Fortnite Skin Swapper[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Fortnite Skin Swapper.rar
Size

85.2MB
MD5

3e5dfe034d6af905222effcf88342002
SHA1

faf787248aae19d6bd29e7a3bd01969314957fad
SHA256

b63790d35df9490ed170487194b3a94e75376776a66ba39329cd439749f0adcc
SHA512

31fa5b07ab4f6d34e2821b8a6138f098a5ea4492d1cb8bffc4e8424e1600fe06d27fa8856fe0b762f9384dfd363e833d25f629fdfce6eb15d5071d617bd371ea
SSDEEP

1572864:cs5Zr41J4jfJw5NZFASoqJqzNiXg/+gWpg94xgm42Dy5aGwBBP60SP/a:csr4QJw5NYSoqJbgsbJe5azB7sy

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/Installer/Other/Program Files (x86)/ASIO4ALL v2/ASIO4ALL v2 Instruction Manual.pdf	pdf_with_link_action

Files

Fortnite Skin Swapper.rar
.rar
Installer/About/iconv.dll
.dll windows x64

Password: 1515

0b195d0b0828f122e1c234d175811fd7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

__dllonexit
__iob_func
_amsg_exit
_errno
_initterm
_lock
_onexit
_stricmp
_strnicmp
_unlock
abort
atoi
calloc
free
fwrite
getenv
malloc
memcpy
memmove
signal
strchr
strlen
strncmp
vfprintf

Exports

Exports

iconv
iconv_close
iconv_open
iconvctl
libiconv
libiconv_close
libiconv_open
libiconvctl

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/libgcc_s_seh-1.dll
.dll windows x64

Password: 1515

1ede8ff23b8ed751df2548ed9dd2bc40

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RaiseException
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
memcpy
memset
realloc
signal
strlen
strncmp
vfprintf

Exports

Exports

_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
__absvdi2
__absvsi2
__absvti2
__addtf3
__addvdi3
__addvsi3
__addvti3
__ashlti3
__ashrti3
__bswapdi2
__bswapsi2
__clear_cache
__clrsbdi2
__clrsbti2
__clzdi2
__clzti2
__cmpti2
__ctzdi2
__ctzti2
__divdc3
__divsc3
__divtc3
__divtf3
__divti3
__divxc3
__emutls_get_address
__emutls_register_common
__enable_execute_stack
__eqtf2
__extenddftf2
__extendsftf2
__extendxftf2
__ffsdi2
__ffsti2
__fixdfti
__fixsfti
__fixtfdi
__fixtfsi
__fixtfti
__fixunsdfdi
__fixunsdfti
__fixunssfdi
__fixunssfti
__fixunstfdi
__fixunstfsi
__fixunstfti
__fixunsxfdi
__fixunsxfti
__fixxfti
__floatditf
__floatsitf
__floattidf
__floattisf
__floattitf
__floattixf
__floatunditf
__floatunsitf
__floatuntidf
__floatuntisf
__floatuntitf
__floatuntixf
__gcc_personality_seh0
__getf2
__gttf2
__letf2
__lshrti3
__lttf2
__modti3
__muldc3
__mulsc3
__multc3
__multf3
__multi3
__mulvdi3
__mulvsi3
__mulvti3
__mulxc3
__negtf2
__negti2
__negvdi2
__negvsi2
__negvti2
__netf2
__paritydi2
__parityti2
__popcountdi2
__popcountti2
__powidf2
__powisf2
__powitf2
__powixf2
__subtf3
__subvdi3
__subvsi3
__subvti3
__trunctfdf2
__trunctfsf2
__trunctfxf2
__ucmpti2
__udivmodti4
__udivti3
__umodti3
__unordtf2

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 261B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/libglib-2.0-0.dll
.dll windows x64

Password: 1515

499904276cb63533308f9af02f163226

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetUserNameW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

libintl-8

libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dgettext
libintl_dngettext
libintl_gettext
libintl_sprintf
libintl_textdomain

kernel32

CloseHandle
CreateEventA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FormatMessageW
FreeEnvironmentStringsW
GetACP
GetCPInfoExA
GetCommandLineW
GetComputerNameA
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetShortPathNameW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetVersion
GetWindowsDirectoryW
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
PeekConsoleInputA
PeekNamedPipe
QueryPerformanceCounter
ReadConsoleInputA
ReadFile
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEnvironmentVariableW
SetEvent
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
__iob_func
__mb_cur_max
_amsg_exit
_beginthreadex
_chsize
_endthreadex
_errno
_exit
_fdopen
_findclose
_fmode
_fstat64
_get_osfhandle
_gmtime64
_initterm
_kbhit
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_open_osfhandle
_pipe
_setmode
_stricmp
_strnicmp
_time64
_unlock
_waccess
_wchdir
_wchmod
_wfindfirst64
_wfindnext64
_wfreopen
_wfullpath
_wmkdir
_wputenv
_wremove
_wrmdir
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wunlink
_wutime64
abort
atoi
atol
bsearch
calloc
exit
fclose
feof
ferror
fflush
fprintf
fputc
fputs
fread
free
fwrite
getenv
islower
isupper
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
realloc
setlocale
signal
sprintf
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
toupper
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
_wstat64
_write
_read
_getpid
_fileno
_close

ole32

CoTaskMemFree

shell32

CommandLineToArgvW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

user32

IsWindow
MessageBoxA
MsgWaitForMultipleObjectsEx
PeekMessageA
PostMessageA

winmm

timeGetTime

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetEvent
closesocket
getsockopt
ioctlsocket
recv
send

Exports

Exports

__glib_assert_msg
_glib_get_locale_dir
g_access
g_allocator_free
g_allocator_new
g_array_append_vals
g_array_free
g_array_get_element_size
g_array_insert_vals
g_array_new
g_array_prepend_vals
g_array_ref
g_array_remove_index
g_array_remove_index_fast
g_array_remove_range
g_array_set_clear_func
g_array_set_size
g_array_sized_new
g_array_sort
g_array_sort_with_data
g_array_unref
g_ascii_digit_value
g_ascii_dtostr
g_ascii_formatd
g_ascii_strcasecmp
g_ascii_strdown
g_ascii_strncasecmp
g_ascii_strtod
g_ascii_strtoll
g_ascii_strtoull
g_ascii_strup
g_ascii_table
g_ascii_tolower
g_ascii_toupper
g_ascii_xdigit_value
g_assert_warning
g_assertion_message
g_assertion_message_cmpnum
g_assertion_message_cmpstr
g_assertion_message_error
g_assertion_message_expr
g_async_queue_length
g_async_queue_length_unlocked
g_async_queue_lock
g_async_queue_new
g_async_queue_new_full
g_async_queue_pop
g_async_queue_pop_unlocked
g_async_queue_push
g_async_queue_push_sorted
g_async_queue_push_sorted_unlocked
g_async_queue_push_unlocked
g_async_queue_ref
g_async_queue_ref_unlocked
g_async_queue_sort
g_async_queue_sort_unlocked
g_async_queue_timed_pop
g_async_queue_timed_pop_unlocked
g_async_queue_timeout_pop
g_async_queue_timeout_pop_unlocked
g_async_queue_try_pop
g_async_queue_try_pop_unlocked
g_async_queue_unlock
g_async_queue_unref
g_async_queue_unref_and_unlock
g_atexit
g_atomic_int_add
g_atomic_int_and
g_atomic_int_compare_and_exchange
g_atomic_int_dec_and_test
g_atomic_int_exchange_and_add
g_atomic_int_get
g_atomic_int_inc
g_atomic_int_or
g_atomic_int_set
g_atomic_int_xor
g_atomic_pointer_add
g_atomic_pointer_and
g_atomic_pointer_compare_and_exchange
g_atomic_pointer_get
g_atomic_pointer_or
g_atomic_pointer_set
g_atomic_pointer_xor
g_base64_decode
g_base64_decode_inplace
g_base64_decode_step
g_base64_encode
g_base64_encode_close
g_base64_encode_step
g_basename
g_bit_lock
g_bit_nth_lsf
g_bit_nth_msf
g_bit_storage
g_bit_trylock
g_bit_unlock
g_blow_chunks
g_bookmark_file_add_application
g_bookmark_file_add_group
g_bookmark_file_error_quark
g_bookmark_file_free
g_bookmark_file_get_added
g_bookmark_file_get_app_info
g_bookmark_file_get_applications
g_bookmark_file_get_description
g_bookmark_file_get_groups
g_bookmark_file_get_icon
g_bookmark_file_get_is_private
g_bookmark_file_get_mime_type
g_bookmark_file_get_modified
g_bookmark_file_get_size
g_bookmark_file_get_title
g_bookmark_file_get_uris
g_bookmark_file_get_visited
g_bookmark_file_has_application
g_bookmark_file_has_group
g_bookmark_file_has_item
g_bookmark_file_load_from_data
g_bookmark_file_load_from_data_dirs
g_bookmark_file_load_from_file
g_bookmark_file_move_item
g_bookmark_file_new
g_bookmark_file_remove_application
g_bookmark_file_remove_group
g_bookmark_file_remove_item
g_bookmark_file_set_added
g_bookmark_file_set_app_info
g_bookmark_file_set_description
g_bookmark_file_set_groups
g_bookmark_file_set_icon
g_bookmark_file_set_is_private
g_bookmark_file_set_mime_type
g_bookmark_file_set_modified
g_bookmark_file_set_title
g_bookmark_file_set_visited
g_bookmark_file_to_data
g_bookmark_file_to_file
g_build_filename
g_build_filenamev
g_build_path
g_build_pathv
g_byte_array_append
g_byte_array_free
g_byte_array_free_to_bytes
g_byte_array_new
g_byte_array_new_take
g_byte_array_prepend
g_byte_array_ref
g_byte_array_remove_index
g_byte_array_remove_index_fast
g_byte_array_remove_range
g_byte_array_set_size
g_byte_array_sized_new
g_byte_array_sort
g_byte_array_sort_with_data
g_byte_array_unref
g_bytes_compare
g_bytes_equal
g_bytes_get_data
g_bytes_get_size
g_bytes_hash
g_bytes_new
g_bytes_new_from_bytes
g_bytes_new_static
g_bytes_new_take
g_bytes_new_with_free_func
g_bytes_ref
g_bytes_unref
g_bytes_unref_to_array
g_bytes_unref_to_data
g_cache_destroy
g_cache_insert
g_cache_key_foreach
g_cache_new
g_cache_remove
g_cache_value_foreach
g_chdir
g_checksum_copy
g_checksum_free
g_checksum_get_digest
g_checksum_get_string
g_checksum_new
g_checksum_reset
g_checksum_type_get_length
g_checksum_update
g_child_watch_add
g_child_watch_add_full
g_child_watch_funcs
g_child_watch_source_new
g_chmod
g_clear_error
g_clear_pointer
g_close
g_completion_add_items
g_completion_clear_items
g_completion_complete
g_completion_complete_utf8
g_completion_free
g_completion_new
g_completion_remove_items
g_completion_set_compare
g_compute_checksum_for_bytes
g_compute_checksum_for_data
g_compute_checksum_for_string
g_compute_hmac_for_data
g_compute_hmac_for_string
g_cond_broadcast
g_cond_clear
g_cond_free
g_cond_init
g_cond_new
g_cond_signal
g_cond_timed_wait
g_cond_wait
g_cond_wait_until
g_convert
g_convert_error_quark
g_convert_with_fallback
g_convert_with_iconv
g_creat
g_datalist_clear
g_datalist_foreach
g_datalist_get_data
g_datalist_get_flags
g_datalist_id_dup_data
g_datalist_id_get_data
g_datalist_id_remove_no_notify
g_datalist_id_replace_data
g_datalist_id_set_data_full
g_datalist_init
g_datalist_set_flags
g_datalist_unset_flags
g_dataset_destroy
g_dataset_foreach
g_dataset_id_get_data
g_dataset_id_remove_no_notify
g_dataset_id_set_data_full
g_date_add_days
g_date_add_months
g_date_add_years
g_date_clamp
g_date_clear
g_date_compare
g_date_days_between
g_date_free
g_date_get_day
g_date_get_day_of_year
g_date_get_days_in_month
g_date_get_iso8601_week_of_year
g_date_get_julian
g_date_get_monday_week_of_year
g_date_get_monday_weeks_in_year
g_date_get_month
g_date_get_sunday_week_of_year
g_date_get_sunday_weeks_in_year
g_date_get_weekday
g_date_get_year
g_date_is_first_of_month
g_date_is_last_of_month
g_date_is_leap_year
g_date_new
g_date_new_dmy
g_date_new_julian
g_date_order
g_date_set_day
g_date_set_dmy
g_date_set_julian
g_date_set_month
g_date_set_parse
g_date_set_time
g_date_set_time_t
g_date_set_time_val
g_date_set_year
g_date_strftime
g_date_subtract_days
g_date_subtract_months
g_date_subtract_years
g_date_time_add
g_date_time_add_days
g_date_time_add_full
g_date_time_add_hours
g_date_time_add_minutes
g_date_time_add_months
g_date_time_add_seconds
g_date_time_add_weeks
g_date_time_add_years
g_date_time_compare
g_date_time_difference
g_date_time_equal
g_date_time_format
g_date_time_get_day_of_month
g_date_time_get_day_of_week
g_date_time_get_day_of_year
g_date_time_get_hour
g_date_time_get_microsecond
g_date_time_get_minute
g_date_time_get_month
g_date_time_get_second
g_date_time_get_seconds
g_date_time_get_timezone_abbreviation
g_date_time_get_utc_offset
g_date_time_get_week_numbering_year
g_date_time_get_week_of_year
g_date_time_get_year
g_date_time_get_ymd
g_date_time_hash
g_date_time_is_daylight_savings
g_date_time_new
g_date_time_new_from_timeval_local
g_date_time_new_from_timeval_utc
g_date_time_new_from_unix_local
g_date_time_new_from_unix_utc
g_date_time_new_local
g_date_time_new_now
g_date_time_new_now_local
g_date_time_new_now_utc
g_date_time_new_utc
g_date_time_ref
g_date_time_to_local
g_date_time_to_timeval
g_date_time_to_timezone
g_date_time_to_unix
g_date_time_to_utc
g_date_time_unref
g_date_to_struct_tm
g_date_valid
g_date_valid_day
g_date_valid_dmy
g_date_valid_julian
g_date_valid_month
g_date_valid_weekday
g_date_valid_year
g_dcgettext
g_dgettext
g_dir_close
g_dir_make_tmp
g_dir_open_utf8
g_dir_read_name_utf8
g_dir_rewind
g_direct_equal
g_direct_hash
g_dngettext
g_double_equal
g_double_hash
g_dpgettext
g_dpgettext2
g_environ_getenv
g_environ_setenv
g_environ_unsetenv
g_error_copy
g_error_free
g_error_matches
g_error_new
g_error_new_literal
g_error_new_valist
g_file_error_from_errno
g_file_error_quark
g_file_get_contents_utf8
g_file_open_tmp_utf8
g_file_read_link
g_file_set_contents
g_file_test_utf8
g_filename_display_basename
g_filename_display_name
g_filename_from_uri_utf8
g_filename_from_utf8_utf8
g_filename_to_uri_utf8
g_filename_to_utf8_utf8
g_find_program_in_path
g_fopen
g_format_size
g_format_size_for_display
g_format_size_full
g_fprintf
g_free
g_freopen
g_get_application_name
g_get_charset
g_get_codeset
g_get_current_dir_utf8
g_get_current_time
g_get_environ
g_get_filename_charsets
g_get_home_dir
g_get_host_name
g_get_language_names
g_get_locale_variants
g_get_monotonic_time
g_get_num_processors
g_get_prgname
g_get_real_name
g_get_real_time
g_get_system_config_dirs
g_get_system_data_dirs
g_get_tmp_dir
g_get_user_cache_dir
g_get_user_config_dir
g_get_user_data_dir
g_get_user_name
g_get_user_runtime_dir
g_get_user_special_dir
g_getenv_utf8
g_hash_table_add
g_hash_table_contains
g_hash_table_destroy
g_hash_table_find
g_hash_table_foreach
g_hash_table_foreach_remove
g_hash_table_foreach_steal
g_hash_table_get_keys
g_hash_table_get_keys_as_array
g_hash_table_get_values
g_hash_table_insert
g_hash_table_iter_get_hash_table
g_hash_table_iter_init
g_hash_table_iter_next
g_hash_table_iter_remove
g_hash_table_iter_replace
g_hash_table_iter_steal
g_hash_table_lookup
g_hash_table_lookup_extended
g_hash_table_new
g_hash_table_new_full
g_hash_table_ref
g_hash_table_remove
g_hash_table_remove_all
g_hash_table_replace
g_hash_table_size
g_hash_table_steal
g_hash_table_steal_all
g_hash_table_unref
g_hmac_copy
g_hmac_get_digest
g_hmac_get_string
g_hmac_new
g_hmac_ref
g_hmac_unref
g_hmac_update
g_hook_alloc
g_hook_compare_ids
g_hook_destroy
g_hook_destroy_link
g_hook_find
g_hook_find_data
g_hook_find_func
g_hook_find_func_data
g_hook_first_valid
g_hook_free
g_hook_get
g_hook_insert_before
g_hook_insert_sorted
g_hook_list_clear
g_hook_list_init
g_hook_list_invoke
g_hook_list_invoke_check
g_hook_list_marshal
g_hook_list_marshal_check
g_hook_next_valid
g_hook_prepend
g_hook_ref
g_hook_unref
g_hostname_is_ascii_encoded
g_hostname_is_ip_address
g_hostname_is_non_ascii
g_hostname_to_ascii
g_hostname_to_unicode
g_iconv
g_iconv_close
g_iconv_open
g_idle_add
g_idle_add_full
g_idle_funcs
g_idle_remove_by_data
g_idle_source_new
g_int64_equal
g_int64_hash
g_int_equal
g_int_hash
g_intern_static_string
g_intern_string
g_io_add_watch
g_io_add_watch_full
g_io_channel_close
g_io_channel_error_from_errno
g_io_channel_error_quark
g_io_channel_flush
g_io_channel_get_buffer_condition
g_io_channel_get_buffer_size
g_io_channel_get_buffered
g_io_channel_get_close_on_unref
g_io_channel_get_encoding
g_io_channel_get_flags
g_io_channel_get_line_term
g_io_channel_init
g_io_channel_new_file_utf8
g_io_channel_read
g_io_channel_read_chars
g_io_channel_read_line
g_io_channel_read_line_string
g_io_channel_read_to_end

