperBound@CStringArray@@QEBAHXZ

  ?HashKey@CMapStringToPtr@@QEBAIPEBG@Z

  ?Init@CString@@IEAAXXZ

  ?InitHashTable@CMapStringToPtr@@QEAAXIH@Z

  ?InsertAt@CStringArray@@QEAAXHPEAV1@@Z

  ?InsertAt@CStringArray@@QEAAXHPEBGH@Z

  ?IsEmpty@CMapStringToPtr@@QEBAHXZ

  ?IsEmpty@CString@@QEBAHXZ

  ?Left@CString@@QEBA?AV1@H@Z

  ?LoadStringW@CString@@QEAAHI@Z

  ?Lock@CCriticalSection@@QEAAHXZ

  ?Lock@CCriticalSection@@UEAAHK@Z

  ?Lock@CSyncObject@@UEAAHK@Z

  ?LockBuffer@CString@@QEAAPEAGXZ

  ?Lookup@CMapStringToPtr@@QEBAHPEBGAEAPEAX@Z

  ?LookupKey@CMapStringToPtr@@QEBAHPEBGAEAPEBG@Z

  ?MakeLower@CString@@QEAAXXZ

  ?MakeReverse@CString@@QEAAXXZ

  ?MakeUpper@CString@@QEAAXXZ

  ?Mid@CString@@QEBA?AV1@H@Z

  ?Mid@CString@@QEBA?AV1@HH@Z

  ?NewAssoc@CMapStringToPtr@@IEAAPEAUCAssoc@1@XZ

  ?Release@CString@@IEAAXXZ

  ?Release@CString@@KAXPEAUCStringData@@@Z

  ?ReleaseBuffer@CString@@QEAAXH@Z

  ?RemoveAll@CMapStringToPtr@@QEAAXXZ

  ?RemoveAll@CStringArray@@QEAAXXZ

  ?RemoveAt@CStringArray@@QEAAXHH@Z

  ?RemoveKey@CMapStringToPtr@@QEAAHPEBG@Z

  ?ReverseFind@CString@@QEBAHG@Z

  ?Right@CString@@QEBA?AV1@H@Z

  ?SafeStrlen@CString@@KAHPEBG@Z

  ?SetAt@CMapStringToPtr@@QEAAXPEBGPEAX@Z

  ?SetAt@CString@@QEAAXHG@Z

  ?SetAt@CStringArray@@QEAAXHPEBG@Z

  ?SetAtGrow@CStringArray@@QEAAXHPEBG@Z

  ?SetSize@CStringArray@@QEAAXHH@Z

  ?SpanExcluding@CString@@QEBA?AV1@PEBG@Z

  ?SpanIncluding@CString@@QEBA?AV1@PEBG@Z

  ?TrimLeft@CString@@QEAAXXZ

  ?TrimRight@CString@@QEAAXXZ

  ?Unlock@CCriticalSection@@UEAAHXZ

  ?Unlock@CSyncObject@@UEAAHJPEAJ@Z

  ?UnlockBuffer@CString@@QEAAXXZ

  ?data@CPlex@@QEAAPEAXXZ

  Sections

  .text

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 992B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 60B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/resources/mfds.dll

  .dll regsvr32 windows x64

  57d7b97c9bb98b4b08ebf6acadfa64e1

  
  

  Code Sign

  33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c

  Certificate

  Issuer

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-09-2021 18:23

  Not After

  01-09-2022 18:23

  Subject

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:07:76:56:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2011 18:41

  Not After

  19-10-2026 18:51

  Subject

  CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  d9:44:62:f2:fe:ba:aa:17:d5:10:2d:0f:41:a9:a3:81:85:a5:48:72:54:4a:49:e9:0e:9a:fa:c8:e8:e1:10:36

  Signer

  Actual PE Digest

  d9:44:62:f2:fe:ba:aa:17:d5:10:2d:0f:41:a9:a3:81:85:a5:48:72:54:4a:49:e9:0e:9a:fa:c8:e8:e1:10:36

