VSCodeUserSetup-x64-1[.]74[.]3[.]zip

Resubmissions

04-02-2023 21:43

230204-1lbwcseg47 10

Sharing

Copy URL

Twitter E-mail

General

Target

VSCodeUserSetup-x64-1.74.3.zip
Size

10.3MB
MD5

ffc83d031c562f089f0811731a65a47e
SHA1

d2c9b520768f5f526b875d52864d1676c546d3c1
SHA256

3d30d701fb087416627321c60ab02f143718aefbb3ea7e2689b6fb658ab78ab6
SHA512

2638e17d110dbca1b78d51c8f2714b451a7017346fb93b91e28bf8e1e45305cdfb93845d5eb0ee9ece807166ce032317878c3133ef5223a72328d754f1d4c9d4
SSDEEP

196608:tkrvx0ZhKNLWMYVQL8N2ng7pixycHdYZFXXt/vh68g22zl6uT2QhjZi:tkrvx0uvkQ3g7p81dYjXXth681wl/qQu

Score

1^/10

Malware Config

Signatures

Files

VSCodeUserSetup-x64-1.74.3.zip
.zip
VSCodeUserSetup-x64-1.74.3/VSCodeUserSetup-x64-1.74.3.exe
.exe windows x64

4cea7ae85c87ddc7295d39ff9cda31d1

Code Sign

09:95:9f:e7:c3:8f:87:51:bc:99:fc:a2:be:9d:fb:e7
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-11-2020 00:00

Not After

29-11-2023 23:59

Subject

CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:5d:e2:c7:af:11:69:4f:b9:3e:8f:05:3d:a6:e9:19
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14-12-2020 00:00

Not After

29-11-2023 23:59

Subject

CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:70:c3:4f:7c:32:f7:4b:28:e7:6e:81:14:5a:a5:f0:f5:27:d2:da:60:4d:3f:0d:0e:f4:73:4c:a0:9a:aa:a7
Signer

Actual PE Digest

18:70:c3:4f:7c:32:f7:4b:28:e7:6e:81:14:5a:a5:f0:f5:27:d2:da:60:4d:3f:0d:0e:f4:73:4c:a0:9a:aa:a7

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO

24-10-2022 10:45
Valid: true

Chain 1

CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

58:f9:5d:c1:7f:c3:c0:fb:7e:e1:7b:c3:7b:03:eb:0a:38:36:d7:15
Signer

Actual PE Digest

58:f9:5d:c1:7f:c3:c0:fb:7e:e1:7b:c3:7b:03:eb:0a:38:36:d7:15

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO

24-10-2022 10:45
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges

kernel32

_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose

gdi32

GetDeviceCaps

user32

ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA

msvcrt

?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy

comctl32

ord17

cabinet

ord20
ord21
ord23
ord22

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgcc_s_seh-1.dll
.dll windows x64

dba1138574ae4813ca81835aae76e6cd

Code Sign

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-02-2022 00:00

Not After

17-02-2025 23:59

Subject

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

30-08-2022 00:00

Not After

29-08-2023 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8e:10:a6:12:01:65:a3:86:52:e0:ed:90:3d:98:36:60:5f:9a:dc:6b:89:e2:be:9f:1d:00:71:e7:c7:2d:3a:5f
Signer

Actual PE Digest

8e:10:a6:12:01:65:a3:86:52:e0:ed:90:3d:98:36:60:5f:9a:dc:6b:89:e2:be:9f:1d:00:71:e7:c7:2d:3a:5f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

19-09-2022 09:20
Valid: true

Chain 1

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetLastError
InitializeCriticalSection
LeaveCriticalSection
RaiseException
ReleaseSemaphore
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
malloc
memcpy
memset
realloc
strlen
strncmp
vfprintf

Exports

Exports

_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__absvdi2
__absvsi2
__absvti2
__addtf3
__addvdi3
__addvsi3
__addvti3
__ashlti3
__ashrti3
__bswapdi2
__bswapsi2
__clear_cache
__clrsbdi2
__clrsbti2
__clzdi2
__clzti2
__cmpti2
__ctzdi2
__ctzti2
__divdc3
__divmodti4
__divsc3
__divtc3
__divtf3
__divti3
__divxc3
__emutls_get_address
__emutls_register_common
__enable_execute_stack
__eqtf2
__extenddftf2
__extendsftf2
__extendxftf2
__ffsdi2
__ffsti2
__fixdfti
__fixsfti
__fixtfdi
__fixtfsi
__fixtfti
__fixunsdfdi
__fixunsdfti
__fixunssfdi
__fixunssfti
__fixunstfdi
__fixunstfsi
__fixunstfti
__fixunsxfdi
__fixunsxfti
__fixxfti
__floatditf
__floatsitf
__floattidf
__floattisf
__floattitf
__floattixf
__floatunditf
__floatunsitf
__floatuntidf
__floatuntisf
__floatuntitf
__floatuntixf
__gcc_personality_seh0
__getf2
__gttf2
__letf2
__lshrti3
__lttf2
__modti3
__muldc3
__mulsc3
__multc3
__multf3
__multi3
__mulvdi3
__mulvsi3
__mulvti3
__mulxc3
__negtf2
__negti2
__negvdi2
__negvsi2
__negvti2
__netf2
__paritydi2
__parityti2
__popcountdi2
__popcountti2
__powidf2
__powisf2
__powitf2
__powixf2
__subtf3
__subvdi3
__subvsi3
__subvti3
__trunctfdf2
__trunctfsf2
__trunctfxf2
__ucmpti2
__udivmodti4
__udivti3
__umodti3
__unordtf2

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 304B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgmp-10.dll
.dll windows x64

50d3e0798b0b3d30fc332b48dda65861

Code Sign

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-02-2022 00:00

Not After

17-02-2025 23:59

Subject

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

30-08-2022 00:00

Not After

29-08-2023 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

93:8f:a8:f6:fa:33:15:d7:f9:f4:a9:a5:53:fd:8a:d8:79:97:c5:95:85:5d:35:a5:28:92:5a:81:2e:1a:19:15
Signer

Actual PE Digest

93:8f:a8:f6:fa:33:15:d7:f9:f4:a9:a5:53:fd:8a:d8:79:97:c5:95:85:5d:35:a5:28:92:5a:81:2e:1a:19:15

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

19-09-2022 09:20
Valid: true

Chain 1

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
ferror
fgetc
fputc
fread
free
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
malloc
memcpy
memmove
memset
putc
raise
realloc
strchr
strerror
strlen
strncmp
strstr
strtol
strtoul
tolower
ungetc
vfprintf
wcslen