Sections

.text
Size: 672KB - Virtual size: 671KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/libintl-8.dll
.dll windows x64

Password: 1515

eeaab5e869156145e036dcce679fb0a9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

iconv

iconv
iconv_open

kernel32

CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
__dllonexit
__iob_func
__mb_cur_max
_amsg_exit
_errno
_fstat64
_initterm
_lock
_onexit
_stricmp
_unlock
_vsnprintf
_vsnwprintf
abort
bsearch
calloc
fclose
feof
fgets
fopen
fputwc
free
fwrite
getenv
isalnum
isalpha
isspace
malloc
memcpy
memset
putc
qsort
realloc
setlocale
signal
sprintf
strchr
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strrchr
strstr
strtoul
tolower
vfprintf
vfwprintf
vsprintf
wcschr
wcslen
_strdup
_read
_open
_getcwd
_close

Exports

Exports

__printf__
_nl_expand_alias
_nl_explode_name
_nl_find_domain
_nl_find_msg
_nl_language_preferences_default
_nl_load_domain
_nl_locale_name
_nl_locale_name_canonicalize
_nl_locale_name_default
_nl_locale_name_environ
_nl_locale_name_from_win32_LANGID
_nl_locale_name_from_win32_LCID
_nl_locale_name_posix
_nl_locale_name_thread
_nl_locale_name_thread_unsafe
_nl_log_untranslated
_nl_make_l10nflist
_nl_msg_cat_cntr
_nl_normalize_codeset
_nl_state_lock
bind_textdomain_codeset
bindtextdomain
dcgettext
dcngettext
dgettext
dngettext
gettext
libintl_asprintf
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_fwprintf
libintl_gettext
libintl_gettext_extract_plural
libintl_gettext_free_exp
libintl_gettext_germanic_plural
libintl_gettextparse
libintl_hash_string
libintl_lock_destroy_func
libintl_lock_init_func
libintl_lock_lock_func
libintl_lock_unlock_func
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_once_func
libintl_recursive_lock_destroy_func
libintl_recursive_lock_init_func
libintl_recursive_lock_lock_func
libintl_recursive_lock_unlock_func
libintl_relocate
libintl_rwlock_destroy_func
libintl_rwlock_init_func
libintl_rwlock_rdlock_func
libintl_rwlock_unlock_func
libintl_rwlock_wrlock_func
libintl_set_relocation_prefix
libintl_setlocale
libintl_snprintf
libintl_sprintf
libintl_swprintf
libintl_textdomain
libintl_vasnprintf
libintl_vasnwprintf
libintl_vasprintf
libintl_version
libintl_vfprintf
libintl_vfwprintf
libintl_vprintf
libintl_vsnprintf
libintl_vsprintf
libintl_vswprintf
libintl_vwprintf
libintl_wprintf
locale_charset
ngettext
textdomain
xmax
xsum
xsum3
xsum4

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/libssp-0.dll
.dll windows x64

Password: 1515

5b045928d24807c283c317043e7f84c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
_amsg_exit
_exit
_initterm
_lock
_onexit
_unlock
abort
calloc
fgets
free
fwrite
gets
malloc
memcpy
memmove
memset
signal
strlen
strncmp
strncpy
vfprintf
_write
_read
_open
_close

Exports

Exports

__chk_fail
__gets_chk
__memcpy_chk
__memmove_chk
__mempcpy_chk
__memset_chk
__stack_chk_fail
__stack_chk_guard
__stpcpy_chk
__strcat_chk
__strcpy_chk
__strncat_chk
__strncpy_chk

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 361B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 77B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/libwinpthread-1.dll
.dll windows x64

Password: 1515

22ec93d55773cd5a4e361857683e4a86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetProcessAffinityMask
GetProcessTimes
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCriticalSectionSpinCount
SetEvent
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject

msvcrt

__C_specific_handler
__dllonexit
__iob_func
_amsg_exit
_beginthreadex
_endthreadex
_errno
_initterm
_lock
_onexit
_setjmp
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memmove
memset
printf
realloc
signal
strlen
strncmp
vfprintf
longjmp

Exports

Exports

__pth_gpointer_locked
__pthread_clock_nanosleep
_pthread_cleanup_dest
_pthread_get_state
_pthread_invoke_cancel
_pthread_key_dest
_pthread_rel_time_in_ms
_pthread_set_state
_pthread_time_in_ms
_pthread_time_in_ms_from_timespec
_pthread_tryjoin
clock_getres
clock_gettime
clock_nanosleep
clock_settime
nanosleep
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_timedwait_relative_np
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getclock
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setclock
pthread_condattr_setpshared
pthread_create
pthread_create_wrapper
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_get_concurrency
pthread_getclean
pthread_getconcurrency
pthread_getevent
pthread_gethandle
pthread_getschedparam
pthread_getspecific
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getprioceiling
pthread_mutexattr_getprotocol
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setprioceiling
pthread_mutexattr_setprotocol
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_set_concurrency
pthread_set_num_processors_np
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_tls_init
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/qga-vss.dll
.dll regsvr32 windows x64

Password: 1515

3710a6c74c9b8515740c4899b4086831

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

ConvertStringSidToSidW
InitializeSecurityDescriptor
LookupAccountSidW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SetSecurityDescriptorDacl

kernel32

CloseHandle
CreateEventA
CreateSemaphoreW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeW
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
GetVolumePathNamesForVolumeNameW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenEventA
QueryPerformanceCounter
RaiseException
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
__dllonexit
__iob_func
__mb_cur_max
_amsg_exit
_errno
_exit
_initterm
_lock
_onexit
_snwprintf
_unlock
abort
calloc
fputc
fputs
free
fwprintf
fwrite
getenv
localeconv
malloc
mbstowcs
mbstowcs_s
memcmp
memcpy
raise
realloc
signal
sprintf
strchr
strcmp
strerror
strlen
strncmp
vfprintf
wcscpy
wcslen
_write

ole32

CoCreateInstance
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

oleaut32

SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
VariantChangeType
VariantClear
VariantInit

shlwapi

PathFileExistsA
SHDeleteKeyA

user32

MessageBoxA
MessageBoxW

Exports

Exports

COMRegister
COMUnregister
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
requester_deinit
requester_freeze
requester_init
requester_thaw

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 319B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/About/qga-vss.tlb
Installer/Installer.exe
.exe windows x86

Password: 1515

2f285ed6f05eae8b1321ad1b364e9c75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
CreateFileW
lstrlenA
LocalAlloc
LoadLibraryA
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

CoInitialize

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iudhbn0
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.iudhbn1
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.iudhbn2
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/ActiveXInstallService.admx
Installer/Other/AddRemovePrograms.admx
Installer/Other/AppCompat.admx
Installer/Other/AppInfo/Launcher/FLstudioPortable.ini
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sqlpdw.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Cartridges/trdtv2r41.xsl
.xml
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrv.rll
.dll windows x86

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46
Signer

Actual PE Digest

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrvi.rll
.dll windows x86

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0
Signer

Actual PE Digest

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msolui110.rll
.dll windows x86

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6
Signer

Actual PE Digest

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/SQLDumper.exe
.exe windows x86

81c720f8641914edcd344a3a79369611

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a
Signer

Actual PE Digest

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump
ImageNtHeader

psapi

GetModuleFileNameExW
GetModuleBaseNameA
GetModuleInformation
EnumProcessModules

rpcrt4

UuidCreate
UuidToStringW
UuidFromStringW
RpcStringFreeW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

OpenProcess
Thread32First
VirtualFreeEx
InitializeCriticalSectionAndSpinCount
Sleep
ReadProcessMemory
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetFileAttributesW
Thread32Next
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
FindClose
OpenThread
SetConsoleCtrlHandler
GetExitCodeThread
CreateEventW
GetSystemInfo
WriteFile
CreateToolhelp32Snapshot
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
DebugBreak
WriteProcessMemory
SuspendThread
ResumeThread
CreateThread
VirtualFree
GetModuleHandleW
SleepEx
SetEvent
GetComputerNameW
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
VirtualQuery
SetFilePointer
FindFirstFileW
FindNextFileW
GetFileSize
ExitProcess
ExpandEnvironmentStringsW
SetLastError
GetPrivateProfileStringW
lstrlenW
CompareStringW
GetProcessHeap
SetEnvironmentVariableW
HeapReAlloc
GetEnvironmentVariableW
CreateRemoteThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
DecodePointer
EncodePointer
RaiseException
InterlockedExchange
LocalAlloc
LoadLibraryExA

advapi32

RegOpenKeyW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
QueryServiceStatusEx
SetServiceStatus
StartServiceW
LookupPrivilegeValueW
RegQueryValueExW
RegisterServiceCtrlHandlerExW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle

msvcr100

_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
exit
_wstrtime_s
_time64
wcsncmp
swscanf_s
??3@YAXPAX@Z
_vsnwprintf
wcsrchr
_wmakepath_s
memset
_wremove
_errno
_wsplitpath_s
wcsnlen
qsort
_wtoi
wcstoul
_gmtime64_s
_wcsicmp
wcschr
_wstrdate_s
_swscanf_s_l
__CxxFrameHandler3
memcpy
_stricmp
wprintf