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  02-02-2023 17:57

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  _purecall

  memmove

  wcscmp

  _onexit

  _lock

  __dllonexit

  _unlock

  realloc

  wcscat_s

  wcscpy_s

  _errno

  memmove_s

  free

  malloc

  towlower

  _wcsicmp

  iswdigit

  _initterm

  _ultoa_s

  _wcsnicmp

  wcsrchr

  towupper

  wcsncmp

  _vsnprintf

  wcsstr

  _wcslwr

  _ltoa_s

  _i64toa_s

  _gcvt_s

  qsort

  strncpy_s

  strnlen

  swprintf_s

  __CxxFrameHandler3

  _vsnwprintf_s

  _wtoi

  ?terminate@@YAXXZ

  ??1type_info@@UEAA@XZ

  wcsncpy_s

  _amsg_exit

  __C_specific_handler

  memcpy_s

  calloc

  memcpy

  _XcptFilter

  wcslen

  memset

  memcmp

  iswalpha

  _callnewh

  oleaut32

  SafeArrayUnaccessData

  VariantClear

  SafeArrayAccessData

  SafeArrayCreate

  SysAllocStringLen

  VarUI4FromStr

  SafeArrayDestroy

  SysFreeString

  api-ms-win-core-synch-l1-1-0

  DeleteCriticalSection

  ResetEvent

  InitializeCriticalSection

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  SetEvent

  InitializeSRWLock

  WaitForSingleObject

  LeaveCriticalSection

  ReleaseSRWLockShared

  EnterCriticalSection

  AcquireSRWLockShared

  CreateEventW

  CreateSemaphoreExW

  WaitForMultipleObjectsEx

  ReleaseSemaphore

  OpenEventW

  api-ms-win-eventing-classicprovider-l1-1-0

  TraceMessage

  GetTraceEnableLevel

  GetTraceLoggerHandle

  RegisterTraceGuidsW

  UnregisterTraceGuids

  GetTraceEnableFlags

  api-ms-win-core-errorhandling-l1-1-0

  RaiseException

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetLastError

  SetLastError

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentProcess

  TerminateProcess

  CreateThread

  GetCurrentProcessId

  GetCurrentThreadId

  TlsGetValue

  SetThreadPriority

  GetCurrentThread

  GetThreadPriority

  TlsSetValue

  api-ms-win-core-com-l1-1-0

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoCreateInstance

  CoUninitialize

  CoInitializeEx

  CoFreeUnusedLibraries

  PropVariantCopy

  CoCreateGuid

  IIDFromString

  CoTaskMemFree

  StringFromGUID2

  StringFromCLSID

  CreateStreamOnHGlobal

  PropVariantClear

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  MultiByteToWideChar

  CompareStringOrdinal

  api-ms-win-core-heap-l1-1-0

  HeapReAlloc

  GetProcessHeap

  HeapFree

  HeapAlloc

  api-ms-win-eventing-provider-l1-1-0

  EventUnregister

  EventWriteTransfer

  EventRegister

  EventSetInformation

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleFileNameW

  SizeofResource

  LoadLibraryExW

  GetProcAddress

  FindResourceExW

  GetModuleHandleW

  LoadResource

  DisableThreadLibraryCalls

  FreeLibrary

  GetModuleFileNameA

  GetModuleHandleExW

  api-ms-win-core-string-l2-1-0

  CharNextW

  api-ms-win-core-registry-l1-1-0

  RegQueryInfoKeyW

  RegSetValueExW

  RegCreateKeyExW

  RegQueryValueExW

  RegEnumKeyExW

  RegEnumValueW

  RegOpenKeyExW

  RegDeleteValueW

  RegGetValueW

  RegCloseKey

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  lstrcmpW

  lstrlenW

  api-ms-win-core-synch-l1-2-0

  SleepConditionVariableSRW

  Sleep

  WakeAllConditionVariable

  api-ms-win-core-rtlsupport-l1-1-0

  RtlCaptureContext

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceFrequency

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetTickCount64

  GetSystemTimeAsFileTime

  GetVersionExW

  GetSystemInfo

  api-ms-win-core-debug-l1-1-0

  IsDebuggerPresent

  DebugBreak

  OutputDebugStringA

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-mm-time-l1-1-0

  timeGetTime

  timeGetDevCaps

  timeEndPeriod

  timeBeginPeriod

  api-ms-win-core-threadpool-l1-2-0

  CreateThreadpoolWait

  SetThreadpoolWait

  WaitForThreadpoolWaitCallbacks

  CloseThreadpoolWait

  api-ms-win-core-version-l1-1-1

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  api-ms-win-core-version-l1-1-0