Exports

Exports

__gmp_0
__gmp_allocate_func
__gmp_asprintf
__gmp_asprintf_final
__gmp_asprintf_funs
__gmp_asprintf_memory
__gmp_asprintf_reps
__gmp_assert_fail
__gmp_assert_header
__gmp_binvert_limb_table
__gmp_bits_per_limb
__gmp_default_allocate
__gmp_default_fp_limb_precision
__gmp_default_free
__gmp_default_reallocate
__gmp_digit_value_tab
__gmp_divide_by_zero
__gmp_doprnt
__gmp_doprnt_integer
__gmp_doprnt_mpf2
__gmp_doscan
__gmp_errno
__gmp_exception
__gmp_extract_double
__gmp_fac2cnt_table
__gmp_fib_table
__gmp_fprintf
__gmp_fprintf_funs
__gmp_free_func
__gmp_fscanf
__gmp_fscanf_funs
__gmp_get_memory_functions
__gmp_init_primesieve
__gmp_invalid_operation
__gmp_jacobi_table
__gmp_junk
__gmp_limbroots_table
__gmp_mt_recalc_buffer
__gmp_nextprime
__gmp_odd2fac_table
__gmp_oddfac_table
__gmp_primesieve
__gmp_printf
__gmp_randclear
__gmp_randclear_mt
__gmp_randget_mt
__gmp_randinit
__gmp_randinit_default
__gmp_randinit_lc_2exp
__gmp_randinit_lc_2exp_size
__gmp_randinit_mt
__gmp_randinit_mt_noseed
__gmp_randinit_set
__gmp_randiset_mt
__gmp_rands
__gmp_rands_initialized
__gmp_randseed
__gmp_randseed_ui
__gmp_reallocate_func
__gmp_scanf
__gmp_set_memory_functions
__gmp_snprintf
__gmp_snprintf_funs
__gmp_sprintf
__gmp_sprintf_funs
__gmp_sqrt_of_negative
__gmp_sscanf
__gmp_sscanf_funs
__gmp_tmp_reentrant_alloc
__gmp_tmp_reentrant_free
__gmp_urandomb_ui
__gmp_urandomm_ui
__gmp_vasprintf
__gmp_version
__gmp_vfprintf
__gmp_vfscanf
__gmp_vprintf
__gmp_vscanf
__gmp_vsnprintf
__gmp_vsprintf
__gmp_vsscanf
__gmpf_abs
__gmpf_add
__gmpf_add_ui
__gmpf_ceil
__gmpf_clear
__gmpf_clears
__gmpf_cmp
__gmpf_cmp_d
__gmpf_cmp_si
__gmpf_cmp_ui
__gmpf_cmp_z
__gmpf_div
__gmpf_div_2exp
__gmpf_div_ui
__gmpf_dump
__gmpf_eq
__gmpf_fits_sint_p
__gmpf_fits_slong_p
__gmpf_fits_sshort_p
__gmpf_fits_uint_p
__gmpf_fits_ulong_p
__gmpf_fits_ushort_p
__gmpf_floor
__gmpf_get_d
__gmpf_get_d_2exp
__gmpf_get_default_prec
__gmpf_get_prec
__gmpf_get_si
__gmpf_get_str
__gmpf_get_ui
__gmpf_init
__gmpf_init2
__gmpf_init_set
__gmpf_init_set_d
__gmpf_init_set_si
__gmpf_init_set_str
__gmpf_init_set_ui
__gmpf_inits
__gmpf_inp_str
__gmpf_integer_p
__gmpf_mul
__gmpf_mul_2exp
__gmpf_mul_ui
__gmpf_neg
__gmpf_out_str
__gmpf_pow_ui
__gmpf_random2
__gmpf_reldiff
__gmpf_set
__gmpf_set_d
__gmpf_set_default_prec
__gmpf_set_prec
__gmpf_set_prec_raw
__gmpf_set_q
__gmpf_set_si
__gmpf_set_str
__gmpf_set_ui
__gmpf_set_z
__gmpf_size
__gmpf_sqrt
__gmpf_sqrt_ui
__gmpf_sub
__gmpf_sub_ui
__gmpf_swap
__gmpf_trunc
__gmpf_ui_div
__gmpf_ui_sub
__gmpf_urandomb
__gmpn_add
__gmpn_add_1
__gmpn_add_err1_n
__gmpn_add_err2_n
__gmpn_add_err3_n
__gmpn_add_n
__gmpn_add_n_atom
__gmpn_add_n_bd1
__gmpn_add_n_bt1
__gmpn_add_n_core2
__gmpn_add_n_coreihwl
__gmpn_add_n_coreisbr
__gmpn_add_n_goldmont
__gmpn_add_n_init
__gmpn_add_n_pentium4
__gmpn_add_n_silvermont
__gmpn_add_n_sub_n
__gmpn_add_n_x86_64
__gmpn_add_nc_atom
__gmpn_add_nc_bd1
__gmpn_add_nc_bt1
__gmpn_add_nc_core2
__gmpn_add_nc_coreihwl
__gmpn_add_nc_coreisbr
__gmpn_add_nc_goldmont
__gmpn_add_nc_pentium4
__gmpn_add_nc_silvermont
__gmpn_add_nc_x86_64
__gmpn_addlsh1_n
__gmpn_addlsh1_n_atom
__gmpn_addlsh1_n_bd1
__gmpn_addlsh1_n_core2
__gmpn_addlsh1_n_coreisbr
__gmpn_addlsh1_n_init
__gmpn_addlsh1_n_pentium4
__gmpn_addlsh1_n_silvermont
__gmpn_addlsh1_n_x86_64
__gmpn_addlsh1_n_zen
__gmpn_addlsh1_nc_atom
__gmpn_addlsh1_nc_bd1
__gmpn_addlsh1_nc_coreisbr
__gmpn_addlsh1_nc_zen
__gmpn_addlsh2_n
__gmpn_addlsh2_n_atom
__gmpn_addlsh2_n_core2
__gmpn_addlsh2_n_coreisbr
__gmpn_addlsh2_n_init
__gmpn_addlsh2_n_pentium4
__gmpn_addlsh2_n_silvermont
__gmpn_addlsh2_n_x86_64
__gmpn_addlsh2_nc_coreisbr
__gmpn_addlsh_n
__gmpn_addmul_1
__gmpn_addmul_1_atom
__gmpn_addmul_1_bd1
__gmpn_addmul_1_bt1
__gmpn_addmul_1_core2
__gmpn_addmul_1_coreibwl
__gmpn_addmul_1_coreihwl
__gmpn_addmul_1_coreinhm
__gmpn_addmul_1_coreisbr
__gmpn_addmul_1_goldmont
__gmpn_addmul_1_init
__gmpn_addmul_1_pentium4
__gmpn_addmul_1_silvermont
__gmpn_addmul_1_x86_64
__gmpn_addmul_1_zen
__gmpn_addmul_1c_core2
__gmpn_addmul_1c_silvermont
__gmpn_addmul_2
__gmpn_addmul_2_atom
__gmpn_addmul_2_bd1
__gmpn_addmul_2_coreihwl
__gmpn_addmul_2_coreisbr
__gmpn_addmul_2_fat
__gmpn_addmul_2_init
__gmpn_addmul_2_k8
__gmpn_addmul_2_pentium4
__gmpn_and_n
__gmpn_andn_n
__gmpn_bases
__gmpn_bc_mulmod_bnm1
__gmpn_bc_set_str
__gmpn_bdiv_dbm1c
__gmpn_bdiv_dbm1c_init
__gmpn_bdiv_dbm1c_x86_64
__gmpn_bdiv_q
__gmpn_bdiv_q_1
__gmpn_bdiv_q_itch
__gmpn_bdiv_qr
__gmpn_bdiv_qr_itch
__gmpn_binvert
__gmpn_binvert_itch
__gmpn_broot
__gmpn_broot_invm1
__gmpn_brootinv
__gmpn_bsqrt
__gmpn_bsqrtinv
__gmpn_cmp
__gmpn_cnd_add_n
__gmpn_cnd_add_n_atom
__gmpn_cnd_add_n_coreisbr
__gmpn_cnd_add_n_init
__gmpn_cnd_add_n_x86_64
__gmpn_cnd_sub_n
__gmpn_cnd_sub_n_atom
__gmpn_cnd_sub_n_coreisbr
__gmpn_cnd_sub_n_init
__gmpn_cnd_sub_n_x86_64
__gmpn_cnd_swap
__gmpn_com
__gmpn_com_atom
__gmpn_com_bd1
__gmpn_com_bt2
__gmpn_com_core2
__gmpn_com_init
__gmpn_com_x86_64
__gmpn_com_zen
__gmpn_compute_powtab
__gmpn_copyd
__gmpn_copyd_atom
__gmpn_copyd_bd1
__gmpn_copyd_bt1
__gmpn_copyd_bt2
__gmpn_copyd_core2
__gmpn_copyd_init
__gmpn_copyd_nano
__gmpn_copyd_x86_64
__gmpn_copyd_zen
__gmpn_copyi
__gmpn_copyi_atom
__gmpn_copyi_bd1
__gmpn_copyi_bt1
__gmpn_copyi_bt2
__gmpn_copyi_core2
__gmpn_copyi_init
__gmpn_copyi_nano
__gmpn_copyi_x86_64
__gmpn_copyi_zen
__gmpn_cpuid
__gmpn_cpuvec
__gmpn_cpuvec_init
__gmpn_cpuvec_initialized
__gmpn_dc_set_str
__gmpn_dcpi1_bdiv_q
__gmpn_dcpi1_bdiv_qr
__gmpn_dcpi1_bdiv_qr_n
__gmpn_dcpi1_bdiv_qr_n_itch
__gmpn_dcpi1_div_q
__gmpn_dcpi1_div_qr
__gmpn_dcpi1_div_qr_n
__gmpn_dcpi1_divappr_q
__gmpn_div_q
__gmpn_div_qr_1
__gmpn_div_qr_1n_pi1
__gmpn_div_qr_2
__gmpn_div_qr_2n_pi1
__gmpn_div_qr_2u_pi1
__gmpn_divexact
__gmpn_divexact_1
__gmpn_divexact_1_atom
__gmpn_divexact_1_init
__gmpn_divexact_1_nano
__gmpn_divexact_1_x86_64
__gmpn_divexact_by3
__gmpn_divexact_by3c
__gmpn_divisible_p
__gmpn_divmod_1
__gmpn_divrem
__gmpn_divrem_1
__gmpn_divrem_1_core2
__gmpn_divrem_1_coreisbr
__gmpn_divrem_1_init
__gmpn_divrem_1_x86_64
__gmpn_divrem_2
__gmpn_dump
__gmpn_fft_best_k
__gmpn_fft_next_size
__gmpn_fib2_ui
__gmpn_fib2m
__gmpn_gcd
__gmpn_gcd_1
__gmpn_gcd_11
__gmpn_gcd_11_bd1
__gmpn_gcd_11_bt1
__gmpn_gcd_11_bt2
__gmpn_gcd_11_core2
__gmpn_gcd_11_coreisbr
__gmpn_gcd_11_init
__gmpn_gcd_11_k10
__gmpn_gcd_11_nano
__gmpn_gcd_11_x86_64
__gmpn_gcd_11_zen
__gmpn_gcd_22
__gmpn_gcd_subdiv_step
__gmpn_gcdext
__gmpn_gcdext_1
__gmpn_gcdext_hook
__gmpn_gcdext_lehmer_n
__gmpn_get_d
__gmpn_get_str
__gmpn_hamdist
__gmpn_hgcd
__gmpn_hgcd2
__gmpn_hgcd2_jacobi
__gmpn_hgcd_appr
__gmpn_hgcd_appr_itch
__gmpn_hgcd_itch
__gmpn_hgcd_jacobi
__gmpn_hgcd_matrix_adjust
__gmpn_hgcd_matrix_init
__gmpn_hgcd_matrix_mul
__gmpn_hgcd_matrix_mul_1
__gmpn_hgcd_matrix_update_q
__gmpn_hgcd_mul_matrix1_vector
__gmpn_hgcd_reduce
__gmpn_hgcd_reduce_itch
__gmpn_hgcd_step
__gmpn_invert
__gmpn_invert_limb
__gmpn_invert_limb_table
__gmpn_invertappr
__gmpn_ior_n
__gmpn_iorn_n
__gmpn_jacobi_2
__gmpn_jacobi_base
__gmpn_jacobi_n
__gmpn_lshift
__gmpn_lshift_atom
__gmpn_lshift_core2
__gmpn_lshift_coreisbr
__gmpn_lshift_init
__gmpn_lshift_k10
__gmpn_lshift_pentium4
__gmpn_lshift_silvermont
__gmpn_lshift_x86_64
__gmpn_lshift_zen
__gmpn_lshiftc
__gmpn_lshiftc_atom
__gmpn_lshiftc_core2
__gmpn_lshiftc_coreisbr
__gmpn_lshiftc_init
__gmpn_lshiftc_k10
__gmpn_lshiftc_pentium4
__gmpn_lshiftc_silvermont
__gmpn_lshiftc_x86_64
__gmpn_lshiftc_zen
__gmpn_matrix22_mul
__gmpn_matrix22_mul1_inverse_vector
__gmpn_matrix22_mul_itch
__gmpn_mod_1
__gmpn_mod_1_1p
__gmpn_mod_1_1p_cps
__gmpn_mod_1_1p_cps_init
__gmpn_mod_1_1p_cps_x86_64
__gmpn_mod_1_1p_init
__gmpn_mod_1_1p_x86_64
__gmpn_mod_1_fat
__gmpn_mod_1_init
__gmpn_mod_1s_2p
__gmpn_mod_1s_2p_cps
__gmpn_mod_1s_2p_cps_init
__gmpn_mod_1s_2p_cps_x86_64
__gmpn_mod_1s_2p_init
__gmpn_mod_1s_2p_x86_64
__gmpn_mod_1s_3p
__gmpn_mod_1s_3p_cps
__gmpn_mod_1s_4p
__gmpn_mod_1s_4p_cps
__gmpn_mod_1s_4p_cps_init
__gmpn_mod_1s_4p_cps_x86_64
__gmpn_mod_1s_4p_init
__gmpn_mod_1s_4p_x86_64
__gmpn_mod_34lsub1
__gmpn_mod_34lsub1_init
__gmpn_mod_34lsub1_pentium4
__gmpn_mod_34lsub1_x86_64
__gmpn_modexact_1_odd_x86_64
__gmpn_modexact_1c_odd
__gmpn_modexact_1c_odd_init
__gmpn_modexact_1c_odd_x86_64
__gmpn_mu_bdiv_q
__gmpn_mu_bdiv_q_itch
__gmpn_mu_bdiv_qr
__gmpn_mu_bdiv_qr_itch
__gmpn_mu_div_q
__gmpn_mu_div_q_itch
__gmpn_mu_div_qr
__gmpn_mu_div_qr_itch
__gmpn_mu_divappr_q
__gmpn_mu_divappr_q_itch
__gmpn_mul
__gmpn_mul_1
__gmpn_mul_1_atom
__gmpn_mul_1_bd1
__gmpn_mul_1_bt1
__gmpn_mul_1_coreihwl
__gmpn_mul_1_coreisbr
__gmpn_mul_1_goldmont
__gmpn_mul_1_init
__gmpn_mul_1_pentium4
__gmpn_mul_1_silvermont
__gmpn_mul_1_x86_64
__gmpn_mul_1_zen
__gmpn_mul_1c_atom
__gmpn_mul_1c_bd1
__gmpn_mul_1c_bt1
__gmpn_mul_1c_coreisbr
__gmpn_mul_1c_goldmont
__gmpn_mul_1c_pentium4
__gmpn_mul_1c_silvermont
__gmpn_mul_1c_x86_64
__gmpn_mul_1c_zen
__gmpn_mul_2
__gmpn_mul_basecase
__gmpn_mul_basecase_bd1
__gmpn_mul_basecase_bt1
__gmpn_mul_basecase_core2
__gmpn_mul_basecase_coreibwl
__gmpn_mul_basecase_coreihwl
__gmpn_mul_basecase_coreisbr
__gmpn_mul_basecase_fat
__gmpn_mul_basecase_init
__gmpn_mul_basecase_k8
__gmpn_mul_basecase_pentium4
__gmpn_mul_basecase_silvermont
__gmpn_mul_basecase_zen
__gmpn_mul_fft
__gmpn_mul_n
__gmpn_mullo_basecase
__gmpn_mullo_basecase_core2
__gmpn_mullo_basecase_coreibwl
__gmpn_mullo_basecase_coreihwl
__gmpn_mullo_basecase_coreisbr
__gmpn_mullo_basecase_fat
__gmpn_mullo_basecase_init
__gmpn_mullo_basecase_k8
__gmpn_mullo_basecase_pentium4
__gmpn_mullo_basecase_silvermont
__gmpn_mullo_basecase_zen
__gmpn_mullo_n
__gmpn_mulmid
__gmpn_mulmid_basecase
__gmpn_mulmid_n
__gmpn_mulmod_bnm1
__gmpn_mulmod_bnm1_next_size
__gmpn_nand_n
__gmpn_neg
__gmpn_ni_invertappr
__gmpn_nior_n
__gmpn_nussbaumer_mul