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/dbghelp.dll
.dll windows x86

fa6b094f828920cf8999743ff0004319

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/msmdlocal.dll
.dll windows x86

30b9b02c4717da4bc8cc78b0a4bd2e81

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2
Signer

Actual PE Digest

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
_Nan
_Inf
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
calloc
_vsnwprintf_l
_resetstkoflw
??0exception@std@@QAE@ABQBDH@Z
strchr
sprintf_s
fread
bsearch
_wcslwr_s
_strlwr_s
strcpy_s
fwprintf_s
_configthreadlocale
_wgetenv
exit
??2@YAPAXI@Z
_vsnprintf_s
_wcsupr
_ui64tow
_ultow_s
memmove_s
towlower
iswalnum
iswlower
iswalpha
wprintf
_CIfmod
_ultoa_s
_snwprintf_s
_CIlog
_CIsqrt
printf
_finite
wcstok
bsearch_s
qsort_s
_CIpow
_CIexp
ceil
vfprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
fseek
fprintf
_fsopen
getenv
_wcslwr
iswdigit
_ltow
_swscanf_s_l
longjmp
_setjmp3
_wcsnicmp_l
_wtoi64_l
_wfullpath
__pctype_func
_isctype_l
_iswprint_l
_i64tow_s
_i64tow
_wcstoi64
_snprintf_s
strncpy_s
_waccess
_wcsdup
_wsetlocale
_time64
_CIlog10
_CIatan
_CIsin
frexp
ldexp
_wfsopen
_wctime64
srand
rand
_wcsicmp_l
_vsnwprintf
iswspace
_isnan
_itow
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcsrchr
wcschr
swprintf_s
_wtoi
wcstoul
wcstol
_wcsnicmp
wcstok_s
_errno
qsort
wcscpy_s
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_beginthreadex
_wsplitpath_s
_wmakepath_s
wcsncmp
wcscat_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
memcpy_s
malloc
free
_purecall
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
memmove
memset
_vswprintf_c_l
_wcsicmp
wcsstr
memcpy
wcspbrk
__CxxFrameHandler3
_CxxThrowException
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

kernel32

GetStartupInfoW
GetUserDefaultUILanguage
EncodePointer
DecodePointer
SetEnvironmentVariableW
CompareStringW
GetPrivateProfileStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
Module32NextW
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
SystemTimeToFileTime
GetLocaleInfoW
LocaleNameToLCID
CreateSemaphoreW
CreateDirectoryW
GetFileInformationByHandle
GetFileType
RemoveDirectoryW
SetFilePointer
SetFileTime
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
MapViewOfFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueueUserWorkItem
ConvertThreadToFiber
BindIoCompletionCallback
GetThreadLocale
SetThreadLocale
GetFileSize
FlushFileBuffers
WaitForMultipleObjectsEx
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
IsValidLocale
GetSystemDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
ExpandEnvironmentStringsW
TlsGetValue
OutputDebugStringA
SetLastError
LeaveCriticalSection
DeleteCriticalSection
SleepEx
DisableThreadLibraryCalls
GetProcAddress
LocalFree
LoadLibraryExA
LocalAlloc
GetLastError
InterlockedExchange
RaiseException
FreeLibrary
MultiByteToWideChar
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
DebugBreak
SwitchToThread
GetCurrentThreadId
GetTickCount
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
GetCurrentProcessId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
FindClose
FindFirstFileW
FindNextFileW
GetVolumeInformationW
DuplicateHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
SetEvent
ResetEvent
HeapCreate
HeapDestroy
HeapCompact
GlobalMemoryStatusEx
CreateMemoryResourceNotification
QueryMemoryResourceNotification
GetModuleHandleA
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
GetProcessWorkingSetSize
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
AddVectoredExceptionHandler
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
OpenProcess
ReadFile
ReadFileScatter
WriteFile
WriteFileGather
FindCloseChangeNotification
GetThreadPriority
FindNextChangeNotification
GetFileAttributesExW
CopyFileW
MoveFileExW
GetExitCodeProcess
CreateProcessW
CreateTimerQueue
ChangeTimerQueueTimer
DeleteTimerQueueEx
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
DeleteFileW
GetDiskFreeSpaceExW
GetVolumePathNameW
UnregisterWaitEx
RegisterWaitForSingleObject
OpenThread
GetProcessTimes
PulseEvent
GlobalMemoryStatus
CreateFiber
DeleteFiber
SwitchToFiber
ExitProcess
CreateThread
ResumeThread
LCIDToLocaleName
GetLocaleInfoEx
lstrlenA
lstrlenW
FileTimeToLocalFileTime
GlobalFree
ConvertDefaultLocale
SetConsoleCtrlHandler
CreateHardLinkW
WaitForSingleObject
Sleep
IsDBCSLeadByte
LoadLibraryW
ReadProcessMemory
CreateMutexW
SetHandleInformation
ReleaseMutex
FindFirstChangeNotificationW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDeriveKey
ImpersonateLoggedOnUser
GetSecurityInfo
GetUserNameW
AddAccessAllowedAceEx
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
SetThreadToken
OpenThreadToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
CryptGenKey
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
CopySid
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
InitializeAcl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
LookupAccountSidW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSidToSidW
AccessCheck
AllocateLocallyUniqueId
RevertToSelf
ImpersonateAnonymousToken
MapGenericMask
LogonUserW
LsaNtStatusToWinError
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
SetServiceStatus
RegisterServiceCtrlHandlerW

shlwapi

PathCombineW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathRemoveExtensionW
PathRemoveFileSpecW

iphlpapi

GetUnicastIpAddressEntry
GetBestInterfaceEx

userenv

GetProfileType

ncrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptExportKey
BCryptDestroyKey
NCryptOpenStorageProvider
NCryptGetProperty
NCryptImportKey
NCryptVerifySignature
NCryptFreeObject

Exports

Exports

DmpGetClientExport
MSMDCanUnloadNow
MSMDCancelCommands
MSMDCloseHandle
MSMDGetDBImageSize
MSMDGetDBLastModified
MSMDGetMDXUtils
MSMDInitLocal
MSMDLoadDBImage
MSMDOpenLocal
MSMDOpenRequest
MSMDParseFormulaExpression
MSMDParseGetCubeName
MSMDParseXLFormulaExpression
MSMDReadData
MSMDReadDataEx
MSMDReceiveResponse
MSMDRenameServer
MSMDSaveDBImage
MSMDSendRequest
MSMDStopLocal
MSMDWriteData
MSMDWriteDataEx

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.1MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/msmgdsrv.dll
.dll windows x86

1f0b9d86d3b09c1459e4f99bc82b614a

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee
Signer

Actual PE Digest

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSemaphoreW
CreateFileW
CreateDirectoryW
DeleteFileW
GetFileSizeEx
GetFileType
RemoveDirectoryW
SetEndOfFile
SetFilePointer
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObject
GetThreadLocale
SetThreadLocale
FlushFileBuffers
GetDiskFreeSpaceExW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
CloseHandle
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
TlsGetValue
LocalFree
GetFileInformationByHandle
InterlockedIncrement
IsProcessorFeaturePresent
UnhandledExceptionFilter
DecodePointer
EncodePointer
Sleep
Module32NextW
PulseEvent
FindResourceW
SizeofResource
LockResource
LoadResource
GetLastError
LoadLibraryExA
LocalAlloc
InterlockedExchange
RaiseException
FindClose
FindFirstFileW
FindNextFileW
SetLastError
QueryPerformanceFrequency
GetOverlappedResult
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetCurrentProcess
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
InterlockedDecrement
InterlockedCompareExchange
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
TerminateProcess
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
DebugBreak
SwitchToThread
GetLocaleInfoW
ConvertDefaultLocale
SetEvent
ResetEvent
HeapCreate
HeapDestroy
GlobalMemoryStatusEx
CreateMemoryResourceNotification
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
OutputDebugStringA
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
ReadFile
ReadFileScatter
WriteFile
GetFileAttributesExW
CopyFileW
MoveFileExW
DeleteTimerQueueEx

msvcp100

?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ

msvcr100

__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
memmove_s
_wcsicmp_l
bsearch_s
sprintf_s
_vsnwprintf
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcschr
wcsrchr
_wtoi
_msize
_aligned_msize
_except_handler4_common
_aligned_malloc
_aligned_free
realloc
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vswprintf_c_l
_snprintf_s
strncpy_s
calloc
_wsetlocale
_snwprintf_s
_vsnprintf_s
_wcsicmp
wcsstr
malloc
free
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
_wcsnicmp
wcscpy_s
memcpy_s
_itow_s
_wsplitpath_s
_wmakepath_s
wcsncmp
wcspbrk
_purecall
wcscat_s
wcsncpy_s
memset
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_CxxThrowException
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??3@YAXPAX@Z
??_V@YAXPAX@Z
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__FrameUnwindFilter
_cexit
__RTDynamicCast
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_aligned_realloc
__clean_type_info_names_internal

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SetThreadToken
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RevertToSelf

mscoree

_CorDllMain

Exports

Exports

MSMDCreateAssembly
MSMDCreateManagedConnection
MSMDCreateManagedDSV
MSMDCreateManagedNLP
MSMDCreateTimeDimCalculator
MSMDCreateTimeDimReader
MSMDFileSystemBrowserFileExists
MSMDFileSystemBrowserGetAllowedDirectories
MSMDFileSystemBrowserGetDirectories
MSMDFileSystemBrowserGetFiles
MSMDFileSystemBrowserGetLogicalDrives
MSMDInitModule
MSMDLocalStreamClose
MSMDLocalStreamCloseBase
MSMDLocalStreamFlush
MSMDLocalStreamRead
MSMDLocalStreamSkip
MSMDLocalStreamWrite
MSMDLocalStreamWriteEndOfMessage
MSMDOnServerReady
MSMDResetModule
MSMDSetFeatureSwitches

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 855KB - Virtual size: 854KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.3MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/msolap110.dll
.dll regsvr32 windows x86

0bce98ee70e0cf58c1e95a5af6536002

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b
Signer

Actual PE Digest

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

_vsnwprintf_l
iswdigit
_wcsicmp_l
_vsnwprintf
sprintf_s
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
wcstol
_wtoi64_l
wcsrchr
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_endthreadex
_beginthreadex
_snwprintf_s
_wsetlocale
_wcsdup
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_isnan
_ui64tow
_i64tow
_wmakepath_s
wcspbrk
_itow_s
_snprintf_s
strncpy_s
_vsnprintf_s
_wtol
??3@YAXPAX@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_wcsicmp
wcsncmp
swscanf_s
_vswprintf_c_l
iswspace
_wfopen
_wsplitpath_s
swprintf_s
_wtoi
_ultow
_wcsnicmp
wcschr
memmove
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
??_V@YAXPAX@Z
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memmove_s
memcpy_s
_recalloc
malloc
free
calloc
??2@YAPAXI@Z
_purecall
_wfullpath

kernel32

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
OutputDebugStringA
GetCurrentProcessId
TlsGetValue
CreateTimerQueueTimer
DeleteTimerQueueTimer
IsValidCodePage
GetACP
CloseHandle
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetThreadLocale
GetUserDefaultUILanguage
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
SleepEx
GetTickCount
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
WideCharToMultiByte
EnterCriticalSection
EncodePointer
DecodePointer
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
IsProcessorFeaturePresent
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
RaiseException
CreateSemaphoreW
LoadLibraryExW
GetVolumePathNameW
GetDiskFreeSpaceExW
PulseEvent
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
WaitForMultipleObjectsEx
ReadFileScatter
ReleaseSemaphore
GetSystemTime
SetProcessWorkingSetSize
GetLocalTime
GetLongPathNameW
GetFullPathNameW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageW
VirtualUnlock
VirtualLock
HeapValidate
HeapSize
HeapReAlloc
CreateMemoryResourceNotification
GlobalMemoryStatusEx
HeapDestroy
HeapCreate
FlushFileBuffers
MoveFileExW
MoveFileW
CopyFileW
MapViewOfFileEx
CreateEventW
CancelIo
WriteFile
SetFilePointerEx
SetFilePointer
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFileType
GetFileSizeEx
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceW
DeleteFileW
CreateFileW
CreateDirectoryW
SetThreadLocale
BindIoCompletionCallback
FindClose
RegisterWaitForSingleObject
LocalFree
LoadLibraryExA
LocalAlloc
SetLastError
DebugBreak
SwitchToThread
InterlockedExchangeAdd
GetSystemInfo
VirtualAlloc
VirtualQuery
FindFirstFileW
FindNextFileW
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualFree
GetModuleHandleExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocaleInfoW
ConvertDefaultLocale
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
TlsAlloc
TlsSetValue
TlsFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
UnmapViewOfFile
CreateFileMappingW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
ResetEvent
SetThreadPriority
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueue
DeleteTimerQueueEx

advapi32

MapGenericMask
AccessCheck
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
EqualSid
OpenProcessToken
OpenThreadToken
RegQueryValueExW
LookupPrivilegeValueW
RevertToSelf
AdjustTokenPrivileges
GetTokenInformation
SetThreadToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupAccountSidW

msvcp100

?_Orphan_all@_Container_base0@std@@QAEXXZ

shlwapi

PathRemoveFileSpecW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathCombineW

userenv

GetProfileType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.5MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/msolui110.dll
.dll regsvr32 windows x86