  VerQueryValueW

  api-ms-win-core-shlwapi-legacy-l1-1-0

  PathIsRelativeW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  LocalAlloc

  GlobalAlloc

  api-ms-win-core-file-l1-1-0

  CreateFileW

  WriteFile

  GetFullPathNameW

  api-ms-win-core-heap-obsolete-l1-1-0

  GlobalUnlock

  GlobalLock

  api-ms-win-core-synch-l1-2-1

  WaitForMultipleObjects

  api-ms-win-security-trustee-l1-1-0

  BuildTrusteeWithSidW

  api-ms-win-security-base-l1-1-0

  FreeSid

  AllocateAndInitializeSid

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  api-ms-win-core-largeinteger-l1-1-0

  MulDiv

  api-ms-win-core-io-l1-1-0

  CreateIoCompletionPort

  GetQueuedCompletionStatus

  api-ms-win-core-memory-l1-1-0

  UnmapViewOfFile

  CreateFileMappingW

  MapViewOfFile

  OpenFileMappingW

  VirtualFree

  VirtualAlloc

  api-ms-win-core-shlwapi-obsolete-l1-1-0

  QISearch

  api-ms-win-appmodel-runtime-l1-1-0

  GetCurrentPackageFamilyName

  api-ms-win-core-registry-l2-1-0

  RegDeleteKeyW

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  InitAACAudioStream_

  InitAC3AudioStream_

  InitBDAVLPCMAudioStream_

  InitDDPlusAudioStream_

  InitDTSAudioStream_

  InitH264Stream_

  InitHEVCStream_

  InitLPCMAudioStream_

  InitLPCMMiracastAudioStream_

  InitMpeg1VideoStream_

  InitMpeg2VideoStream_

  InitMpegAudioStream_

  InitTrueHDAudioStream_

  PESHeaderLength

  PESPacketLength

  PESPacketPTSinPCR

  PackMuxRate

  PackSCR

  xCreateCannedMediaType

  xMediaSubTypeTransform

  Sections

  .text

  Size: 741KB - Virtual size: 741KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 136KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 33KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 1024B - Virtual size: 528B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• CRM_chat/resources/mfdvdec.dll

  .dll windows x64

  c2cd05a80ef743073eadb33662f239d9

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  strncpy_s

  strnlen

  _purecall

  memset

  _XcptFilter

  _amsg_exit

  free

  _callnewh

  _initterm

  __C_specific_handler

  _lock

  malloc

  _onexit

  _unlock

  __dllonexit

  qsort

  memcpy

  api-ms-win-core-com-l1-1-0

  PropVariantClear

  api-ms-win-core-errorhandling-l1-1-0

  SetLastError

  SetUnhandledExceptionFilter

  GetLastError

  UnhandledExceptionFilter

  api-ms-win-core-synch-l1-1-0

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-eventing-classicprovider-l1-1-0

  GetTraceEnableLevel

  GetTraceLoggerHandle

  UnregisterTraceGuids

  GetTraceEnableFlags

  RegisterTraceGuidsW

  TraceMessage

  api-ms-win-core-processthreads-l1-1-0

  TerminateProcess

  TlsGetValue

  TlsSetValue

  GetCurrentProcess

  GetCurrentThreadId

  GetCurrentProcessId

  api-ms-win-core-libraryloader-l1-2-0

  DisableThreadLibraryCalls

  FreeLibrary

  GetModuleHandleExW

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-rtlsupport-l1-1-0

  RtlLookupFunctionEntry

  RtlCaptureContext

  RtlVirtualUnwind

  mfplat

  MFCreateMediaType

  MFGetStrideForBitmapInfoHeader

  MFGetCallStackTracingWeakReference

  MFCalculateImageSize

  MFGetSystemTime

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  api-ms-win-core-debug-l1-1-0

  DebugBreak

  IsDebuggerPresent

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  Sections

  .text

  Size: 118KB - Virtual size: 117KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 10KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 424B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