Sections

.text
Size: 501KB - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/fold/libgnutls-30.dll
.dll windows x64

291bf80a623dd34eb1c465735dd3467f

Code Sign

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

18-02-2022 00:00

Not After

17-02-2025 23:59

Subject

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

30-08-2022 00:00

Not After

29-08-2023 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:4d:d8:01:b2:24:df:30:35:bb:5d:dd:61:b6:28:2a:dc:1a:30:5b:05:87:bd:ab:76:dc:44:b0:5d:e9:8f:09
Signer

Actual PE Digest

51:4d:d8:01:b2:24:df:30:35:bb:5d:dd:61:b6:28:2a:dc:1a:30:5b:05:87:bd:ab:76:dc:44:b0:5d:e9:8f:09

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

19-09-2022 09:20
Valid: true

Chain 1

CN=Tim Kosse,O=Tim Kosse,ST=Nordrhein-Westfalen,C=DE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libgmp-10

__gmp_get_memory_functions
__gmp_set_memory_functions
__gmpn_cnd_add_n
__gmpn_copyi
__gmpn_rshift
__gmpn_sub_n
__gmpn_zero
__gmpz_add
__gmpz_add_ui
__gmpz_cdiv_q
__gmpz_clear
__gmpz_cmp
__gmpz_cmp_ui
__gmpz_export
__gmpz_fdiv_q
__gmpz_fdiv_q_2exp
__gmpz_fdiv_r
__gmpz_fdiv_r_2exp
__gmpz_gcd
__gmpz_import
__gmpz_init
__gmpz_init_set_str
__gmpz_invert
__gmpz_lcm
__gmpz_limbs_finish
__gmpz_limbs_read
__gmpz_limbs_write
__gmpz_mod
__gmpz_mul
__gmpz_mul_2exp
__gmpz_mul_ui
__gmpz_powm
__gmpz_probab_prime_p
__gmpz_set
__gmpz_set_ui
__gmpz_sizeinbase
__gmpz_sqrt
__gmpz_sub
__gmpz_sub_ui
__gmpz_tdiv_q_2exp
__gmpz_tdiv_r_2exp
__gmpz_tstbit

libhogweed-6

nettle_curve25519_mul
nettle_curve25519_mul_g
nettle_curve448_mul
nettle_curve448_mul_g
nettle_dsa_generate_params
nettle_dsa_params_clear
nettle_dsa_params_init
nettle_dsa_sign
nettle_dsa_signature_clear
nettle_dsa_signature_init
nettle_dsa_verify
nettle_ecc_bit_size
nettle_ecc_point_clear
nettle_ecc_point_get
nettle_ecc_point_init
nettle_ecc_point_mul
nettle_ecc_point_mul_g
nettle_ecc_point_set
nettle_ecc_scalar_clear
nettle_ecc_scalar_get
nettle_ecc_scalar_init
nettle_ecc_scalar_set
nettle_ecc_size
nettle_ecc_size_a
nettle_ecdsa_generate_keypair
nettle_ecdsa_sign
nettle_ecdsa_verify
nettle_ed25519_sha512_public_key
nettle_ed25519_sha512_sign
nettle_ed25519_sha512_verify
nettle_ed448_shake256_public_key
nettle_ed448_shake256_sign
nettle_ed448_shake256_verify
nettle_get_gost_gc256b
nettle_get_gost_gc512a
nettle_get_secp_192r1
nettle_get_secp_224r1
nettle_get_secp_256r1
nettle_get_secp_384r1
nettle_get_secp_521r1
nettle_gostdsa_sign
nettle_gostdsa_verify
nettle_gostdsa_vko
nettle_mpz_get_str_256
nettle_mpz_random
nettle_mpz_random_size
nettle_mpz_set_str_256_s
nettle_mpz_set_str_256_u
nettle_mpz_sizeinbase_256_s
nettle_mpz_sizeinbase_256_u
nettle_pkcs1_rsa_digest_encode
nettle_pss_encode_mgf1
nettle_rsa_decrypt_tr
nettle_rsa_encrypt
nettle_rsa_generate_keypair
nettle_rsa_pkcs1_sign_tr
nettle_rsa_pkcs1_verify
nettle_rsa_private_key_clear
nettle_rsa_private_key_init
nettle_rsa_private_key_prepare
nettle_rsa_pss_sha256_sign_digest_tr
nettle_rsa_pss_sha256_verify_digest
nettle_rsa_pss_sha384_sign_digest_tr
nettle_rsa_pss_sha384_verify_digest
nettle_rsa_pss_sha512_sign_digest_tr
nettle_rsa_pss_sha512_verify_digest
nettle_rsa_public_key_clear
nettle_rsa_public_key_init
nettle_rsa_public_key_prepare
nettle_rsa_sec_decrypt

libnettle-8

nettle_aes128_decrypt
nettle_aes128_encrypt
nettle_aes128_set_decrypt_key
nettle_aes128_set_encrypt_key
nettle_aes192_decrypt
nettle_aes192_encrypt
nettle_aes192_set_decrypt_key
nettle_aes192_set_encrypt_key
nettle_aes256_decrypt
nettle_aes256_encrypt
nettle_aes256_set_decrypt_key
nettle_aes256_set_encrypt_key
nettle_arcfour128_set_key
nettle_arcfour_crypt
nettle_arcfour_set_key
nettle_arctwo40_set_key
nettle_arctwo_decrypt
nettle_arctwo_encrypt
nettle_base64_decode_final
nettle_base64_decode_init
nettle_base64_decode_update
nettle_base64_encode_raw
nettle_camellia128_crypt
nettle_camellia128_set_encrypt_key
nettle_camellia192_set_decrypt_key
nettle_camellia192_set_encrypt_key
nettle_camellia256_crypt
nettle_camellia256_set_decrypt_key
nettle_camellia256_set_encrypt_key
nettle_camellia_set_decrypt_key
nettle_cbc_decrypt
nettle_cbc_encrypt
nettle_ccm_decrypt_message
nettle_ccm_encrypt_message
nettle_cfb8_decrypt
nettle_cfb8_encrypt
nettle_cfb_decrypt
nettle_cfb_encrypt
nettle_chacha_crypt
nettle_chacha_crypt32
nettle_chacha_poly1305_decrypt
nettle_chacha_poly1305_digest
nettle_chacha_poly1305_encrypt
nettle_chacha_poly1305_set_key
nettle_chacha_poly1305_set_nonce
nettle_chacha_poly1305_update
nettle_chacha_set_counter
nettle_chacha_set_counter32
nettle_chacha_set_key
nettle_chacha_set_nonce
nettle_chacha_set_nonce96
nettle_cmac128_digest
nettle_cmac128_init
nettle_cmac128_set_key
nettle_cmac128_update
nettle_cmac64_digest
nettle_cmac64_init
nettle_cmac64_set_key
nettle_cmac64_update
nettle_cmac_aes128_digest
nettle_cmac_aes128_set_key
nettle_cmac_aes128_update
nettle_cmac_aes256_digest
nettle_cmac_aes256_set_key
nettle_cmac_aes256_update
nettle_ctr_crypt
nettle_des3_decrypt
nettle_des3_encrypt
nettle_des3_set_key
nettle_des_decrypt
nettle_des_encrypt
nettle_des_set_key
nettle_gcm_aes128_digest
nettle_gcm_aes128_set_iv
nettle_gcm_aes128_set_key
nettle_gcm_aes128_update
nettle_gcm_aes192_digest
nettle_gcm_aes192_set_iv
nettle_gcm_aes192_set_key
nettle_gcm_aes192_update
nettle_gcm_aes256_digest
nettle_gcm_aes256_set_iv
nettle_gcm_aes256_set_key
nettle_gcm_aes256_update
nettle_gcm_camellia128_digest
nettle_gcm_camellia128_set_iv
nettle_gcm_camellia128_set_key
nettle_gcm_camellia128_update
nettle_gcm_camellia256_digest
nettle_gcm_camellia256_set_iv
nettle_gcm_camellia256_set_key
nettle_gcm_camellia256_update
nettle_gcm_decrypt
nettle_gcm_digest
nettle_gcm_encrypt
nettle_gcm_set_iv
nettle_gcm_set_key
nettle_gcm_update
nettle_gosthash94_init
nettle_gosthash94cp_digest
nettle_gosthash94cp_update
nettle_hkdf_expand
nettle_hkdf_extract
nettle_hmac_digest
nettle_hmac_gosthash94cp_digest
nettle_hmac_gosthash94cp_set_key
nettle_hmac_gosthash94cp_update
nettle_hmac_md5_digest
nettle_hmac_md5_set_key
nettle_hmac_md5_update
nettle_hmac_set_key
nettle_hmac_sha1_digest
nettle_hmac_sha1_set_key
nettle_hmac_sha1_update
nettle_hmac_sha224_digest
nettle_hmac_sha224_set_key
nettle_hmac_sha256_digest
nettle_hmac_sha256_set_key
nettle_hmac_sha256_update
nettle_hmac_sha384_digest
nettle_hmac_sha384_set_key
nettle_hmac_sha512_digest
nettle_hmac_sha512_set_key
nettle_hmac_sha512_update
nettle_hmac_streebog256_digest
nettle_hmac_streebog256_set_key
nettle_hmac_streebog512_digest
nettle_hmac_streebog512_set_key
nettle_hmac_streebog512_update
nettle_md2_digest
nettle_md2_init
nettle_md2_update
nettle_md5_digest
nettle_md5_init
nettle_md5_update
nettle_memeql_sec
nettle_memxor
nettle_memxor3
nettle_pbkdf2
nettle_salsa20_256_set_key
nettle_salsa20_crypt
nettle_salsa20r12_crypt
nettle_sha1_digest
nettle_sha1_init
nettle_sha1_update
nettle_sha224_digest
nettle_sha224_init
nettle_sha256
nettle_sha256_digest
nettle_sha256_init
nettle_sha256_update
nettle_sha384
nettle_sha384_digest
nettle_sha384_init
nettle_sha3_224_digest
nettle_sha3_224_init
nettle_sha3_224_update
nettle_sha3_256_digest
nettle_sha3_256_init
nettle_sha3_256_update
nettle_sha3_384_digest
nettle_sha3_384_init
nettle_sha3_384_update
nettle_sha3_512_digest
nettle_sha3_512_init
nettle_sha3_512_update
nettle_sha512
nettle_sha512_digest
nettle_sha512_init
nettle_sha512_update
nettle_siv_cmac_aes128_decrypt_message
nettle_siv_cmac_aes128_encrypt_message
nettle_siv_cmac_aes128_set_key
nettle_siv_cmac_aes256_decrypt_message
nettle_siv_cmac_aes256_encrypt_message
nettle_siv_cmac_aes256_set_key
nettle_streebog256_digest
nettle_streebog256_init
nettle_streebog512_digest
nettle_streebog512_init
nettle_streebog512_update
nettle_umac128_digest
nettle_umac128_set_key
nettle_umac128_set_nonce
nettle_umac128_update
nettle_umac96_digest
nettle_umac96_set_key
nettle_umac96_set_nonce
nettle_umac96_update
nettle_xts_aes128_decrypt_message
nettle_xts_aes128_encrypt_message
nettle_xts_aes128_set_decrypt_key
nettle_xts_aes128_set_encrypt_key
nettle_xts_aes256_decrypt_message
nettle_xts_aes256_encrypt_message
nettle_xts_aes256_set_decrypt_key
nettle_xts_aes256_set_encrypt_key