1297b79f6a02b17ccd62ab546c93a9dc

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca
Signer

Actual PE Digest

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

kernel32

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
FindFirstFileW
FindNextFileW
SetLastError
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
GlobalAlloc
GlobalFree
lstrcmpW
LockResource
GlobalLock
GetModuleFileNameW
GlobalUnlock
MulDiv
LoadLibraryW
GetUserDefaultLCID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
IsProcessorFeaturePresent
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedCompareExchange
FreeLibrary
DisableThreadLibraryCalls
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GlobalHandle
GetProcessHeap

ole32

OleLockRunning
OleUninitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
VariantInit
VariantClear
OleCreateFontIndirect
VariantCopy
SysFreeString

user32

CharNextW
LoadStringW
RegisterWindowMessageW
SendMessageW
DefWindowProcW
MessageBoxW
MapDialogRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
SetWindowContextHelpId
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
EnableWindow
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
CallWindowProcW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
SetFocus
UnregisterClassA

gdi32

CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt

comdlg32

GetOpenFileNameW

msvcr100

??_V@YAXPAX@Z
__CxxFrameHandler3
_purecall
??2@YAPAXI@Z
free
malloc
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??3@YAXPAX@Z
_wcsupr
_wcsicmp
wcschr
_wcsdup
swprintf_s
_ltow_s
memset
_CxxThrowException
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memcpy_s
??_U@YAPAXI@Z
_recalloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Launcher/Microsoft Analysis Services/AS OLEDB/110/xmsrv.dll
.dll windows x86

4cd6069d05f895d3e3590106a764cc93

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86
Signer

Actual PE Digest

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

getenv
__CxxFrameHandler3
fopen
strcat_s
_get_errno
qsort_s
strncat_s
_strnicmp
__iob_func
feof
qsort
strncpy_s
isalnum
_strtoi64
_strtoui64
strtod
strtol
wcstombs
atoi
_wtoi64
_vsnwprintf
memmove_s
strtok_s
tolower
wcsrchr
_strlwr_s
_wcslwr_s
bsearch
fread
_wcsicmp_l
strcpy_s
floor
_CIfmod
_wtoi
_CIpow
fflush
fwprintf
fgets
wprintf_s
fputws
wcstok
_CIsqrt
sprintf_s
printf
_time64
fclose
_wfopen
fgetws
_wgetenv
wcstod
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ungetch
_kbhit
_getch
srand
rand
_stricmp
vprintf
vwprintf
realloc
??0exception@std@@QAE@ABQBDH@Z
strchr
??2@YAPAXI@Z
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
malloc
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
memcpy_s
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
wcsncmp
wcscat_s
fputwc
wcschr
??_V@YAXPAX@Z
_CxxThrowException
memmove
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
iswalnum
_CIlog
ceil
wcscpy_s
_set_errno
memset
??3@YAXPAX@Z
_wtof
_purecall

kernel32

Module32NextW
IsDBCSLeadByte
WriteFile
CreateFileW
CreateProcessA
ReadFile
GetFileSizeEx
CreateFileA
FormatMessageW
LocalFree
WideCharToMultiByte
CreateSemaphoreW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TlsGetValue
DisableThreadLibraryCalls
CloseHandle
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentThreadId
PulseEvent
WaitForMultipleObjects
EncodePointer
DecodePointer
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ReleaseSemaphore
CreateThread
GetCurrentDirectoryW
VirtualLock
ResumeThread
WaitForSingleObject
ResetEvent
Thread32Next
Thread32First
CreateToolhelp32Snapshot
DeleteTimerQueueTimer
TlsFree
TlsSetValue
TlsAlloc
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
SystemTimeToFileTime
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetThreadTimes
GetCurrentThread
SetThreadIdealProcessor
SetThreadAffinityMask
GetProcessAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
VirtualFree
GetVersionExW
WaitForSingleObjectEx
GetOverlappedResult
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
InterlockedExchangeAdd
SwitchToThread
SleepEx

oleaut32

SysStringByteLen
SysFreeString
SysAllocStringLen
VarDateFromStr
VarR8FromStr
GetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantClear
VariantChangeTypeEx
VarR8FromCy
VarCyFromR8
VarParseNumFromStr
VarCmp

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateGuid
StringFromGUID2
IIDFromString
CoUninitialize
CoCreateInstance

Exports

Exports

XMDllCanUnloadNow
XMDllLoad

Sections

.text
Size: 24.1MB - Virtual size: 24.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.2MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/Informix.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/Sybase.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/as80.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/as90.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/db2v0801.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/hive.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/msjet.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/orcl7.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/sql2000.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/sql70.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/sql90.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/sqlpdw.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges — копия/trdtv2r41.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sqlpdw.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Cartridges/trdtv2r41.xsl
.xml
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources — копия/1049/msmdsrv.rll
.dll windows x86

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46
Signer

Actual PE Digest

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources — копия/1049/msmdsrvi.rll
.dll windows x86

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0
Signer

Actual PE Digest

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources — копия/1049/msolui110.rll
.dll windows x86

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6
Signer

Actual PE Digest

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrv.rll
.dll windows x86

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46
Signer

Actual PE Digest

28:5f:7a:0c:7a:8b:a2:52:48:97:00:2a:38:97:36:d0:41:07:28:46

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrvi.rll
.dll windows x86

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0
Signer

Actual PE Digest

4d:28:b4:19:dc:9b:4c:3f:1a:a2:df:6a:4d:dd:7b:c6:9f:2c:e0:b0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msolui110.rll
.dll windows x86

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6
Signer

Actual PE Digest

d8:80:be:90:ca:b2:aa:81:89:a4:ab:47:30:e9:e4:eb:30:82:24:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/SQLDumper — копия.exe
.exe windows x86

81c720f8641914edcd344a3a79369611

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a
Signer

Actual PE Digest

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump
ImageNtHeader

psapi

GetModuleFileNameExW
GetModuleBaseNameA
GetModuleInformation
EnumProcessModules

rpcrt4

UuidCreate
UuidToStringW
UuidFromStringW
RpcStringFreeW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

OpenProcess
Thread32First
VirtualFreeEx
InitializeCriticalSectionAndSpinCount
Sleep
ReadProcessMemory
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetFileAttributesW
Thread32Next
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
FindClose
OpenThread
SetConsoleCtrlHandler
GetExitCodeThread
CreateEventW
GetSystemInfo
WriteFile
CreateToolhelp32Snapshot
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
DebugBreak
WriteProcessMemory
SuspendThread
ResumeThread
CreateThread
VirtualFree
GetModuleHandleW
SleepEx
SetEvent
GetComputerNameW
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
VirtualQuery
SetFilePointer
FindFirstFileW
FindNextFileW
GetFileSize
ExitProcess
ExpandEnvironmentStringsW
SetLastError
GetPrivateProfileStringW
lstrlenW
CompareStringW
GetProcessHeap
SetEnvironmentVariableW
HeapReAlloc
GetEnvironmentVariableW
CreateRemoteThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
DecodePointer
EncodePointer
RaiseException
InterlockedExchange
LocalAlloc
LoadLibraryExA

advapi32

RegOpenKeyW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
QueryServiceStatusEx
SetServiceStatus
StartServiceW
LookupPrivilegeValueW
RegQueryValueExW
RegisterServiceCtrlHandlerExW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle

msvcr100

_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
exit
_wstrtime_s
_time64
wcsncmp
swscanf_s
??3@YAXPAX@Z
_vsnwprintf
wcsrchr
_wmakepath_s
memset
_wremove
_errno
_wsplitpath_s
wcsnlen
qsort
_wtoi
wcstoul
_gmtime64_s
_wcsicmp
wcschr
_wstrdate_s
_swscanf_s_l
__CxxFrameHandler3
memcpy
_stricmp
wprintf

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/SQLDumper.exe
.exe windows x86

81c720f8641914edcd344a3a79369611

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a
Signer

Actual PE Digest

2d:ba:af:60:19:77:d5:3b:13:7c:11:2a:46:7a:6d:30:6b:4b:b2:5a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump
ImageNtHeader

psapi

GetModuleFileNameExW
GetModuleBaseNameA
GetModuleInformation
EnumProcessModules

rpcrt4

UuidCreate
UuidToStringW
UuidFromStringW
RpcStringFreeW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

OpenProcess
Thread32First
VirtualFreeEx
InitializeCriticalSectionAndSpinCount
Sleep
ReadProcessMemory
FormatMessageW
GetVersionExW
LeaveCriticalSection
GetFileAttributesW
Thread32Next
ReadFile
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetLastError
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
FindClose
OpenThread
SetConsoleCtrlHandler
GetExitCodeThread
CreateEventW
GetSystemInfo
WriteFile
CreateToolhelp32Snapshot
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
DebugBreak
WriteProcessMemory
SuspendThread
ResumeThread
CreateThread
VirtualFree
GetModuleHandleW
SleepEx
SetEvent
GetComputerNameW
WaitForSingleObject
CreateDirectoryW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
VirtualQuery
SetFilePointer
FindFirstFileW
FindNextFileW
GetFileSize
ExitProcess
ExpandEnvironmentStringsW
SetLastError
GetPrivateProfileStringW
lstrlenW
CompareStringW
GetProcessHeap
SetEnvironmentVariableW
HeapReAlloc
GetEnvironmentVariableW
CreateRemoteThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
DecodePointer
EncodePointer
RaiseException
InterlockedExchange
LocalAlloc
LoadLibraryExA

advapi32

RegOpenKeyW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
QueryServiceStatusEx
SetServiceStatus
StartServiceW
LookupPrivilegeValueW
RegQueryValueExW
RegisterServiceCtrlHandlerExW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle

msvcr100

_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
exit
_wstrtime_s
_time64
wcsncmp
swscanf_s
??3@YAXPAX@Z
_vsnwprintf
wcsrchr
_wmakepath_s
memset
_wremove
_errno
_wsplitpath_s
wcsnlen
qsort
_wtoi
wcstoul
_gmtime64_s
_wcsicmp
wcschr
_wstrdate_s
_swscanf_s_l
__CxxFrameHandler3
memcpy
_stricmp
wprintf

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/dbghelp — копия.dll
.dll windows x86

fa6b094f828920cf8999743ff0004319

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/dbghelp.dll
.dll windows x86

fa6b094f828920cf8999743ff0004319

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msmdlocal — копия.dll
.dll windows x86

30b9b02c4717da4bc8cc78b0a4bd2e81

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2
Signer

Actual PE Digest

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
_Nan
_Inf
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
calloc
_vsnwprintf_l
_resetstkoflw
??0exception@std@@QAE@ABQBDH@Z
strchr
sprintf_s
fread
bsearch
_wcslwr_s
_strlwr_s
strcpy_s
fwprintf_s
_configthreadlocale
_wgetenv
exit
??2@YAPAXI@Z
_vsnprintf_s
_wcsupr
_ui64tow
_ultow_s
memmove_s
towlower
iswalnum
iswlower
iswalpha
wprintf
_CIfmod
_ultoa_s
_snwprintf_s
_CIlog
_CIsqrt
printf
_finite
wcstok
bsearch_s
qsort_s
_CIpow
_CIexp
ceil
vfprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
fseek
fprintf
_fsopen
getenv
_wcslwr
iswdigit
_ltow
_swscanf_s_l
longjmp
_setjmp3
_wcsnicmp_l
_wtoi64_l
_wfullpath
__pctype_func
_isctype_l
_iswprint_l
_i64tow_s
_i64tow
_wcstoi64
_snprintf_s
strncpy_s
_waccess
_wcsdup
_wsetlocale
_time64
_CIlog10
_CIatan
_CIsin
frexp
ldexp
_wfsopen
_wctime64
srand
rand
_wcsicmp_l
_vsnwprintf
iswspace
_isnan
_itow
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcsrchr
wcschr
swprintf_s
_wtoi
wcstoul
wcstol
_wcsnicmp
wcstok_s
_errno
qsort
wcscpy_s
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_beginthreadex
_wsplitpath_s
_wmakepath_s
wcsncmp
wcscat_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
memcpy_s
malloc
free
_purecall
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
memmove
memset
_vswprintf_c_l
_wcsicmp
wcsstr
memcpy
wcspbrk
__CxxFrameHandler3
_CxxThrowException
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

kernel32

GetStartupInfoW
GetUserDefaultUILanguage
EncodePointer
DecodePointer
SetEnvironmentVariableW
CompareStringW
GetPrivateProfileStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
Module32NextW
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
SystemTimeToFileTime
GetLocaleInfoW
LocaleNameToLCID
CreateSemaphoreW
CreateDirectoryW
GetFileInformationByHandle
GetFileType
RemoveDirectoryW
SetFilePointer
SetFileTime
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
MapViewOfFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueueUserWorkItem
ConvertThreadToFiber
BindIoCompletionCallback
GetThreadLocale
SetThreadLocale
GetFileSize
FlushFileBuffers
WaitForMultipleObjectsEx
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
IsValidLocale
GetSystemDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
ExpandEnvironmentStringsW
TlsGetValue
OutputDebugStringA
SetLastError
LeaveCriticalSection
DeleteCriticalSection
SleepEx
DisableThreadLibraryCalls
GetProcAddress
LocalFree
LoadLibraryExA
LocalAlloc
GetLastError
InterlockedExchange
RaiseException
FreeLibrary
MultiByteToWideChar
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
DebugBreak
SwitchToThread
GetCurrentThreadId
GetTickCount
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
GetCurrentProcessId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
FindClose
FindFirstFileW
FindNextFileW
GetVolumeInformationW
DuplicateHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
SetEvent
ResetEvent
HeapCreate
HeapDestroy
HeapCompact
GlobalMemoryStatusEx
CreateMemoryResourceNotification
QueryMemoryResourceNotification
GetModuleHandleA
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
GetProcessWorkingSetSize
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
AddVectoredExceptionHandler
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
OpenProcess
ReadFile
ReadFileScatter
WriteFile
WriteFileGather
FindCloseChangeNotification
GetThreadPriority
FindNextChangeNotification
GetFileAttributesExW
CopyFileW
MoveFileExW
GetExitCodeProcess
CreateProcessW
CreateTimerQueue
ChangeTimerQueueTimer
DeleteTimerQueueEx
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
DeleteFileW
GetDiskFreeSpaceExW
GetVolumePathNameW
UnregisterWaitEx
RegisterWaitForSingleObject
OpenThread
GetProcessTimes
PulseEvent
GlobalMemoryStatus
CreateFiber
DeleteFiber
SwitchToFiber
ExitProcess
CreateThread
ResumeThread
LCIDToLocaleName
GetLocaleInfoEx
lstrlenA
lstrlenW
FileTimeToLocalFileTime
GlobalFree
ConvertDefaultLocale
SetConsoleCtrlHandler
CreateHardLinkW
WaitForSingleObject
Sleep
IsDBCSLeadByte
LoadLibraryW
ReadProcessMemory
CreateMutexW
SetHandleInformation
ReleaseMutex
FindFirstChangeNotificationW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDeriveKey
ImpersonateLoggedOnUser
GetSecurityInfo
GetUserNameW
AddAccessAllowedAceEx
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
SetThreadToken
OpenThreadToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
CryptGenKey
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
CopySid
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
InitializeAcl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
LookupAccountSidW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSidToSidW
AccessCheck
AllocateLocallyUniqueId
RevertToSelf
ImpersonateAnonymousToken
MapGenericMask
LogonUserW
LsaNtStatusToWinError
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
SetServiceStatus
RegisterServiceCtrlHandlerW

shlwapi

PathCombineW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathRemoveExtensionW
PathRemoveFileSpecW

iphlpapi

GetUnicastIpAddressEntry
GetBestInterfaceEx

userenv

GetProfileType

ncrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptExportKey
BCryptDestroyKey
NCryptOpenStorageProvider
NCryptGetProperty
NCryptImportKey
NCryptVerifySignature
NCryptFreeObject

Exports

Exports

DmpGetClientExport
MSMDCanUnloadNow
MSMDCancelCommands
MSMDCloseHandle
MSMDGetDBImageSize
MSMDGetDBLastModified
MSMDGetMDXUtils
MSMDInitLocal
MSMDLoadDBImage
MSMDOpenLocal
MSMDOpenRequest
MSMDParseFormulaExpression
MSMDParseGetCubeName
MSMDParseXLFormulaExpression
MSMDReadData
MSMDReadDataEx
MSMDReceiveResponse
MSMDRenameServer
MSMDSaveDBImage
MSMDSendRequest
MSMDStopLocal
MSMDWriteData
MSMDWriteDataEx

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.1MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msmdlocal.dll
.dll windows x86

30b9b02c4717da4bc8cc78b0a4bd2e81

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2
Signer

Actual PE Digest

07:7f:ff:1d:d6:09:04:46:00:2c:7e:55:1f:f3:01:d8:d5:10:a5:d2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
_Nan
_Inf
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
calloc
_vsnwprintf_l
_resetstkoflw
??0exception@std@@QAE@ABQBDH@Z
strchr
sprintf_s
fread
bsearch
_wcslwr_s
_strlwr_s
strcpy_s
fwprintf_s
_configthreadlocale
_wgetenv
exit
??2@YAPAXI@Z
_vsnprintf_s
_wcsupr
_ui64tow
_ultow_s
memmove_s
towlower
iswalnum
iswlower
iswalpha
wprintf
_CIfmod
_ultoa_s
_snwprintf_s
_CIlog
_CIsqrt
printf
_finite
wcstok
bsearch_s
qsort_s
_CIpow
_CIexp
ceil
vfprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
fseek
fprintf
_fsopen
getenv
_wcslwr
iswdigit
_ltow
_swscanf_s_l
longjmp
_setjmp3
_wcsnicmp_l
_wtoi64_l
_wfullpath
__pctype_func
_isctype_l
_iswprint_l
_i64tow_s
_i64tow
_wcstoi64
_snprintf_s
strncpy_s
_waccess
_wcsdup
_wsetlocale
_time64
_CIlog10
_CIatan
_CIsin
frexp
ldexp
_wfsopen
_wctime64
srand
rand
_wcsicmp_l
_vsnwprintf
iswspace
_isnan
_itow
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcsrchr
wcschr
swprintf_s
_wtoi
wcstoul
wcstol
_wcsnicmp
wcstok_s
_errno
qsort
wcscpy_s
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_beginthreadex
_wsplitpath_s
_wmakepath_s
wcsncmp
wcscat_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
memcpy_s
malloc
free
_purecall
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
memmove
memset
_vswprintf_c_l
_wcsicmp
wcsstr
memcpy
wcspbrk
__CxxFrameHandler3
_CxxThrowException
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

kernel32

GetStartupInfoW
GetUserDefaultUILanguage
EncodePointer
DecodePointer
SetEnvironmentVariableW
CompareStringW
GetPrivateProfileStringW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
Module32NextW
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
SystemTimeToFileTime
GetLocaleInfoW
LocaleNameToLCID
CreateSemaphoreW
CreateDirectoryW
GetFileInformationByHandle
GetFileType
RemoveDirectoryW
SetFilePointer
SetFileTime
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
MapViewOfFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueueUserWorkItem
ConvertThreadToFiber
BindIoCompletionCallback
GetThreadLocale
SetThreadLocale
GetFileSize
FlushFileBuffers
WaitForMultipleObjectsEx
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
IsValidLocale
GetSystemDefaultLCID
UnhandledExceptionFilter
IsProcessorFeaturePresent
ExpandEnvironmentStringsW
TlsGetValue
OutputDebugStringA
SetLastError
LeaveCriticalSection
DeleteCriticalSection
SleepEx
DisableThreadLibraryCalls
GetProcAddress
LocalFree
LoadLibraryExA
LocalAlloc
GetLastError
InterlockedExchange
RaiseException
FreeLibrary
MultiByteToWideChar
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
DebugBreak
SwitchToThread
GetCurrentThreadId
GetTickCount
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
GetCurrentProcessId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
FindClose
FindFirstFileW
FindNextFileW
GetVolumeInformationW
DuplicateHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
SetEvent
ResetEvent
HeapCreate
HeapDestroy
HeapCompact
GlobalMemoryStatusEx
CreateMemoryResourceNotification
QueryMemoryResourceNotification
GetModuleHandleA
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
GetProcessWorkingSetSize
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
AddVectoredExceptionHandler
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
OpenProcess
ReadFile
ReadFileScatter
WriteFile
WriteFileGather
FindCloseChangeNotification
GetThreadPriority
FindNextChangeNotification
GetFileAttributesExW
CopyFileW
MoveFileExW
GetExitCodeProcess
CreateProcessW
CreateTimerQueue
ChangeTimerQueueTimer
DeleteTimerQueueEx
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileW
DeleteFileW
GetDiskFreeSpaceExW
GetVolumePathNameW
UnregisterWaitEx
RegisterWaitForSingleObject
OpenThread
GetProcessTimes
PulseEvent
GlobalMemoryStatus
CreateFiber
DeleteFiber
SwitchToFiber
ExitProcess
CreateThread
ResumeThread
LCIDToLocaleName
GetLocaleInfoEx
lstrlenA
lstrlenW
FileTimeToLocalFileTime
GlobalFree
ConvertDefaultLocale
SetConsoleCtrlHandler
CreateHardLinkW
WaitForSingleObject
Sleep
IsDBCSLeadByte
LoadLibraryW
ReadProcessMemory
CreateMutexW
SetHandleInformation
ReleaseMutex
FindFirstChangeNotificationW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDeriveKey
ImpersonateLoggedOnUser
GetSecurityInfo
GetUserNameW
AddAccessAllowedAceEx
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
SetThreadToken
OpenThreadToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
CryptGenKey
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptExportKey
CryptImportKey
CryptEncrypt
CryptDecrypt
CopySid
GetLengthSid
AddAccessAllowedAce
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
InitializeAcl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
LookupAccountSidW
LookupAccountNameW
ConvertSidToStringSidW
ConvertStringSidToSidW
AccessCheck
AllocateLocallyUniqueId
RevertToSelf
ImpersonateAnonymousToken
MapGenericMask
LogonUserW
LsaNtStatusToWinError
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
SetServiceStatus
RegisterServiceCtrlHandlerW

shlwapi

PathCombineW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathRemoveExtensionW
PathRemoveFileSpecW

iphlpapi

GetUnicastIpAddressEntry
GetBestInterfaceEx

userenv

GetProfileType

ncrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptExportKey
BCryptDestroyKey
NCryptOpenStorageProvider
NCryptGetProperty
NCryptImportKey
NCryptVerifySignature
NCryptFreeObject

Exports

Exports

DmpGetClientExport
MSMDCanUnloadNow
MSMDCancelCommands
MSMDCloseHandle
MSMDGetDBImageSize
MSMDGetDBLastModified
MSMDGetMDXUtils
MSMDInitLocal
MSMDLoadDBImage
MSMDOpenLocal
MSMDOpenRequest
MSMDParseFormulaExpression
MSMDParseGetCubeName
MSMDParseXLFormulaExpression
MSMDReadData
MSMDReadDataEx
MSMDReceiveResponse
MSMDRenameServer
MSMDSaveDBImage
MSMDSendRequest
MSMDStopLocal
MSMDWriteData
MSMDWriteDataEx

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.1MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msmgdsrv — копия.dll
.dll windows x86

1f0b9d86d3b09c1459e4f99bc82b614a

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee
Signer

Actual PE Digest

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSemaphoreW
CreateFileW
CreateDirectoryW
DeleteFileW
GetFileSizeEx
GetFileType
RemoveDirectoryW
SetEndOfFile
SetFilePointer
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObject
GetThreadLocale
SetThreadLocale
FlushFileBuffers
GetDiskFreeSpaceExW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
CloseHandle
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
TlsGetValue
LocalFree
GetFileInformationByHandle
InterlockedIncrement
IsProcessorFeaturePresent
UnhandledExceptionFilter
DecodePointer
EncodePointer
Sleep
Module32NextW
PulseEvent
FindResourceW
SizeofResource
LockResource
LoadResource
GetLastError
LoadLibraryExA
LocalAlloc
InterlockedExchange
RaiseException
FindClose
FindFirstFileW
FindNextFileW
SetLastError
QueryPerformanceFrequency
GetOverlappedResult
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetCurrentProcess
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
InterlockedDecrement
InterlockedCompareExchange
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
TerminateProcess
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
DebugBreak
SwitchToThread
GetLocaleInfoW
ConvertDefaultLocale
SetEvent
ResetEvent
HeapCreate
HeapDestroy
GlobalMemoryStatusEx
CreateMemoryResourceNotification
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
OutputDebugStringA
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
ReadFile
ReadFileScatter
WriteFile
GetFileAttributesExW
CopyFileW
MoveFileExW
DeleteTimerQueueEx

msvcp100

?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ

msvcr100

__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
memmove_s
_wcsicmp_l
bsearch_s
sprintf_s
_vsnwprintf
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcschr
wcsrchr
_wtoi
_msize
_aligned_msize
_except_handler4_common
_aligned_malloc
_aligned_free
realloc
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vswprintf_c_l
_snprintf_s
strncpy_s
calloc
_wsetlocale
_snwprintf_s
_vsnprintf_s
_wcsicmp
wcsstr
malloc
free
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
_wcsnicmp
wcscpy_s
memcpy_s
_itow_s
_wsplitpath_s
_wmakepath_s
wcsncmp
wcspbrk
_purecall
wcscat_s
wcsncpy_s
memset
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_CxxThrowException
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??3@YAXPAX@Z
??_V@YAXPAX@Z
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__FrameUnwindFilter
_cexit
__RTDynamicCast
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_aligned_realloc
__clean_type_info_names_internal

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SetThreadToken
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RevertToSelf

mscoree

_CorDllMain

Exports

Exports

MSMDCreateAssembly
MSMDCreateManagedConnection
MSMDCreateManagedDSV
MSMDCreateManagedNLP
MSMDCreateTimeDimCalculator
MSMDCreateTimeDimReader
MSMDFileSystemBrowserFileExists
MSMDFileSystemBrowserGetAllowedDirectories
MSMDFileSystemBrowserGetDirectories
MSMDFileSystemBrowserGetFiles
MSMDFileSystemBrowserGetLogicalDrives
MSMDInitModule
MSMDLocalStreamClose
MSMDLocalStreamCloseBase
MSMDLocalStreamFlush
MSMDLocalStreamRead
MSMDLocalStreamSkip
MSMDLocalStreamWrite
MSMDLocalStreamWriteEndOfMessage
MSMDOnServerReady
MSMDResetModule
MSMDSetFeatureSwitches

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 855KB - Virtual size: 854KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.3MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msmgdsrv.dll
.dll windows x86