zlib1

compress
compressBound
uncompress

advapi32

CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptGetHashParam
CryptGetProvParam
CryptReleaseContext
CryptSetHashParam
CryptSetProvParam
CryptSignHashA

crypt32

CertCloseStore
CertDeleteCertificateFromStore
CertEnumCRLsInStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
PFXImportCertStore

kernel32

CloseHandle
CreateEventA
CreateFileA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleA
GetHandleInformation
GetLastError
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
PeekNamedPipe
RtlVirtualUnwind
SetEvent
Sleep
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_close
_dup2
_errno
_fdopen
_fileno
_findclose
_get_osfhandle
_getmaxstdio
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mkdir
_open
_open_osfhandle
_read
_setmaxstdio
_setmode
_stricmp
_time64
_unlock
_wassert
_wfindfirst64
_wfindnext64
_wfullpath
abort
atoi
atol
calloc
exit
fclose
ferror
fflush
fgetpos
fgets
fopen
fputc
fread
free
fseek
fwrite
getc
getenv
islower
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
setvbuf
strcat
strchr
strcmp
strcpy
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtol
strtoul
vfprintf
wcscat
wcscpy
wcslen

ncrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
NCryptDecrypt
NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSignHash

libwinpthread-1

pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_mutexattr_settype
pthread_once
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock

ws2_32

WSAGetLastError
WSASend
WSASetLastError
connect
inet_ntop
inet_pton
recv
select
send
setsockopt