1f0b9d86d3b09c1459e4f99bc82b614a

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee
Signer

Actual PE Digest

67:1f:23:2c:95:00:e6:ea:be:0b:af:6a:9a:2d:3f:ac:3b:5c:68:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateSemaphoreW
CreateFileW
CreateDirectoryW
DeleteFileW
GetFileSizeEx
GetFileType
RemoveDirectoryW
SetEndOfFile
SetFilePointer
CancelIo
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
MoveFileW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObject
GetThreadLocale
SetThreadLocale
FlushFileBuffers
GetDiskFreeSpaceExW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
CloseHandle
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
TlsGetValue
LocalFree
GetFileInformationByHandle
InterlockedIncrement
IsProcessorFeaturePresent
UnhandledExceptionFilter
DecodePointer
EncodePointer
Sleep
Module32NextW
PulseEvent
FindResourceW
SizeofResource
LockResource
LoadResource
GetLastError
LoadLibraryExA
LocalAlloc
InterlockedExchange
RaiseException
FindClose
FindFirstFileW
FindNextFileW
SetLastError
QueryPerformanceFrequency
GetOverlappedResult
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
InterlockedExchangeAdd
GetCurrentProcess
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualFree
VirtualQuery
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
InterlockedDecrement
InterlockedCompareExchange
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
TerminateProcess
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
Thread32First
Thread32Next
DebugBreak
SwitchToThread
GetLocaleInfoW
ConvertDefaultLocale
SetEvent
ResetEvent
HeapCreate
HeapDestroy
GlobalMemoryStatusEx
CreateMemoryResourceNotification
HeapReAlloc
HeapSize
HeapValidate
VirtualLock
VirtualUnlock
OutputDebugStringA
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetLocalTime
SetProcessWorkingSetSize
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
SetUnhandledExceptionFilter
TryEnterCriticalSection
WideCharToMultiByte
GetSystemTime
GetDiskFreeSpaceW
ReleaseSemaphore
CreateEventW
SetThreadPriority
ReadFile
ReadFileScatter
WriteFile
GetFileAttributesExW
CopyFileW
MoveFileExW
DeleteTimerQueueEx

msvcp100

?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ

msvcr100

__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
memmove_s
_wcsicmp_l
bsearch_s
sprintf_s
_vsnwprintf
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
_endthreadex
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
_wfopen
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
swscanf_s
_wtol
wcschr
wcsrchr
_wtoi
_msize
_aligned_msize
_except_handler4_common
_aligned_malloc
_aligned_free
realloc
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vswprintf_c_l
_snprintf_s
strncpy_s
calloc
_wsetlocale
_snwprintf_s
_vsnprintf_s
_wcsicmp
wcsstr
malloc
free
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
_wcsnicmp
wcscpy_s
memcpy_s
_itow_s
_wsplitpath_s
_wmakepath_s
wcsncmp
wcspbrk
_purecall
wcscat_s
wcsncpy_s
memset
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_CxxThrowException
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??3@YAXPAX@Z
??_V@YAXPAX@Z
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__FrameUnwindFilter
_cexit
__RTDynamicCast
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_aligned_realloc
__clean_type_info_names_internal

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SetThreadToken
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
InitializeSecurityDescriptor
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RevertToSelf

mscoree

_CorDllMain

Exports

Exports

MSMDCreateAssembly
MSMDCreateManagedConnection
MSMDCreateManagedDSV
MSMDCreateManagedNLP
MSMDCreateTimeDimCalculator
MSMDCreateTimeDimReader
MSMDFileSystemBrowserFileExists
MSMDFileSystemBrowserGetAllowedDirectories
MSMDFileSystemBrowserGetDirectories
MSMDFileSystemBrowserGetFiles
MSMDFileSystemBrowserGetLogicalDrives
MSMDInitModule
MSMDLocalStreamClose
MSMDLocalStreamCloseBase
MSMDLocalStreamFlush
MSMDLocalStreamRead
MSMDLocalStreamSkip
MSMDLocalStreamWrite
MSMDLocalStreamWriteEndOfMessage
MSMDOnServerReady
MSMDResetModule
MSMDSetFeatureSwitches

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 855KB - Virtual size: 854KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.3MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msolap110 — копия.dll
.dll regsvr32 windows x86

0bce98ee70e0cf58c1e95a5af6536002

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b
Signer

Actual PE Digest

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

_vsnwprintf_l
iswdigit
_wcsicmp_l
_vsnwprintf
sprintf_s
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
wcstol
_wtoi64_l
wcsrchr
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_endthreadex
_beginthreadex
_snwprintf_s
_wsetlocale
_wcsdup
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_isnan
_ui64tow
_i64tow
_wmakepath_s
wcspbrk
_itow_s
_snprintf_s
strncpy_s
_vsnprintf_s
_wtol
??3@YAXPAX@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_wcsicmp
wcsncmp
swscanf_s
_vswprintf_c_l
iswspace
_wfopen
_wsplitpath_s
swprintf_s
_wtoi
_ultow
_wcsnicmp
wcschr
memmove
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
??_V@YAXPAX@Z
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memmove_s
memcpy_s
_recalloc
malloc
free
calloc
??2@YAPAXI@Z
_purecall
_wfullpath

kernel32

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
OutputDebugStringA
GetCurrentProcessId
TlsGetValue
CreateTimerQueueTimer
DeleteTimerQueueTimer
IsValidCodePage
GetACP
CloseHandle
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetThreadLocale
GetUserDefaultUILanguage
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
SleepEx
GetTickCount
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
WideCharToMultiByte
EnterCriticalSection
EncodePointer
DecodePointer
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
IsProcessorFeaturePresent
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
RaiseException
CreateSemaphoreW
LoadLibraryExW
GetVolumePathNameW
GetDiskFreeSpaceExW
PulseEvent
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
WaitForMultipleObjectsEx
ReadFileScatter
ReleaseSemaphore
GetSystemTime
SetProcessWorkingSetSize
GetLocalTime
GetLongPathNameW
GetFullPathNameW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageW
VirtualUnlock
VirtualLock
HeapValidate
HeapSize
HeapReAlloc
CreateMemoryResourceNotification
GlobalMemoryStatusEx
HeapDestroy
HeapCreate
FlushFileBuffers
MoveFileExW
MoveFileW
CopyFileW
MapViewOfFileEx
CreateEventW
CancelIo
WriteFile
SetFilePointerEx
SetFilePointer
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFileType
GetFileSizeEx
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceW
DeleteFileW
CreateFileW
CreateDirectoryW
SetThreadLocale
BindIoCompletionCallback
FindClose
RegisterWaitForSingleObject
LocalFree
LoadLibraryExA
LocalAlloc
SetLastError
DebugBreak
SwitchToThread
InterlockedExchangeAdd
GetSystemInfo
VirtualAlloc
VirtualQuery
FindFirstFileW
FindNextFileW
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualFree
GetModuleHandleExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocaleInfoW
ConvertDefaultLocale
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
TlsAlloc
TlsSetValue
TlsFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
UnmapViewOfFile
CreateFileMappingW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
ResetEvent
SetThreadPriority
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueue
DeleteTimerQueueEx

advapi32

MapGenericMask
AccessCheck
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
EqualSid
OpenProcessToken
OpenThreadToken
RegQueryValueExW
LookupPrivilegeValueW
RevertToSelf
AdjustTokenPrivileges
GetTokenInformation
SetThreadToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupAccountSidW

msvcp100

?_Orphan_all@_Container_base0@std@@QAEXXZ

shlwapi

PathRemoveFileSpecW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathCombineW

userenv

GetProfileType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.5MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msolap110.dll
.dll regsvr32 windows x86

0bce98ee70e0cf58c1e95a5af6536002

Code Sign

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b
Signer

Actual PE Digest

69:8d:cb:83:b9:8c:62:a7:7f:bd:22:66:74:4e:84:be:e5:fc:f0:8b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

_vsnwprintf_l
iswdigit
_wcsicmp_l
_vsnwprintf
sprintf_s
_CIpow
_CIexp
ceil
vfprintf
fseek
fprintf
_fsopen
getenv
floor
wcsncat_s
setvbuf
_ftelli64
fflush
ferror
fclose
vswprintf_s
vfwprintf
fwprintf
fputwc
__iob_func
_local_unwind4
_vsnwprintf_s
wcstol
_wtoi64_l
wcsrchr
_msize
_aligned_msize
_aligned_realloc
_aligned_malloc
_aligned_free
realloc
_endthreadex
_beginthreadex
_snwprintf_s
_wsetlocale
_wcsdup
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_isnan
_ui64tow
_i64tow
_wmakepath_s
wcspbrk
_itow_s
_snprintf_s
strncpy_s
_vsnprintf_s
_wtol
??3@YAXPAX@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_wcsicmp
wcsncmp
swscanf_s
_vswprintf_c_l
iswspace
_wfopen
_wsplitpath_s
swprintf_s
_wtoi
_ultow
_wcsnicmp
wcschr
memmove
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
??_V@YAXPAX@Z
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memmove_s
memcpy_s
_recalloc
malloc
free
calloc
??2@YAPAXI@Z
_purecall
_wfullpath

kernel32

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
OutputDebugStringA
GetCurrentProcessId
TlsGetValue
CreateTimerQueueTimer
DeleteTimerQueueTimer
IsValidCodePage
GetACP
CloseHandle
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetThreadLocale
GetUserDefaultUILanguage
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
SleepEx
GetTickCount
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
WideCharToMultiByte
EnterCriticalSection
EncodePointer
DecodePointer
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
IsProcessorFeaturePresent
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLastError
RaiseException
CreateSemaphoreW
LoadLibraryExW
GetVolumePathNameW
GetDiskFreeSpaceExW
PulseEvent
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
WaitForMultipleObjectsEx
ReadFileScatter
ReleaseSemaphore
GetSystemTime
SetProcessWorkingSetSize
GetLocalTime
GetLongPathNameW
GetFullPathNameW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageW
VirtualUnlock
VirtualLock
HeapValidate
HeapSize
HeapReAlloc
CreateMemoryResourceNotification
GlobalMemoryStatusEx
HeapDestroy
HeapCreate
FlushFileBuffers
MoveFileExW
MoveFileW
CopyFileW
MapViewOfFileEx
CreateEventW
CancelIo
WriteFile
SetFilePointerEx
SetFilePointer
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFileType
GetFileSizeEx
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceW
DeleteFileW
CreateFileW
CreateDirectoryW
SetThreadLocale
BindIoCompletionCallback
FindClose
RegisterWaitForSingleObject
LocalFree
LoadLibraryExA
LocalAlloc
SetLastError
DebugBreak
SwitchToThread
InterlockedExchangeAdd
GetSystemInfo
VirtualAlloc
VirtualQuery
FindFirstFileW
FindNextFileW
GetOverlappedResult
WaitForSingleObjectEx
SetWaitableTimer
GetSystemDirectoryW
GetComputerNameExW
GetVersionExW
GetLogicalProcessorInformation
VirtualFree
GetModuleHandleExW
GetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
CreateWaitableTimerW
GetNumaProcessorNode
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocaleInfoW
ConvertDefaultLocale
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
TlsAlloc
TlsSetValue
TlsFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetCurrentThread
GetThreadTimes
WaitForMultipleObjects
UnmapViewOfFile
CreateFileMappingW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
ResetEvent
SetThreadPriority
ResumeThread
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueue
DeleteTimerQueueEx

advapi32

MapGenericMask
AccessCheck
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
EqualSid
OpenProcessToken
OpenThreadToken
RegQueryValueExW
LookupPrivilegeValueW
RevertToSelf
AdjustTokenPrivileges
GetTokenInformation
SetThreadToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupAccountSidW

msvcp100

?_Orphan_all@_Container_base0@std@@QAEXXZ

shlwapi

PathRemoveFileSpecW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathCombineW

userenv

GetProfileType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 655KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.5MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msolui110 — копия.dll
.dll regsvr32 windows x86

1297b79f6a02b17ccd62ab546c93a9dc

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca
Signer

Actual PE Digest

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

kernel32

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
FindFirstFileW
FindNextFileW
SetLastError
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
GlobalAlloc
GlobalFree
lstrcmpW
LockResource
GlobalLock
GetModuleFileNameW
GlobalUnlock
MulDiv
LoadLibraryW
GetUserDefaultLCID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
IsProcessorFeaturePresent
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedCompareExchange
FreeLibrary
DisableThreadLibraryCalls
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GlobalHandle
GetProcessHeap

ole32

OleLockRunning
OleUninitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
VariantInit
VariantClear
OleCreateFontIndirect
VariantCopy
SysFreeString

user32

CharNextW
LoadStringW
RegisterWindowMessageW
SendMessageW
DefWindowProcW
MessageBoxW
MapDialogRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
SetWindowContextHelpId
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
EnableWindow
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
CallWindowProcW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
SetFocus
UnregisterClassA

gdi32

CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt

comdlg32

GetOpenFileNameW

msvcr100

??_V@YAXPAX@Z
__CxxFrameHandler3
_purecall
??2@YAPAXI@Z
free
malloc
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??3@YAXPAX@Z
_wcsupr
_wcsicmp
wcschr
_wcsdup
swprintf_s
_ltow_s
memset
_CxxThrowException
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memcpy_s
??_U@YAPAXI@Z
_recalloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/msolui110.dll
.dll regsvr32 windows x86

1297b79f6a02b17ccd62ab546c93a9dc

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca
Signer

Actual PE Digest

fd:13:7b:1b:22:68:64:91:9a:ad:37:dc:80:ba:06:d7:1f:7d:bb:ca

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW

kernel32

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
MultiByteToWideChar
FindFirstFileW
FindNextFileW
SetLastError
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
GlobalAlloc
GlobalFree
lstrcmpW
LockResource
GlobalLock
GetModuleFileNameW
GlobalUnlock
MulDiv
LoadLibraryW
GetUserDefaultLCID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
IsProcessorFeaturePresent
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedCompareExchange
FreeLibrary
DisableThreadLibraryCalls
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GlobalHandle
GetProcessHeap

ole32

OleLockRunning
OleUninitialize
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
GetErrorInfo
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
VariantInit
VariantClear
OleCreateFontIndirect
VariantCopy
SysFreeString

user32

CharNextW
LoadStringW
RegisterWindowMessageW
SendMessageW
DefWindowProcW
MessageBoxW
MapDialogRect
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
SetWindowContextHelpId
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
EnableWindow
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
CallWindowProcW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
SetFocus
UnregisterClassA

gdi32

CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt

comdlg32

GetOpenFileNameW

msvcr100

??_V@YAXPAX@Z
__CxxFrameHandler3
_purecall
??2@YAPAXI@Z
free
malloc
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??3@YAXPAX@Z
_wcsupr
_wcsicmp
wcschr
_wcsdup
swprintf_s
_ltow_s
memset
_CxxThrowException
wcsstr
wcsncpy_s
wcscpy_s
wcscat_s
memcpy_s
??_U@YAPAXI@Z
_recalloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/xmsrv — копия.dll
.dll windows x86