libgcc_s_seh-1

__emutls_get_address

Exports

Exports

_dsa_generate_dss_g
_dsa_generate_dss_pq
_dsa_validate_dss_g
_dsa_validate_dss_pq
_gnutls13_psk_ext_iter_next_binder
_gnutls13_psk_ext_iter_next_identity
_gnutls13_psk_ext_parser_init
_gnutls_anti_replay_check
_gnutls_bin2hex
_gnutls_buffer_append_str
_gnutls_buffer_clear
_gnutls_buffer_init
_gnutls_buffer_pop_datum
_gnutls_buffer_to_datum
_gnutls_buffer_unescape
_gnutls_cidr_to_string
_gnutls_cipher_get_iv
_gnutls_cipher_to_entry
_gnutls_crypto_register_cipher
_gnutls_decode_ber_rs_raw
_gnutls_default_priority_string
_gnutls_digest_exists
_gnutls_ecc_curve_is_supported
_gnutls_encode_ber_rs_raw
_gnutls_global_set_gettime_function
_gnutls_global_version
_gnutls_hello_set_default_version
_gnutls_iov_iter_init
_gnutls_iov_iter_next
_gnutls_iov_iter_sync
_gnutls_ip_to_string
_gnutls_lib_force_operational
_gnutls_lib_simulate_error
_gnutls_log
_gnutls_log_level
_gnutls_mac_to_entry
_gnutls_mpi_log
_gnutls_mpi_ops
_gnutls_pkcs12_string_to_key
_gnutls_prf_raw
_gnutls_record_overhead
_gnutls_record_set_default_version
_gnutls_resolve_priorities
_gnutls_rsa_pms_set_version
_gnutls_server_name_set_raw
_gnutls_set_session_ticket_key_rotation_callback
_gnutls_supplemental_deinit
_gnutls_ucs2_to_utf8
_gnutls_utcTime2gtime
_gnutls_utf8_to_ucs2
_gnutls_version_to_entry
_gnutls_x509_generalTime2gtime
_gnutls_x509_name_constraints_merge
_rsa_generate_fips186_4_keypair
dsa_generate_dss_keypair
gnutls_aead_cipher_decrypt
gnutls_aead_cipher_decryptv2
gnutls_aead_cipher_deinit
gnutls_aead_cipher_encrypt
gnutls_aead_cipher_encryptv
gnutls_aead_cipher_encryptv2
gnutls_aead_cipher_init
gnutls_aead_cipher_set_key
gnutls_alert_get
gnutls_alert_get_name
gnutls_alert_get_strname
gnutls_alert_send
gnutls_alert_send_appropriate
gnutls_alert_set_read_function
gnutls_alpn_get_selected_protocol
gnutls_alpn_set_protocols
gnutls_anti_replay_deinit
gnutls_anti_replay_enable
gnutls_anti_replay_init
gnutls_anti_replay_set_add_function
gnutls_anti_replay_set_ptr
gnutls_anti_replay_set_window
gnutls_auth_client_get_type
gnutls_auth_get_type
gnutls_auth_server_get_type
gnutls_base64_decode2
gnutls_base64_encode2
gnutls_buffer_append_data
gnutls_bye
gnutls_calloc
gnutls_certificate_activation_time_peers
gnutls_certificate_allocate_credentials
gnutls_certificate_client_get_request_status
gnutls_certificate_expiration_time_peers
gnutls_certificate_free_ca_names
gnutls_certificate_free_cas
gnutls_certificate_free_credentials
gnutls_certificate_free_crls
gnutls_certificate_free_keys
gnutls_certificate_get_crt_raw
gnutls_certificate_get_issuer
gnutls_certificate_get_ocsp_expiration
gnutls_certificate_get_openpgp_crt
gnutls_certificate_get_openpgp_key
gnutls_certificate_get_ours
gnutls_certificate_get_peers
gnutls_certificate_get_peers_subkey_id
gnutls_certificate_get_trust_list
gnutls_certificate_get_verify_flags
gnutls_certificate_get_x509_crt
gnutls_certificate_get_x509_key
gnutls_certificate_send_x509_rdn_sequence
gnutls_certificate_server_set_request
gnutls_certificate_set_dh_params
gnutls_certificate_set_flags
gnutls_certificate_set_key
gnutls_certificate_set_known_dh_params
gnutls_certificate_set_ocsp_status_request_file
gnutls_certificate_set_ocsp_status_request_file2
gnutls_certificate_set_ocsp_status_request_function
gnutls_certificate_set_ocsp_status_request_function2
gnutls_certificate_set_ocsp_status_request_mem
gnutls_certificate_set_openpgp_key
gnutls_certificate_set_openpgp_key_file
gnutls_certificate_set_openpgp_key_file2
gnutls_certificate_set_openpgp_key_mem
gnutls_certificate_set_openpgp_key_mem2
gnutls_certificate_set_openpgp_keyring_file
gnutls_certificate_set_openpgp_keyring_mem
gnutls_certificate_set_params_function
gnutls_certificate_set_pin_function
gnutls_certificate_set_rawpk_key_file
gnutls_certificate_set_rawpk_key_mem
gnutls_certificate_set_retrieve_function
gnutls_certificate_set_retrieve_function2
gnutls_certificate_set_retrieve_function3
gnutls_certificate_set_trust_list
gnutls_certificate_set_verify_flags
gnutls_certificate_set_verify_function
gnutls_certificate_set_verify_limits
gnutls_certificate_set_x509_crl
gnutls_certificate_set_x509_crl_file
gnutls_certificate_set_x509_crl_mem
gnutls_certificate_set_x509_key
gnutls_certificate_set_x509_key_file
gnutls_certificate_set_x509_key_file2
gnutls_certificate_set_x509_key_mem
gnutls_certificate_set_x509_key_mem2
gnutls_certificate_set_x509_simple_pkcs12_file
gnutls_certificate_set_x509_simple_pkcs12_mem
gnutls_certificate_set_x509_system_trust
gnutls_certificate_set_x509_trust
gnutls_certificate_set_x509_trust_dir
gnutls_certificate_set_x509_trust_file
gnutls_certificate_set_x509_trust_mem
gnutls_certificate_type_get
gnutls_certificate_type_get2
gnutls_certificate_type_get_id
gnutls_certificate_type_get_name
gnutls_certificate_type_list
gnutls_certificate_verification_profile_get_id
gnutls_certificate_verification_profile_get_name
gnutls_certificate_verification_status_print
gnutls_certificate_verify_peers
gnutls_certificate_verify_peers2
gnutls_certificate_verify_peers3
gnutls_check_version
gnutls_cipher_add_auth
gnutls_cipher_decrypt
gnutls_cipher_decrypt2
gnutls_cipher_decrypt3
gnutls_cipher_deinit
gnutls_cipher_encrypt
gnutls_cipher_encrypt2
gnutls_cipher_encrypt3
gnutls_cipher_get
gnutls_cipher_get_block_size
gnutls_cipher_get_id
gnutls_cipher_get_iv_size
gnutls_cipher_get_key_size
gnutls_cipher_get_name
gnutls_cipher_get_tag_size
gnutls_cipher_init
gnutls_cipher_list
gnutls_cipher_self_test
gnutls_cipher_set_iv
gnutls_cipher_suite_get_name
gnutls_cipher_suite_info
gnutls_cipher_tag
gnutls_ciphersuite_get
gnutls_compress_certificate_get_selected_method
gnutls_compress_certificate_set_methods
gnutls_compression_get
gnutls_compression_get_id
gnutls_compression_get_name
gnutls_compression_list
gnutls_credentials_clear
gnutls_credentials_get
gnutls_credentials_set
gnutls_crypto_register_aead_cipher
gnutls_crypto_register_cipher
gnutls_crypto_register_digest
gnutls_crypto_register_mac
gnutls_db_check_entry
gnutls_db_check_entry_expire_time
gnutls_db_check_entry_time
gnutls_db_get_default_cache_expiration
gnutls_db_get_ptr
gnutls_db_remove_session
gnutls_db_set_cache_expiration
gnutls_db_set_ptr
gnutls_db_set_remove_function
gnutls_db_set_retrieve_function
gnutls_db_set_store_function
gnutls_decode_ber_digest_info
gnutls_decode_gost_rs_value
gnutls_decode_rs_value
gnutls_deinit
gnutls_dh_get_group
gnutls_dh_get_peers_public_bits
gnutls_dh_get_prime_bits
gnutls_dh_get_pubkey
gnutls_dh_get_secret_bits
gnutls_dh_params_cpy
gnutls_dh_params_deinit
gnutls_dh_params_export2_pkcs3
gnutls_dh_params_export_pkcs3
gnutls_dh_params_export_raw
gnutls_dh_params_generate2
gnutls_dh_params_import_dsa
gnutls_dh_params_import_pkcs3
gnutls_dh_params_import_raw
gnutls_dh_params_import_raw2
gnutls_dh_params_import_raw3
gnutls_dh_params_init
gnutls_dh_set_prime_bits
gnutls_digest_get_id
gnutls_digest_get_name
gnutls_digest_get_oid
gnutls_digest_list
gnutls_digest_self_test
gnutls_digest_set_secure
gnutls_dtls_cookie_send
gnutls_dtls_cookie_verify
gnutls_dtls_get_data_mtu
gnutls_dtls_get_mtu
gnutls_dtls_get_timeout
gnutls_dtls_prestate_set
gnutls_dtls_set_data_mtu
gnutls_dtls_set_mtu
gnutls_dtls_set_timeouts
gnutls_early_cipher_get
gnutls_early_prf_hash_get
gnutls_ecc_curve_get
gnutls_ecc_curve_get_id
gnutls_ecc_curve_get_name
gnutls_ecc_curve_get_oid
gnutls_ecc_curve_get_pk
gnutls_ecc_curve_get_size
gnutls_ecc_curve_list
gnutls_ecc_curve_set_enabled
gnutls_encode_ber_digest_info
gnutls_encode_gost_rs_value
gnutls_encode_rs_value
gnutls_error_is_fatal
gnutls_error_to_alert
gnutls_est_record_overhead_size
gnutls_ext_get_current_msg
gnutls_ext_get_data
gnutls_ext_get_name
gnutls_ext_get_name2
gnutls_ext_raw_parse
gnutls_ext_register
gnutls_ext_set_data
gnutls_ffdhe_2048_group_generator
gnutls_ffdhe_2048_group_prime
gnutls_ffdhe_2048_group_q
gnutls_ffdhe_2048_key_bits
gnutls_ffdhe_3072_group_generator
gnutls_ffdhe_3072_group_prime
gnutls_ffdhe_3072_group_q
gnutls_ffdhe_3072_key_bits
gnutls_ffdhe_4096_group_generator
gnutls_ffdhe_4096_group_prime
gnutls_ffdhe_4096_group_q
gnutls_ffdhe_4096_key_bits
gnutls_ffdhe_6144_group_generator
gnutls_ffdhe_6144_group_prime
gnutls_ffdhe_6144_group_q
gnutls_ffdhe_6144_key_bits
gnutls_ffdhe_8192_group_generator
gnutls_ffdhe_8192_group_prime
gnutls_ffdhe_8192_group_q
gnutls_ffdhe_8192_key_bits
gnutls_fingerprint
gnutls_fips140_context_deinit
gnutls_fips140_context_init
gnutls_fips140_get_operation_state
gnutls_fips140_mode_enabled
gnutls_fips140_pop_context
gnutls_fips140_push_context
gnutls_fips140_run_self_tests
gnutls_fips140_set_mode
gnutls_free
gnutls_get_library_config
gnutls_get_system_config_file
gnutls_global_deinit
gnutls_global_init
gnutls_global_set_audit_log_function
gnutls_global_set_log_function
gnutls_global_set_log_level
gnutls_global_set_mem_functions
gnutls_global_set_mutex
gnutls_global_set_time_function
gnutls_gost_paramset_get_name
gnutls_gost_paramset_get_oid
gnutls_group_get
gnutls_group_get_id
gnutls_group_get_name
gnutls_group_list
gnutls_handshake
gnutls_handshake_description_get_name
gnutls_handshake_get_last_in
gnutls_handshake_get_last_out
gnutls_handshake_set_hook_function
gnutls_handshake_set_max_packet_length
gnutls_handshake_set_post_client_hello_function
gnutls_handshake_set_private_extensions
gnutls_handshake_set_random
gnutls_handshake_set_read_function
gnutls_handshake_set_secret_function
gnutls_handshake_set_timeout
gnutls_handshake_write
gnutls_hash
gnutls_hash_copy
gnutls_hash_deinit
gnutls_hash_fast
gnutls_hash_get_len
gnutls_hash_init
gnutls_hash_output
gnutls_heartbeat_allowed
gnutls_heartbeat_enable
gnutls_heartbeat_get_timeout
gnutls_heartbeat_ping
gnutls_heartbeat_pong
gnutls_heartbeat_set_timeouts
gnutls_hex2bin
gnutls_hex_decode
gnutls_hex_decode2
gnutls_hex_encode
gnutls_hex_encode2
gnutls_hkdf_expand
gnutls_hkdf_extract
gnutls_hkdf_self_test
gnutls_hmac
gnutls_hmac_copy
gnutls_hmac_deinit
gnutls_hmac_fast
gnutls_hmac_get_key_size
gnutls_hmac_get_len
gnutls_hmac_init
gnutls_hmac_output
gnutls_hmac_set_nonce
gnutls_idna_map
gnutls_idna_reverse_map
gnutls_init
gnutls_key_generate
gnutls_kx_get
gnutls_kx_get_id
gnutls_kx_get_name
gnutls_kx_list
gnutls_load_file
gnutls_mac_get
gnutls_mac_get_id
gnutls_mac_get_key_size
gnutls_mac_get_name
gnutls_mac_get_nonce_size
gnutls_mac_list
gnutls_mac_self_test
gnutls_malloc
gnutls_memcmp
gnutls_memset
gnutls_ocsp_req_add_cert
gnutls_ocsp_req_add_cert_id
gnutls_ocsp_req_deinit
gnutls_ocsp_req_export
gnutls_ocsp_req_get_cert_id
gnutls_ocsp_req_get_extension
gnutls_ocsp_req_get_nonce
gnutls_ocsp_req_get_version
gnutls_ocsp_req_import
gnutls_ocsp_req_init
gnutls_ocsp_req_print
gnutls_ocsp_req_randomize_nonce
gnutls_ocsp_req_set_extension
gnutls_ocsp_req_set_nonce
gnutls_ocsp_resp_check_crt
gnutls_ocsp_resp_deinit
gnutls_ocsp_resp_export
gnutls_ocsp_resp_export2
gnutls_ocsp_resp_get_certs
gnutls_ocsp_resp_get_extension
gnutls_ocsp_resp_get_nonce
gnutls_ocsp_resp_get_produced
gnutls_ocsp_resp_get_responder
gnutls_ocsp_resp_get_responder2
gnutls_ocsp_resp_get_responder_raw_id
gnutls_ocsp_resp_get_response
gnutls_ocsp_resp_get_signature
gnutls_ocsp_resp_get_signature_algorithm
gnutls_ocsp_resp_get_single
gnutls_ocsp_resp_get_status
gnutls_ocsp_resp_get_version
gnutls_ocsp_resp_import
gnutls_ocsp_resp_import2
gnutls_ocsp_resp_init
gnutls_ocsp_resp_list_import2
gnutls_ocsp_resp_print
gnutls_ocsp_resp_verify
gnutls_ocsp_resp_verify_direct
gnutls_ocsp_status_request_enable_client
gnutls_ocsp_status_request_get
gnutls_ocsp_status_request_get2
gnutls_ocsp_status_request_is_checked
gnutls_oid_to_digest
gnutls_oid_to_ecc_curve
gnutls_oid_to_gost_paramset
gnutls_oid_to_mac
gnutls_oid_to_pk
gnutls_oid_to_sign
gnutls_openpgp_crt_check_email
gnutls_openpgp_crt_check_hostname
gnutls_openpgp_crt_check_hostname2
gnutls_openpgp_crt_deinit
gnutls_openpgp_crt_export
gnutls_openpgp_crt_export2
gnutls_openpgp_crt_get_auth_subkey
gnutls_openpgp_crt_get_creation_time
gnutls_openpgp_crt_get_expiration_time
gnutls_openpgp_crt_get_fingerprint
gnutls_openpgp_crt_get_key_id
gnutls_openpgp_crt_get_key_usage
gnutls_openpgp_crt_get_name
gnutls_openpgp_crt_get_pk_algorithm
gnutls_openpgp_crt_get_pk_dsa_raw
gnutls_openpgp_crt_get_pk_rsa_raw
gnutls_openpgp_crt_get_preferred_key_id
gnutls_openpgp_crt_get_revoked_status
gnutls_openpgp_crt_get_subkey_count
gnutls_openpgp_crt_get_subkey_creation_time
gnutls_openpgp_crt_get_subkey_expiration_time
gnutls_openpgp_crt_get_subkey_fingerprint
gnutls_openpgp_crt_get_subkey_id
gnutls_openpgp_crt_get_subkey_idx
gnutls_openpgp_crt_get_subkey_pk_algorithm
gnutls_openpgp_crt_get_subkey_pk_dsa_raw
gnutls_openpgp_crt_get_subkey_pk_rsa_raw
gnutls_openpgp_crt_get_subkey_revoked_status
gnutls_openpgp_crt_get_subkey_usage
gnutls_openpgp_crt_get_version
gnutls_openpgp_crt_import
gnutls_openpgp_crt_init
gnutls_openpgp_crt_print
gnutls_openpgp_crt_set_preferred_key_id
gnutls_openpgp_crt_verify_ring
gnutls_openpgp_crt_verify_self
gnutls_openpgp_keyring_check_id
gnutls_openpgp_keyring_deinit
gnutls_openpgp_keyring_get_crt
gnutls_openpgp_keyring_get_crt_count
gnutls_openpgp_keyring_import
gnutls_openpgp_keyring_init
gnutls_openpgp_privkey_deinit
gnutls_openpgp_privkey_export
gnutls_openpgp_privkey_export2
gnutls_openpgp_privkey_export_dsa_raw
gnutls_openpgp_privkey_export_rsa_raw
gnutls_openpgp_privkey_export_subkey_dsa_raw
gnutls_openpgp_privkey_export_subkey_rsa_raw
gnutls_openpgp_privkey_get_fingerprint
gnutls_openpgp_privkey_get_key_id
gnutls_openpgp_privkey_get_pk_algorithm
gnutls_openpgp_privkey_get_preferred_key_id
gnutls_openpgp_privkey_get_revoked_status
gnutls_openpgp_privkey_get_subkey_count
gnutls_openpgp_privkey_get_subkey_creation_time
gnutls_openpgp_privkey_get_subkey_expiration_time
gnutls_openpgp_privkey_get_subkey_fingerprint
gnutls_openpgp_privkey_get_subkey_id
gnutls_openpgp_privkey_get_subkey_idx
gnutls_openpgp_privkey_get_subkey_pk_algorithm
gnutls_openpgp_privkey_get_subkey_revoked_status
gnutls_openpgp_privkey_import
gnutls_openpgp_privkey_init
gnutls_openpgp_privkey_sec_param
gnutls_openpgp_privkey_set_preferred_key_id
gnutls_openpgp_privkey_sign_hash
gnutls_openpgp_send_cert
gnutls_openpgp_set_recv_key_function
gnutls_packet_deinit
gnutls_packet_get
gnutls_pbkdf2
gnutls_pbkdf2_self_test
gnutls_pcert_deinit
gnutls_pcert_export_openpgp

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 687KB - Virtual size: 686KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcore.dll
.dll regsvr32 windows x64

bb755df87764d426164a520063f1c78e

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05-05-2022 19:23

Not After

04-05-2023 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

97:48:79:65:00:db:cd:8b:21:4c:da:3c:cb:d2:00:19:82:c2:db:98:73:42:ed:ed:08:74:b1:a4:d7:32:5c:a9
Signer

Actual PE Digest

97:48:79:65:00:db:cd:8b:21:4c:da:3c:cb:d2:00:19:82:c2:db:98:73:42:ed:ed:08:74:b1:a4:d7:32:5c:a9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02-02-2023 17:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_unlock
wcsncmp
_lock
strnlen
sqrt
sin
strncpy_s
_ultow_s
wcsstr
isprint
qsort
swscanf_s
__dllonexit
_wcslwr_s
towlower
srand
time
rand
_wcsicmp
_ui64tow_s
_wcsnicmp
towupper
sqrtf
_wsplitpath_s
?terminate@@YAXXZ
_onexit
_initterm
_amsg_exit
_XcptFilter
_gcvt_s
_ultoa_s
__C_specific_handler
realloc
_errno
_ltoa_s
__CxxFrameHandler3
memmove_s
_callnewh
_vsnprintf
_i64toa_s
_vsnwprintf
wcsncpy_s
iswdigit
iswalpha
malloc
free
_purecall
memset
memmove
memcpy
memcmp
wcscat_s
wcscpy_s
memcpy_s
_vscprintf
ceil
cos
floor
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
GetModuleHandleA
LoadLibraryExW
LoadLibraryExA
GetProcAddress
LoadResource
GetModuleFileNameA
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
SizeofResource

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
TryEnterCriticalSection
InitializeSRWLock
ReleaseMutex
WaitForSingleObject
OpenEventW
AcquireSRWLockExclusive
DeleteCriticalSection
CreateEventW
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSRWLockShared
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockExclusive
ResetEvent
CreateEventExW
AcquireSRWLockShared
WaitForSingleObjectEx
OpenSemaphoreW

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegQueryValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegSetValueExW

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableSRW
Sleep

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
VirtualQueryEx
CreateFileMappingW
MapViewOfFile
VirtualAlloc
VirtualFree
UnmapViewOfFile
MapViewOfFileEx

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThread
GetCurrentProcess
OpenProcessToken
GetExitCodeProcess
TerminateProcess
ProcessIdToSessionId
CreateProcessW
TlsSetValue
GetCurrentThreadId
TlsGetValue
GetCurrentProcessId

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlAddFunctionTable

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapSize

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsValidLocaleName

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExA
GetSystemDirectoryW
GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

crypt32

CryptBinaryToStringA

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
IsWow64Process
Wow64DisableWow64FsRedirection

api-ms-win-core-file-l1-1-0

GetFileSize
ReadFile
CreateFileA
CreateFileW
GetFinalPathNameByHandleW
GetFullPathNameW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
EqualSid
PrivilegeCheck

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-io-l1-1-0

CancelIoEx
DeviceIoControl
GetOverlappedResult

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-largeinteger-l1-1-0

MulDiv

ntdll

RtlNtStatusToDosError
NtQuerySystemInformation
NtQueryInformationProcess

cfgmgr32

CM_Get_Device_Interface_AliasW

ksuser

KsCreateClock2
KsCreatePin2

api-ms-win-appmodel-runtime-l1-1-2

AppPolicyGetLifecycleManagement
AppPolicyGetWindowingModel
AppPolicyGetMediaFoundationCodecLoading

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

bcrypt

BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyKey
BCryptVerifySignature
BCryptImportKeyPair
BCryptCloseAlgorithmProvider

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-file-l2-1-0

CopyFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AppendPropVariant
ConvertPropVariant
CopyPropertyStore
CreateNamedPropertyStore
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ExtractPropVariant
MFCopyMFMetadata
MFCopyPropertyStore
MFCopyStreamMetadata
MFCreateAggregateSource
MFCreateAppSourceProxy
MFCreateAudioRenderer
MFCreateAudioRendererActivate
MFCreateDeviceSource
MFCreateDeviceSourceActivate
MFCreateEncryptedMediaExtensionsStoreActivate
MFCreateExtendedCameraIntrinsicModel
MFCreateExtendedCameraIntrinsics
MFCreateFileSchemePlugin
MFCreateMFMetadataOnPropertyStore
MFCreateMediaProcessor
MFCreateMediaSession
MFCreatePMPHost
MFCreatePMPMediaSession
MFCreatePMPServer
MFCreatePresentationClock
MFCreateSampleCopierMFT
MFCreateSampleGrabberSinkActivate
MFCreateSequencerSegmentOffset
MFCreateSequencerSource
MFCreateSequencerSourceRemoteStream
MFCreateSimpleTypeHandler
MFCreateSoundEventSchemePlugin
MFCreateStandardQualityManager
MFCreateTopoLoader
MFCreateTopology
MFCreateTopologyNode
MFCreateTransformWrapper
MFCreateWMAEncoderActivate
MFCreateWMVEncoderActivate
MFEnumDeviceSources
MFGetMultipleServiceProviders
MFGetService
MFGetTopoNodeCurrentType
MFReadSequencerSegmentOffset
MFRequireProtectedEnvironment
MFShutdownObject
MergePropertyStore

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

?g_Encry
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 407KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfcsubs.dll
.dll windows x64

30c7cb39213bf552e9d5798b2c47de50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

malloc
free
_amsg_exit
__CxxFrameHandler3
__C_specific_handler
_XcptFilter
_purecall
iswspace
?terminate@@YAXXZ
memmove
_vsnwprintf
iswdigit
_wtoi
wcsstr
wcsrchr
wcscspn
wcsspn
_wcsrev
_wcslwr
_wcsupr
wcspbrk
wcschr
wcscoll
_wcsicmp
_initterm
memcpy
memset

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

Exports

Exports

??$ConstructElements@VCString@@@@YAXPEAVCString@@H@Z
??$CopyElements@VCString@@@@YAXPEAVCString@@PEBV0@H@Z
??$DestructElements@VCString@@@@YAXPEAVCString@@H@Z
??$HashKey@AEBU_GUID@@@@YAIAEBU_GUID@@@Z
??$HashKey@PEBD@@YAIPEBD@Z
??$HashKey@PEBG@@YAIPEBG@Z
??0CCriticalSection@@QEAA@XZ
??0CMapStringToPtr@@QEAA@H@Z
??0CObject@@IEAA@XZ
??0CString@@QEAA@AEBV0@@Z
??0CString@@QEAA@GH@Z
??0CString@@QEAA@PEBD@Z
??0CString@@QEAA@PEBE@Z
??0CString@@QEAA@PEBG@Z
??0CString@@QEAA@PEBGH@Z
??0CString@@QEAA@XZ
??0CStringArray@@QEAA@XZ
??0CSyncObject@@QEAA@PEBG@Z
??1CCriticalSection@@UEAA@XZ
??1CMapStringToPtr@@UEAA@XZ
??1CObject@@UEAA@XZ
??1CString@@QEAA@XZ
??1CStringArray@@UEAA@XZ
??1CSyncObject@@UEAA@XZ
??4CPlex@@QEAAAEAU0@$$QEAU0@@Z
??4CPlex@@QEAAAEAU0@AEBU0@@Z
??4CString@@QEAAAEBV0@AEBV0@@Z
??4CString@@QEAAAEBV0@D@Z
??4CString@@QEAAAEBV0@G@Z
??4CString@@QEAAAEBV0@PEBD@Z
??4CString@@QEAAAEBV0@PEBE@Z
??4CString@@QEAAAEBV0@PEBG@Z
??8@YA_NAEBVCString@@0@Z
??8@YA_NAEBVCString@@PEBG@Z
??8@YA_NPEBGAEBVCString@@@Z
??9@YA_NAEBVCString@@0@Z
??9@YA_NAEBVCString@@PEBG@Z
??9@YA_NPEBGAEBVCString@@@Z
??ACMapStringToPtr@@QEAAAEAPEAXPEBG@Z
??ACString@@QEBAGH@Z
??ACStringArray@@QEAAAEAVCString@@H@Z
??ACStringArray@@QEBA?AVCString@@H@Z
??BCCriticalSection@@QEAAPEAU_RTL_CRITICAL_SECTION@@XZ
??BCString@@QEBAPEBGXZ
??BCSyncObject@@QEBAPEAXXZ
??H@YA?AVCString@@AEBV0@0@Z
??H@YA?AVCString@@AEBV0@D@Z
??H@YA?AVCString@@AEBV0@G@Z
??H@YA?AVCString@@AEBV0@PEBG@Z
??H@YA?AVCString@@DAEBV0@@Z
??H@YA?AVCString@@GAEBV0@@Z
??H@YA?AVCString@@PEBGAEBV0@@Z
??M@YA_NAEBVCString@@0@Z
??M@YA_NAEBVCString@@PEBG@Z
??M@YA_NPEBGAEBVCString@@@Z
??N@YA_NAEBVCString@@0@Z
??N@YA_NAEBVCString@@PEBG@Z
??N@YA_NPEBGAEBVCString@@@Z
??O@YA_NAEBVCString@@0@Z
??O@YA_NAEBVCString@@PEBG@Z
??O@YA_NPEBGAEBVCString@@@Z
??P@YA_NAEBVCString@@0@Z
??P@YA_NAEBVCString@@PEBG@Z
??P@YA_NPEBGAEBVCString@@@Z
??YCString@@QEAAAEBV0@AEBV0@@Z
??YCString@@QEAAAEBV0@D@Z
??YCString@@QEAAAEBV0@G@Z
??YCString@@QEAAAEBV0@PEBG@Z
??_7CCriticalSection@@6B@
??_7CMapStringToPtr@@6B@
??_7CObject@@6B@
??_7CStringArray@@6B@
??_7CSyncObject@@6B@
??_FCMapStringToPtr@@QEAAXXZ
?Add@CStringArray@@QEAAHPEBG@Z
?AfxExtractSubString@@YAHAEAVCString@@PEBGHG@Z
?AfxGetEmptyString@@YAAEBVCString@@XZ
?AfxLoadString@@YAHIPEAGI@Z
?AllocBeforeWrite@CString@@IEAAXH@Z
?AllocBuffer@CString@@IEAAXH@Z
?AllocCopy@CString@@IEBAXAEAV1@III@Z
?Append@CStringArray@@QEAAHAEBV1@@Z
?AssignCopy@CString@@IEAAXHPEBG@Z
?Collate@CString@@QEBAHPEBG@Z
?Compare@CString@@QEBAHPEBG@Z
?CompareNoCase@CString@@QEBAHPEBG@Z
?ConcatCopy@CString@@IEAAXHPEBGH0@Z
?ConcatInPlace@CString@@IEAAXHPEBG@Z
?Copy@CStringArray@@QEAAXAEBV1@@Z
?CopyBeforeWrite@CString@@IEAAXXZ
?Create@CPlex@@SAPEAU1@AEAPEAU1@II@Z
?ElementAt@CStringArray@@QEAAAEAVCString@@H@Z
?Empty@CString@@QEAAXXZ
?Find@CString@@QEBAHG@Z
?Find@CString@@QEBAHPEBG@Z
?FindOneOf@CString@@QEBAHPEBG@Z
?Format@CString@@QEAAXIZZ
?Format@CString@@QEAAXPEBGZZ
?FormatMessageW@CString@@QEAAXIZZ
?FormatMessageW@CString@@QEAAXPEBGZZ
?FormatV@CString@@IEAAXPEBGPEAD@Z
?FreeAssoc@CMapStringToPtr@@IEAAXPEAUCAssoc@1@@Z
?FreeDataChain@CPlex@@QEAAXXZ
?FreeExtra@CString@@QEAAXXZ
?FreeExtra@CStringArray@@QEAAXXZ
?GetAllocLength@CString@@QEBAHXZ
?GetAssocAt@CMapStringToPtr@@IEBAPEAUCAssoc@1@PEBGAEAI@Z
?GetAt@CString@@QEBAGH@Z
?GetAt@CStringArray@@QEBA?AVCString@@H@Z
?GetBuffer@CString@@QEAAPEAGH@Z
?GetBufferSetLength@CString@@QEAAPEAGH@Z
?GetCount@CMapStringToPtr@@QEBAHXZ
?GetData@CString@@IEBAPEAUCStringData@@XZ
?GetData@CStringArray@@QEAAPEAVCString@@XZ
?GetData@CStringArray@@QEBAPEBVCString@@XZ
?GetHashTableSize@CMapStringToPtr@@QEBAIXZ
?GetLength@CString@@QEBAHXZ
?GetNextAssoc@CMapStringToPtr@@QEBAXAEAPEAU__POSITION@@AEAVCString@@AEAPEAX@Z
?GetSize@CStringArray@@QEBAHXZ
?GetStartPosition@CMapStringToPtr@@QEBAPEAU__POSITION@@XZ
?GetUpperBound@CStringArray@@QEBAHXZ
?HashKey@CMapStringToPtr@@QEBAIPEBG@Z
?Init@CString@@IEAAXXZ
?InitHashTable@CMapStringToPtr@@QEAAXIH@Z
?InsertAt@CStringArray@@QEAAXHPEAV1@@Z
?InsertAt@CStringArray@@QEAAXHPEBGH@Z
?IsEmpty@CMapStringToPtr@@QEBAHXZ
?IsEmpty@CString@@QEBAHXZ
?Left@CString@@QEBA?AV1@H@Z
?LoadStringW@CString@@QEAAHI@Z
?Lock@CCriticalSection@@QEAAHXZ
?Lock@CCriticalSection@@UEAAHK@Z
?Lock@CSyncObject@@UEAAHK@Z
?LockBuffer@CString@@QEAAPEAGXZ
?Lookup@CMapStringToPtr@@QEBAHPEBGAEAPEAX@Z
?LookupKey@CMapStringToPtr@@QEBAHPEBGAEAPEBG@Z
?MakeLower@CString@@QEAAXXZ
?MakeReverse@CString@@QEAAXXZ
?MakeUpper@CString@@QEAAXXZ
?Mid@CString@@QEBA?AV1@H@Z
?Mid@CString@@QEBA?AV1@HH@Z
?NewAssoc@CMapStringToPtr@@IEAAPEAUCAssoc@1@XZ
?Release@CString@@IEAAXXZ
?Release@CString@@KAXPEAUCStringData@@@Z
?ReleaseBuffer@CString@@QEAAXH@Z
?RemoveAll@CMapStringToPtr@@QEAAXXZ
?RemoveAll@CStringArray@@QEAAXXZ
?RemoveAt@CStringArray@@QEAAXHH@Z
?RemoveKey@CMapStringToPtr@@QEAAHPEBG@Z
?ReverseFind@CString@@QEBAHG@Z
?Right@CString@@QEBA?AV1@H@Z
?SafeStrlen@CString@@KAHPEBG@Z
?SetAt@CMapStringToPtr@@QEAAXPEBGPEAX@Z
?SetAt@CString@@QEAAXHG@Z
?SetAt@CStringArray@@QEAAXHPEBG@Z
?SetAtGrow@CStringArray@@QEAAXHPEBG@Z
?SetSize@CStringArray@@QEAAXHH@Z
?SpanExcluding@CString@@QEBA?AV1@PEBG@Z
?SpanIncluding@CString@@QEBA?AV1@PEBG@Z
?TrimLeft@CString@@QEAAXXZ
?TrimRight@CString@@QEAAXXZ
?Unlock@CCriticalSection@@UEAAHXZ
?Unlock@CSyncObject@@UEAAHJPEAJ@Z
?UnlockBuffer@CString@@QEAAXXZ
?data@CPlex@@QEAAPEAXXZ

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfds.dll
.dll regsvr32 windows x64

57d7b97c9bb98b4b08ebf6acadfa64e1

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:44:62:f2:fe:ba:aa:17:d5:10:2d:0f:41:a9:a3:81:85:a5:48:72:54:4a:49:e9:0e:9a:fa:c8:e8:e1:10:36
Signer

Actual PE Digest

d9:44:62:f2:fe:ba:aa:17:d5:10:2d:0f:41:a9:a3:81:85:a5:48:72:54:4a:49:e9:0e:9a:fa:c8:e8:e1:10:36

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02-02-2023 17:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_purecall
memmove
wcscmp
_onexit
_lock
__dllonexit
_unlock
realloc
wcscat_s
wcscpy_s
_errno
memmove_s
free
malloc
towlower
_wcsicmp
iswdigit
_initterm
_ultoa_s
_wcsnicmp
wcsrchr
towupper
wcsncmp
_vsnprintf
wcsstr
_wcslwr
_ltoa_s
_i64toa_s
_gcvt_s
qsort
strncpy_s
strnlen
swprintf_s
__CxxFrameHandler3
_vsnwprintf_s
_wtoi
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
wcsncpy_s
_amsg_exit
__C_specific_handler
memcpy_s
calloc
memcpy
_XcptFilter
wcslen
memset
memcmp
iswalpha
_callnewh

oleaut32

SafeArrayUnaccessData
VariantClear
SafeArrayAccessData
SafeArrayCreate
SysAllocStringLen
VarUI4FromStr
SafeArrayDestroy
SysFreeString

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
ResetEvent
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetEvent
InitializeSRWLock
WaitForSingleObject
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
AcquireSRWLockShared
CreateEventW
CreateSemaphoreExW
WaitForMultipleObjectsEx
ReleaseSemaphore
OpenEventW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateThread
GetCurrentProcessId
GetCurrentThreadId
TlsGetValue
SetThreadPriority
GetCurrentThread
GetThreadPriority
TlsSetValue

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitializeEx
CoFreeUnusedLibraries
PropVariantCopy
CoCreateGuid
IIDFromString
CoTaskMemFree
StringFromGUID2
StringFromCLSID
CreateStreamOnHGlobal
PropVariantClear

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
SizeofResource
LoadLibraryExW
GetProcAddress
FindResourceExW
GetModuleHandleW
LoadResource
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegGetValueW
RegCloseKey

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW
lstrlenW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-mm-time-l1-1-0

timeGetTime
timeGetDevCaps
timeEndPeriod
timeBeginPeriod

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRelativeW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-file-l1-1-0

CreateFileW
WriteFile
GetFullPathNameW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW

api-ms-win-security-base-l1-1-0

FreeSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OpenFileMappingW
VirtualFree
VirtualAlloc

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch

api-ms-win-appmodel-runtime-l1-1-0

GetCurrentPackageFamilyName

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitAACAudioStream_
InitAC3AudioStream_
InitBDAVLPCMAudioStream_
InitDDPlusAudioStream_
InitDTSAudioStream_
InitH264Stream_
InitHEVCStream_
InitLPCMAudioStream_
InitLPCMMiracastAudioStream_
InitMpeg1VideoStream_
InitMpeg2VideoStream_
InitMpegAudioStream_
InitTrueHDAudioStream_
PESHeaderLength
PESPacketLength
PESPacketPTSinPCR
PackMuxRate
PackSCR
xCreateCannedMediaType
xMediaSubTypeTransform

Sections

.text
Size: 741KB - Virtual size: 741KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/app/resources/mfdvdec.dll
.dll windows x64

c2cd05a80ef743073eadb33662f239d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

strncpy_s
strnlen
_purecall
memset
_XcptFilter
_amsg_exit
free
_callnewh
_initterm
__C_specific_handler
_lock
malloc
_onexit
_unlock
__dllonexit
qsort
memcpy

api-ms-win-core-com-l1-1-0

PropVariantClear

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
TlsGetValue
TlsSetValue
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleExW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

mfplat

MFCreateMediaType
MFGetStrideForBitmapInfoHeader
MFGetCallStackTracingWeakReference
MFCalculateImageSize
MFGetSystemTime

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/locales/MemoryDiagnostic.dll
.dll regsvr32 windows x64

c539f5fac8e8357033ae954f9286a2ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcsdup
memset
memcpy
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
bsearch
qsort
wcscmp

ntdll

NtQuerySystemInformation
WinSqmSetIfMaxDWORD
NtSetSystemInformation
WinSqmSetDWORD
WinSqmIncrementDWORD
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
GetModuleHandleExW
WaitForSingleObject
FreeLibraryAndExitThread
ResumeThread
CreateEventW
GetTickCount64
GetLastError
SetEvent
DisableThreadLibraryCalls
CloseHandle
GetSystemInfo
CreateThread
FreeLibrary
GetSystemTimeAsFileTime
UnhandledExceptionFilter

ole32

CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

advapi32

EventWrite
RegCloseKey
EventRegister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
RegSetValueExW
GetTraceEnableLevel
OpenProcessToken
RegisterTraceGuidsW
UnregisterTraceGuids
RegOpenKeyExW
EventUnregister
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW

wevtapi

EvtClose
EvtCreateRenderContext
EvtRender
EvtNext
EvtQuery

bcd

BcdOpenObject
BcdSetElementData
BcdCloseStore
BcdOpenSystemStore
BcdCloseObject
BcdGetElementData

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/locales/MessagingDataModel2.dll
.dll windows x64

7993a0c7d9c117435c3aafec5a60abec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcmp
_wtoi64
__C_specific_handler
_onexit
memmove
__CxxFrameHandler3
__dllonexit
memcpy
_wtoi
realloc
_lock
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
wcstok_s
wcstoul
toupper
memset
_errno
_vsnwprintf_s
towlower
memmove_s
_wcslwr_s
wcsncmp
iswdigit
_wgetenv
_wcsicmp
wcsrchr
swscanf_s
_wcstoui64
wcschr
_unlock
_vsnwprintf
memcpy_s
_wcsnicmp
_purecall
wcsftime
wcscmp

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
FreeLibraryAndExitThread
GetModuleHandleExW
FreeLibrary
LoadStringW
GetModuleFileNameA
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
SetEvent
InitializeCriticalSection
CreateMutexExW
CreateEventW
ReleaseSemaphore
CreateSemaphoreExW
AcquireSRWLockShared
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
LeaveCriticalSection
CreateEventExW
WaitForSingleObjectEx
ReleaseSRWLockShared
WaitForSingleObject
ResetEvent
ReleaseMutex
OpenSemaphoreW

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantInit
VarBstrFromUI8
VarBstrCat

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
EventProviderEnabled

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoWaitForMultipleObjects
StringFromGUID2
CLSIDFromString
StringFromCLSID
CoTaskMemFree
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoTaskMemAlloc

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathSkipRootW
PathGetDriveNumberW
PathFindExtensionW

api-ms-win-core-path-l1-1-0

PathCchRenameExtension
PathCchCanonicalize

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
CreateProcessW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentThread
CreateThread
GetThreadPriority
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegGetValueW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-file-l1-1-0

GetFileSizeEx
DeleteFileW
CompareFileTime
CreateFileW
FileTimeToLocalFileTime

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetGeoInfoW
FormatMessageW
GetUserDefaultLocaleName
GetLocaleInfoW
GetThreadUILanguage

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptAcquireContextW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolWork
CloseThreadpool
SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
CreateThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWait
CloseThreadpoolWork
SetThreadpoolThreadMaximum

xmllite

CreateXmlReader

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetCurrentDirectoryW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

phoneutil

CellularApiHelper_FreeCountedSlotCanAssociationArray
GetDialStringFromTelUri
MaskPhoneUri
Phone_FmtText_NonDialerFormat
IsDialableChar
IsNumberDialable
GetCchTailMin
CellularApiHelper_CreateInstance
MaskPhoneNumber
OneShotTimer_CreateInstance
GetTelUriFromDialString
ComparePhoneNumbers

pimstore

FindAllMatchingContactsEx
FindMatchingContactEx

cemapi

MAPIAllocateBuffer
CreateMAPITableWalker
MAPIInitialize
MAPILogonEx
FreeProws
GetNamedPropTag
HrSetOneProp
MAPIFreeBuffer
HrGetOneProp
MAPI_CompareEntryIDs
MAPIUninitialize

userdataplatformhelperutil

CreateKnownFolderPath
StartAndWaitForServiceForUser
IsCommsSystemService
SetThreadIOPriority
GetThreadIOPriority
GetUserTokenFromContext
GetFileExtensionFromContentType
GetContentTypeFromFilePath

userdatatypehelperutil

BytesToDigits
ReadStreamContent
CreateWrapFileNameStm
StringToBytes
CreateWrapFileStreamFromDssToken
CopyStream
StreamFromStringW
FormatPoomIdToString

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDeleteString

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-base-l1-1-0

GetTokenInformation

rpcrt4

RpcBindingCreateW
RpcExceptionFilter
RpcBindingFree
NdrClientCall2
RpcBindingBind

Exports

Exports

?CommitAllAttachments@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?CommitDeferredContent@MessagingDeferredAttachment@@YAJPEAUIStream@@0@Z
?DeleteMessageAndTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?DeleteTempFiles@MessagingDeferredAttachment@@YAJPEAUISmMessage@@@Z
?GetData@MessagingDeferredAttachment@@YAJPEAUISmAttachment@@PEAPEAUIStream@@1@Z
?GetDeferredAttachmentFilePath@MessagingDeferredAttachment@@YAJPEAUISmMessage@@KPEAHPEAV?$basic_string@GU?$char_traits@G@utl@@V?$allocator@G@2@@utl@@@Z
CellMessagingHelper_CreateInstance
DllCanUnloadNow
DllGetClassObject
GetActiveMmsProfile
GetDirectionalMarkerForCurrentLocale
GetHasInternationalCapability
GetMaxAuthorizedSizeOfMMS
MOCloudCorrelation_CreateInstance
MOCloudCorrelation_CreateInstance2
MessagingAsyncDeletion_CreateInstance
MessagingMultiSimConverter_CreateInstanceWithPhoneOM
MessagingMultiSimConverter_CreateInstanceWithSimOM
MessagingMultiSimConverter_CreateSynchronousInstanceWithSimOM
MessagingRegistryGetDWORDFromPerSimMmsProfile
MessagingRegistryGetDWORDPerSim
MessagingRegistryGetStringFromPerSimMmsProfile
MessagingRegistryGetStringPerSim
MessagingRegistrySetDWORDPerSim
MessagingRegistrySetDWORDToPerSimMmsProfile
MessagingRegistrySetStringPerSim
MessagingRegistrySetStringToPerSimMmsProfile
Messaging_ChatTransportIdToStoreId
Messaging_CreateMessageInConversation
Messaging_CreateMessageInConversationWithRecipients
Messaging_CreateMessageInConversationWithRecipientsAndRemoteId
Messaging_FormatPhoneNumber
Messaging_FormatRecipient
Messaging_FormatRecipientFromAggregate
Messaging_FormatStringWithLeftToRightMarkers
Messaging_FormatStringWithLeftToRightMarkersIfPhoneNumber
Messaging_GetAddressType
Messaging_GetContentTypeFromFilePath
Messaging_GetFileExtensionFromContentType
Messaging_GetMediaTempFilePath
Messaging_GetMediaTempFolder
Messaging_GetMediaTypeFromMimeTag
Messaging_GetMessageAttachmentText
Messaging_GetMessagePreview
Messaging_GetPlatformType
Messaging_GetRecipientsPreviewWithBiDiMarkers
Messaging_GetRecipientsString
Messaging_GetSmsCharacterCount
Messaging_GetUnFormattedMessagePreview
Messaging_GetValidSimId
Messaging_HasEmbeddedModem
Messaging_InitializeRcsSlotMessagingSettings
Messaging_IsContentSupported
Messaging_IsCustomAppProviderId
Messaging_IsDataRoamingRestrictionActive
Messaging_IsFilterProviderId
Messaging_IsMediaType
Messaging_IsMmsMessage
Messaging_IsRcsEnabled
Messaging_IsRcsMessage
Messaging_IsSIMMessage
Messaging_IsThreadedByRemoteConversationId
Messaging_IsUnderMediaTempFolder
Messaging_IsVoiceRoamingRestrictionActive
Messaging_MarkMessageAsFailed
Messaging_MessagingOMStartupShutdown
Messaging_MessagingOMStartupStoreScan
Messaging_ResolveRecipientEx
Messaging_RetryDownloadCloudServiceMessage
Messaging_ShowToastForRcsEndUserMessage
Messaging_ShutdownCloudServices
Messaging_ShutdownMessageMaintenance
Messaging_ShutdownNotification
Messaging_SmEntryIdToUdmObjectId
Messaging_StartCloudServiceSync
Messaging_StartCloudServices
Messaging_StartMessageMaintenance
Messaging_StartNotification
UnInitMessagingObjectModelModule
WwanConnectionConfiguration_CreateInstance

Sections

.text
Size: 831KB - Virtual size: 830KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VSCodeUserSetup-x64-1.74.3/upl/locales/docs/defaults.xml.example
.xml
VSCodeUserSetup-x64-1.74.3/upl/locales/mcupdate_GenuineIntel.dll
.exe windows x64

a43a3e7c022b8819b72e9dd93ec10e0d

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-05-2019 21:24

Not After

02-05-2020 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b
Signer

Actual PE Digest

32:c8:3a:ec:b3:ce:a9:c0:e6:27:6e:9a:c6:1d:40:32:4d:2b:bf:f5:c3:26:c4:9e:c6:74:0e:36:8e:57:67:1b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02-02-2023 17:57
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlInitUnicodeString
RtlCopyUnicodeString
RtlIntegerToUnicodeString
ZwClose
ZwSetValueKey
ZwOpenKey
RtlAppendUnicodeStringToString

Exports

Exports

McImageInfo

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEUPDT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MCDATA
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

4cea7ae85c87ddc7295d39ff9cda31d1

Code Sign

09:95:9f:e7:c3:8f:87:51:bc:99:fc:a2:be:9d:fb:e7Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:5d:e2:c7:af:11:69:4f:b9:3e:8f:05:3d:a6:e9:19Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

18:70:c3:4f:7c:32:f7:4b:28:e7:6e:81:14:5a:a5:f0:f5:27:d2:da:60:4d:3f:0d:0e:f4:73:4c:a0:9a:aa:a7Signer

Signature Validations

Verification

24-10-2022 10:45 Valid: true

Chain 1

58:f9:5d:c1:7f:c3:c0:fb:7e:e1:7b:c3:7b:03:eb:0a:38:36:d7:15Signer

Signature Validations

Verification

24-10-2022 10:45 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 7KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 512B - Virtual size: 32B

dba1138574ae4813ca81835aae76e6cd

Code Sign

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

09:95:9f:e7:c3:8f:87:51:bc:99:fc:a2:be:9d:fb:e7
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:5d:e2:c7:af:11:69:4f:b9:3e:8f:05:3d:a6:e9:19
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

18:70:c3:4f:7c:32:f7:4b:28:e7:6e:81:14:5a:a5:f0:f5:27:d2:da:60:4d:3f:0d:0e:f4:73:4c:a0:9a:aa:a7
Signer

24-10-2022 10:45
Valid: true

58:f9:5d:c1:7f:c3:c0:fb:7e:e1:7b:c3:7b:03:eb:0a:38:36:d7:15
Signer

24-10-2022 10:45
Valid: false

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 7KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 512B - Virtual size: 32B

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6
Certificate

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7
Certificate

8e:10:a6:12:01:65:a3:86:52:e0:ed:90:3d:98:36:60:5f:9a:dc:6b:89:e2:be:9f:1d:00:71:e7:c7:2d:3a:5f
Signer

19-09-2022 09:20
Valid: true

.text
Size: 58KB - Virtual size: 58KB

.data
Size: 512B - Virtual size: 128B

.rdata
Size: 7KB - Virtual size: 6KB

.pdata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 304B

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 1KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 96B

31:83:0c:37:0a:d7:e4:97:63:3b:6e:b3:a0:2d:69:e6
Certificate

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:cb:34:fd:3d:ff:12:11:33:9f:f0:7c:4b:21:57:c7
Certificate

93:8f:a8:f6:fa:33:15:d7:f9:f4:a9:a5:53:fd:8a:d8:79:97:c5:95:85:5d:35:a5:28:92:5a:81:2e:1a:19:15
Signer

19-09-2022 09:20
Valid: true

.text
Size: 501KB - Virtual size: 501KB

.data
Size: 1024B - Virtual size: 624B

.rdata
Size: 58KB - Virtual size: 57KB

.pdata
Size: 9KB - Virtual size: 8KB

.xdata
Size: 11KB - Virtual size: 10KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 25KB - Virtual size: 25KB

.idata
Size: 2KB - Virtual size: 1KB