4cd6069d05f895d3e3590106a764cc93

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86
Signer

Actual PE Digest

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

getenv
__CxxFrameHandler3
fopen
strcat_s
_get_errno
qsort_s
strncat_s
_strnicmp
__iob_func
feof
qsort
strncpy_s
isalnum
_strtoi64
_strtoui64
strtod
strtol
wcstombs
atoi
_wtoi64
_vsnwprintf
memmove_s
strtok_s
tolower
wcsrchr
_strlwr_s
_wcslwr_s
bsearch
fread
_wcsicmp_l
strcpy_s
floor
_CIfmod
_wtoi
_CIpow
fflush
fwprintf
fgets
wprintf_s
fputws
wcstok
_CIsqrt
sprintf_s
printf
_time64
fclose
_wfopen
fgetws
_wgetenv
wcstod
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ungetch
_kbhit
_getch
srand
rand
_stricmp
vprintf
vwprintf
realloc
??0exception@std@@QAE@ABQBDH@Z
strchr
??2@YAPAXI@Z
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
malloc
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
memcpy_s
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
wcsncmp
wcscat_s
fputwc
wcschr
??_V@YAXPAX@Z
_CxxThrowException
memmove
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
iswalnum
_CIlog
ceil
wcscpy_s
_set_errno
memset
??3@YAXPAX@Z
_wtof
_purecall

kernel32

Module32NextW
IsDBCSLeadByte
WriteFile
CreateFileW
CreateProcessA
ReadFile
GetFileSizeEx
CreateFileA
FormatMessageW
LocalFree
WideCharToMultiByte
CreateSemaphoreW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TlsGetValue
DisableThreadLibraryCalls
CloseHandle
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentThreadId
PulseEvent
WaitForMultipleObjects
EncodePointer
DecodePointer
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ReleaseSemaphore
CreateThread
GetCurrentDirectoryW
VirtualLock
ResumeThread
WaitForSingleObject
ResetEvent
Thread32Next
Thread32First
CreateToolhelp32Snapshot
DeleteTimerQueueTimer
TlsFree
TlsSetValue
TlsAlloc
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
SystemTimeToFileTime
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetThreadTimes
GetCurrentThread
SetThreadIdealProcessor
SetThreadAffinityMask
GetProcessAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
VirtualFree
GetVersionExW
WaitForSingleObjectEx
GetOverlappedResult
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
InterlockedExchangeAdd
SwitchToThread
SleepEx

oleaut32

SysStringByteLen
SysFreeString
SysAllocStringLen
VarDateFromStr
VarR8FromStr
GetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantClear
VariantChangeTypeEx
VarR8FromCy
VarCyFromR8
VarParseNumFromStr
VarCmp

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateGuid
StringFromGUID2
IIDFromString
CoUninitialize
CoCreateInstance

Exports

Exports

XMDllCanUnloadNow
XMDllLoad

Sections

.text
Size: 24.1MB - Virtual size: 24.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.2MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppInfo/Microsoft Analysis Services/AS OLEDB/110/xmsrv.dll
.dll windows x86

4cd6069d05f895d3e3590106a764cc93

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86
Signer

Actual PE Digest

51:2e:56:8e:b4:01:eb:c4:30:07:f3:6c:e5:56:96:e5:af:3b:4f:86

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr100

getenv
__CxxFrameHandler3
fopen
strcat_s
_get_errno
qsort_s
strncat_s
_strnicmp
__iob_func
feof
qsort
strncpy_s
isalnum
_strtoi64
_strtoui64
strtod
strtol
wcstombs
atoi
_wtoi64
_vsnwprintf
memmove_s
strtok_s
tolower
wcsrchr
_strlwr_s
_wcslwr_s
bsearch
fread
_wcsicmp_l
strcpy_s
floor
_CIfmod
_wtoi
_CIpow
fflush
fwprintf
fgets
wprintf_s
fputws
wcstok
_CIsqrt
sprintf_s
printf
_time64
fclose
_wfopen
fgetws
_wgetenv
wcstod
_beginthreadex
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ungetch
_kbhit
_getch
srand
rand
_stricmp
vprintf
vwprintf
realloc
??0exception@std@@QAE@ABQBDH@Z
strchr
??2@YAPAXI@Z
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
malloc
_isnan
swprintf_s
_ui64tow
_i64tow
iswspace
memcpy_s
_ui64tow_s
_ultow
_itow_s
wcsncpy_s
wcsncmp
wcscat_s
fputwc
wcschr
??_V@YAXPAX@Z
_CxxThrowException
memmove
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
iswalnum
_CIlog
ceil
wcscpy_s
_set_errno
memset
??3@YAXPAX@Z
_wtof
_purecall

kernel32

Module32NextW
IsDBCSLeadByte
WriteFile
CreateFileW
CreateProcessA
ReadFile
GetFileSizeEx
CreateFileA
FormatMessageW
LocalFree
WideCharToMultiByte
CreateSemaphoreW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TlsGetValue
DisableThreadLibraryCalls
CloseHandle
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentThreadId
PulseEvent
WaitForMultipleObjects
EncodePointer
DecodePointer
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ReleaseSemaphore
CreateThread
GetCurrentDirectoryW
VirtualLock
ResumeThread
WaitForSingleObject
ResetEvent
Thread32Next
Thread32First
CreateToolhelp32Snapshot
DeleteTimerQueueTimer
TlsFree
TlsSetValue
TlsAlloc
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
SystemTimeToFileTime
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetThreadTimes
GetCurrentThread
SetThreadIdealProcessor
SetThreadAffinityMask
GetProcessAffinityMask
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
VirtualFree
GetVersionExW
WaitForSingleObjectEx
GetOverlappedResult
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
InterlockedExchangeAdd
SwitchToThread
SleepEx

oleaut32

SysStringByteLen
SysFreeString
SysAllocStringLen
VarDateFromStr
VarR8FromStr
GetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantClear
VariantChangeTypeEx
VarR8FromCy
VarCyFromR8
VarParseNumFromStr
VarCmp

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoInitializeEx
CoTaskMemFree
CoCreateGuid
StringFromGUID2
IIDFromString
CoUninitialize
CoCreateInstance

Exports

Exports

XMDllCanUnloadNow
XMDllLoad

Sections

.text
Size: 24.1MB - Virtual size: 24.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.2MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/AppXRuntime.admx
.xml
Installer/Other/AppxPackageManager.admx
Installer/Other/AttachmentManager.admx
Installer/Other/AuditSettings.admx
.xml
Installer/Other/AutoPlay.admx
Installer/Other/Biometrics.admx
Installer/Other/Bits.admx
Installer/Other/CEIPEnable.admx
Installer/Other/COM.admx
Installer/Other/CipherSuiteOrder.admx
Installer/Other/CompatProvider.dll
.dll regsvr32 windows x64

d7ae07202a5ac5d9e427f377980f333b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

_wcsnicmp
??0exception@@QEAA@XZ
wcschr
_purecall
vswprintf_s
_vscwprintf
??0exception@@QEAA@AEBV0@@Z
_vsnwprintf
wcsrchr
_wcsicmp
?what@exception@@UEBAPEBDXZ
memset
__C_specific_handler
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_CxxThrowException
_XcptFilter
_amsg_exit
wcsncpy_s
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
__RTDynamicCast
memcmp
__CxxFrameHandler3
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
memmove_s
memcpy_s
malloc
wcscat_s
free
wcscpy_s
??1type_info@@UEAA@XZ
memcpy

ntdll

RtlFreeHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap

kernel32

ExpandEnvironmentStringsW
MapViewOfFile
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetModuleHandleW
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
SetThreadUILanguage
GetVersionExW
SetEnvironmentVariableW
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CompareStringW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FormatMessageW
LocalFree
CreateFileW
CloseHandle
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
GetNativeSystemInfo
GetFileAttributesW
ReadFile
SetFilePointer
FreeLibrary
GetStartupInfoW
GetExitCodeProcess
CreateProcessW
GetCurrentDirectoryW
WaitForSingleObject
SetFileAttributesW
FindNextFileW
UnmapViewOfFile
SetLastError
CreateFileMappingW
FindFirstFileW
DeviceIoControl
FindClose
SearchPathW

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
LookupPrivilegeValueW

user32

CharLowerBuffW
LoadStringW
CharNextW

ole32

StringFromGUID2
CoTaskMemFree
CoCreateGuid
StringFromCLSID
ProgIDFromCLSID
CoCreateInstance

oleaut32

LoadRegTypeLi
SysFreeString
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
VarBstrCat
SetErrorInfo
CreateErrorInfo
VariantClear
SysAllocStringLen

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

Exports

Exports

DLLGetDISMProviderCLSID
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/Conf.admx
Installer/Other/ControlPanel.admx
Installer/Other/ControlPanelDisplay.admx
Installer/Other/Cpls.admx
Installer/Other/CredSsp.admx
Installer/Other/CredUI.admx
Installer/Other/CredentialProviders.admx
Installer/Other/CtrlAltDel.admx
Installer/Other/DCOM.admx
Installer/Other/DFS.admx
Installer/Other/DWM.admx
Installer/Other/Desktop.admx
Installer/Other/DeviceCompat.admx
Installer/Other/DeviceInstallation.admx
Installer/Other/DeviceSetup.admx
Installer/Other/DigitalLocker.admx
Installer/Other/DiskDiagnostic.admx
Installer/Other/DiskNVCache.admx
Installer/Other/DiskQuota.admx
Installer/Other/DismCore.dll
.dll regsvr32 windows x64

298860fdb9cb4e7d7cb65f8079d6a0b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

fclose
wcstok_s
swscanf_s
fgetws
_wfopen
feof
iswctype
strrchr
_vsnprintf
towlower
_wcsnicmp
_wtoi
vsprintf_s
_vscprintf
rand
_vsnwprintf
wcsstr
memcmp
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
__CxxFrameHandler3
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
wcscat_s
wcsncpy_s
calloc
_purecall
malloc
_resetstkoflw
wcscpy_s
vswprintf_s
_vscwprintf
wcschr
wcsrchr
_wcsicmp
memmove_s
memcpy_s
free
memcpy

api-ms-win-downlevel-kernel32-l1-1-0

GetModuleFileNameW
GetModuleHandleW
CopyFileExW
TlsGetValue
GetFileSize
CreateEventW
ExitProcess
CreateFileMappingW
SetLastError
GetVersionExW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
RaiseException
UnmapViewOfFile
GetProcAddress
LoadLibraryExW
TerminateProcess
WaitForSingleObject
SetEvent
MapViewOfFile
SearchPathW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetVersion
FreeLibrary
DuplicateHandle
CompareStringW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
TlsFree
GetModuleHandleExW
GetCurrentDirectoryW
GetTempPathW
VirtualQuery
MultiByteToWideChar
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
CreateFileW
SetThreadUILanguage
GetLastError
GetDriveTypeW
SetFileAttributesW
FindNextFileW
DeviceIoControl
FindClose
FindFirstFileW
IsDebuggerPresent
FlushFileBuffers
GetFileSizeEx
DeleteFileA
DebugBreak
DeleteFileW
ReleaseMutex
CreateMutexA
FormatMessageA
LoadLibraryExA
GetModuleFileNameA
TlsSetValue
GetLocalTime
TlsAlloc
WriteFile
ExpandEnvironmentStringsA
CreateMutexW
CreateFileA
GetTempFileNameW
GetFullPathNameW
GetCurrentThread
GetWindowsDirectoryW
DeleteProcThreadAttributeList
SetFilePointer
CreateDirectoryW
GetFileInformationByHandle
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
MoveFileExW
GetSystemDirectoryW
FormatMessageW
CreateProcessW
UpdateProcThreadAttribute
GetEnvironmentStringsW
GetSystemWindowsDirectoryW
GetNativeSystemInfo
GetSystemInfo
GetExitCodeProcess
FreeEnvironmentStringsW
InitializeProcThreadAttributeList
ReadFile
GetFileAttributesW

api-ms-win-downlevel-ole32-l1-1-1

CoRegisterClassObject
CoSetProxyBlanket
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoRegisterPSClsid
CoRevokeClassObject
CoCreateInstance
StringFromGUID2
SetErrorInfo
GetErrorInfo
ProgIDFromCLSID
CreateErrorInfo

api-ms-win-downlevel-user32-l1-1-1

LoadStringW
CharNextW

api-ms-win-downlevel-advapi32-l1-1-1

OpenProcessToken
GetTokenInformation
EqualSid
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
GetLengthSid
RegOpenKeyExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryInfoKeyW
OpenThreadToken
RegCloseKey

api-ms-win-downlevel-kernel32-l2-1-0

LocalFree
CreateFileMappingA

ntdll

RtlNtStatusToDosError
RtlFreeHeap
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtSetInformationFile

oleaut32

VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
LoadTypeLibEx
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantInit

api-ms-win-downlevel-advapi32-l2-1-1

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-downlevel-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-downlevel-advapi32-l4-1-0

LookupPrivilegeValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/DismCorePS.dll
.dll regsvr32 windows x64

bdc025567322c4f7466984d41a35515e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

malloc
_initterm
__C_specific_handler
free
_amsg_exit
_XcptFilter
memcmp

oleaut32

BSTR_UserMarshal
LPSAFEARRAY_UserUnmarshal64
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserSize64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserSize64
BSTR_UserFree64
BSTR_UserUnmarshal64
BSTR_UserMarshal64

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrStubCall3
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
NdrOleFree
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllGetClassObject
NdrDllUnregisterProxy
CStdStubBuffer_AddRef
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrOleAllocate
CStdStubBuffer_CountRefs

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetDismInterfaces
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/DistributedLinkTracking.admx
Installer/Other/DnsClient.admx
Installer/Other/EAIME.admx
Installer/Other/EarlyLaunchAM.admx
Installer/Other/EdgeUI.admx
Installer/Other/EncryptFilesonMove.admx
Installer/Other/ErrorReporting.admx
Installer/Other/EventForwarding.admx
.xml
Installer/Other/EventLog.admx
Installer/Other/EventViewer.admx
Installer/Other/Explorer.admx
Installer/Other/ExternalBoot.admx
.xml
Installer/Other/FileHistory.admx
Installer/Other/FileRecovery.admx
Installer/Other/FileRevocation.admx
Installer/Other/FileServerVSSProvider.admx
Installer/Other/FileSys.admx
.xml
Installer/Other/FolderRedirection.admx
Installer/Other/FramePanes.admx
Installer/Other/GameExplorer.admx
Installer/Other/Globalization.admx
Installer/Other/GroupPolicy-Server.admx
Installer/Other/GroupPolicy.admx
Installer/Other/GroupPolicyPreferences.admx
Installer/Other/Help.admx
Installer/Other/HelpAndSupport.admx
Installer/Other/ICM.admx
Installer/Other/IIS.admx
Installer/Other/InkWatson.admx
Installer/Other/Kerberos.admx
Installer/Other/LanmanServer.admx
Installer/Other/LeakDiagnostic.admx
Installer/Other/LinkLayerTopologyDiscovery.admx
Installer/Other/LocationProviderAdm.admx
Installer/Other/Logon.admx
Installer/Other/MMC.admx
Installer/Other/MMCSnapIns2.admx
Installer/Other/MMCSnapins.admx
Installer/Other/MSDT.admx
Installer/Other/MSI.admx
Installer/Other/MediaCenter.admx
Installer/Other/MobilePCMobilityCenter.admx
Installer/Other/MobilePCPresentationSettings.admx
Installer/Other/Msi-FileRecovery.admx
Installer/Other/NAPXPQec.admx
Installer/Other/NCSI.admx
Installer/Other/Netlogon.admx
Installer/Other/NetworkConnections.admx
Installer/Other/NetworkIsolation.admx
Installer/Other/NetworkProjection.admx
Installer/Other/OfflineFiles.admx
Installer/Other/P2P-pnrp.admx
Installer/Other/ParentalControls.admx
Installer/Other/PeerToPeerCaching.admx
Installer/Other/PenTraining.admx
Installer/Other/PerformanceDiagnostics.admx
Installer/Other/PerformancePerftrack.admx
Installer/Other/Power.admx
Installer/Other/PowerShellExecutionPolicy.admx
Installer/Other/PreviousVersions.admx
Installer/Other/Printing.admx
Installer/Other/Printing2.admx
Installer/Other/Program Files (x86)/ASIO4ALL v2/ASIO4ALL Web Site.url
.url
Installer/Other/Program Files (x86)/ASIO4ALL v2/ASIO4ALL v2 Instruction Manual.pdf
.pdf
Installer/Other/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
.exe windows x86

9ca62f5da2a0b14971416bb381a438f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
.exe windows x64

9ca62f5da2a0b14971416bb381a438f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExitProcess

ole32

CoInitialize
CoCreateInstance

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/ASIO4ALL v2/asio4all.dll
.dll regsvr32 windows x86

1910aa462df16700a00a0ff7b2051c13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetCurrentProcess
GetModuleFileNameA
WideCharToMultiByte
TerminateThread
GetVersion
CreateFileA
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapWalk
GetCurrentThreadId
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetModuleHandleA
VirtualAlloc
VirtualFree
VirtualLock
VirtualUnlock
CreateThread
SetThreadPriority
GetCurrentThread
WaitForSingleObject
WaitForMultipleObjects
CreateEventA
SetEvent
ResetEvent

ksuser

KsCreatePin

setupapi

SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod
midiOutOpen
midiOutGetDevCapsA
midiOutClose
midiOutGetNumDevs
midiOutGetID

gdi32

DeleteObject
CreateSolidBrush
SetBkColor
SetTextColor

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

user32

ShowWindow
LoadBitmapA
MessageBoxA
SetTimer
KillTimer
LoadStringA
SetFocus
CreateWindowExA
DestroyWindow
UnregisterClassA
DefWindowProcA
SendMessageA
PostMessageA
MoveWindow
GetWindowRect
ScreenToClient
GetCursorPos
SetWindowPos
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
PostThreadMessageA
DialogBoxParamA
GetFocus
LoadIconA
SendDlgItemMessageA
GetDlgItem
EndDialog
RegisterClassExA
SetForegroundWindow

comctl32

ImageList_AddIcon
ImageList_Create

shell32

DllGetVersion
Shell_NotifyIconA
ShellExecuteA

advapi32

RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegFlushKey

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RWDEFCloseDevice
RWDEFDriveAudio
RWDEFGetDeviceInfo
RWDEFGetDeviceNameAndVersion
RWDEFGetEventBusInfo
RWDEFGetEventChannelInfo
RWDEFGetEventControllerInfo
RWDEFGetEventInfo
RWDEFGetEventNoteInfo
RWDEFIdle
RWDEFIsCloseOK
RWDEFIsPanelAppLaunched
RWDEFLaunchPanelApp
RWDEFOpenDevice
RWDEFQuitPanelApp
RWDEFSetAudioInfo

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
.dll regsvr32 windows x64

2882bd11539d66167a5dab6442f9fb19

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
GetModuleFileNameA
WideCharToMultiByte
TerminateThread
GetVersion
CreateFileA
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapWalk
GetCurrentThreadId
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetModuleHandleA
VirtualAlloc
VirtualFree
VirtualLock
VirtualUnlock
CreateThread
SetThreadPriority
GetCurrentThread
WaitForSingleObject
WaitForMultipleObjects
CreateEventA
SetEvent
ResetEvent

ksuser

KsCreatePin

setupapi

SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceAlias
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod
midiOutOpen
midiOutGetDevCapsA
midiOutClose
midiOutGetNumDevs
midiOutGetID

gdi32

DeleteObject
CreateSolidBrush
SetBkColor
SetTextColor

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

user32

ShowWindow
LoadBitmapA
MessageBoxA
SetTimer
KillTimer
LoadStringA
SetFocus
CreateWindowExA
DestroyWindow
UnregisterClassA
DefWindowProcA
SendMessageA
PostMessageA
MoveWindow
GetWindowRect
ScreenToClient
GetCursorPos
SetWindowPos
GetMessageA
DispatchMessageA
PostQuitMessage
PostThreadMessageA
DialogBoxParamA
GetFocus
LoadIconA
SendDlgItemMessageA
GetDlgItem
EndDialog
RegisterClassExA
SetForegroundWindow

comctl32

ImageList_AddIcon
ImageList_Create

shell32

DllGetVersion
Shell_NotifyIconA
ShellExecuteA

advapi32

RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegFlushKey

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
.dll windows x86

6f8f73d3790535c61959ecb492d51c4f

Code Sign

2b:32:50:47:a6:10:0e:8d:f6:fc:89:1f:0d:c6:75:7a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/05/2013, 00:00

Not After

17/05/2015, 23:59

Subject

CN=Image Line,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Image Line,L=sint-martens-latem,ST=ovl,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:e6:36:49:13:4a:fb:72:08:ad:c7:ff:f9:0a:97:78:ed:8a:fc:3e
Signer

Actual PE Digest

f7:e6:36:49:13:4a:fb:72:08:ad:c7:ff:f9:0a:97:78:ed:8a:fc:3e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Image Line,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Image Line,L=sint-martens-latem,ST=ovl,C=BE

09/03/2023, 18:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

Sleep
CreateFileA
GetCurrentProcess
GetCurrentProcessId
InterlockedExchangeAdd
InterlockedCompareExchange
CreateMutexW
WaitForSingleObject
GetLastError
ReleaseMutex
CreateEventW
SetEvent
TerminateThread
SetThreadIdealProcessor
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentThread
ResumeThread
SetThreadPriority
CreateThread
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
GetACP
SetErrorMode
GetFileAttributesW
GetLongPathNameW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetTempPathW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
CreateDirectoryW
GetTickCount
SetFileTime
GetFileTime
CreateFileW
DeleteFileW
SetFileAttributesW
OpenProcess
FindClose
FindFirstFileW
GetLogicalDriveStringsW
FindNextFileW
ReadFile
WriteFile
RemoveDirectoryW
GetModuleFileNameW
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
SearchPathW
DisableThreadLibraryCalls
SetDllDirectoryW
GetDllDirectoryW
GetFullPathNameW
GetSystemInfo
GetVersionExW
FindResourceW
LoadLibraryExW
SizeofResource
LockResource
LoadResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GetThreadPriority
OpenMutexA
CreateMutexA
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
CreateFileMappingA
SetEnvironmentVariableA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
GetProcessTimes
CloseHandle
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetFileSize
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocaleInfoA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
GetModuleHandleW
ExitProcess
GetTimeFormatA
GetDateFormatA
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
CompareStringA
SetLastError
HeapSize
HeapAlloc
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA

user32

CharLowerBuffW
CharUpperBuffW
wsprintfW

advapi32

RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegSetValueExA
RegQueryValueExW
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Exports

Exports

RWDCloseImp
RWDComBytesAvailableImp
RWDComCheckConnectionImp
RWDComCreateImp
RWDComDestroyImp
RWDComDoesMessageFitImp
RWDComReadImp
RWDComSendImp
RWDIsCloseOKImp
RWDOpenImp
RWIsReWireMixerAppRunningImp
RWM2CloseDeviceImp
RWM2CloseImp
RWM2DriveAudioImp
RWM2GetControllerInfoImp
RWM2GetDeviceCountImp
RWM2GetDeviceInfoByHandleImp
RWM2GetDeviceInfoImp
RWM2GetEventBusInfoImp
RWM2GetEventChannelInfoImp
RWM2GetEventInfoImp
RWM2GetNoteInfoImp
RWM2IdleImp
RWM2IsCloseDeviceOKImp
RWM2IsCloseOKImp
RWM2IsPanelAppLaunchedImp
RWM2LaunchPanelAppImp
RWM2OpenDeviceImp
RWM2OpenImp
RWM2QuitPanelAppImp
RWM2SetAudioInfoImp
RWMCloseDeviceImp
RWMCloseImp
RWMDriveAudioImp
RWMGetDeviceCountImp
RWMGetDeviceInfoByHandleImp
RWMGetDeviceInfoImp
RWMIdleImp
RWMIsCloseDeviceOKImp
RWMIsCloseOKImp
RWMOpenDeviceImp
RWMOpenImp
RWPCloseImp
RWPComBytesAvailableImp
RWPComCheckConnectionImp
RWPComConnectImp
RWPComDisconnectImp
RWPComDoesMessageFitImp
RWPComReadImp
RWPComSendImp
RWPIsCloseOKImp
RWPLoadDeviceImp
RWPOpenImp
RWPRegisterDeviceImp
RWPRegisterReWireDeviceImp
RWPUnloadDeviceImp
RWPUnregisterDeviceImp
RWPUnregisterReWireDeviceImp
TopHatCloseDeviceImp
TopHatCloseImp
TopHatDriveAudioImp
TopHatGetDeviceCountImp
TopHatGetDeviceInfoImp
TopHatIdleImp
TopHatIsCloseDeviceOKImp
TopHatIsCloseOKImp
TopHatOpenDeviceImp
TopHatOpenImp

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sqlpdw.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/trdtv2r41.xsl
.xml
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/dbghelp.dll
.dll windows x86

fa6b094f828920cf8999743ff0004319

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa
Signer

Actual PE Digest

8f:30:24:0d:35:ff:73:8c:8f:ce:2e:fe:f2:26:b5:b2:12:d2:d0:aa

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2015, 13:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_isatty
_write
_lseeki64
??3@YAXPAX@Z
_fileno
_read
__pioinfo
__badioinfo
ferror
wctomb
_snprintf
isleadbyte
mbtowc
_onexit
_lock
__dllonexit
_unlock
_ismbblead
_amsg_exit
_initterm
_XcptFilter
memmove
_iob
__mb_cur_max
strchr
_vsnwprintf
_errno
__CxxFrameHandler
iswspace
calloc
_itoa
_wcsdup
towlower
tolower
_wcslwr
time
_wctime
_ltoa
_strnicmp
_wcsnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
free
wcsrchr
strstr
memcpy
_wcsicmp
qsort
wcschr
wcsstr
wcsncmp
iswxdigit
memset
??2@YAPAXI@Z
iswprint
fflush
fprintf
atol
fclose
__unDName
iswdigit
_CxxThrowException
bsearch
_wfsopen
fread
fseek
wcstol
_wfullpath
_wgetenv
_get_osfhandle
_chsize
_close
_open_osfhandle
ftell
_memicmp
_mbscmp
??1type_info@@UAE@XZ
_wsopen

kernel32

HeapFree
MapViewOfFileEx
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeviceIoControl
SetFileAttributesW
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
GetThreadSelectorEntry
CreateThread
TerminateThread
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
SuspendThread
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetVersion
GetSystemInfo
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
ReadProcessMemory
GetProcessHeap
GetFileAttributesA
SetErrorMode
WriteFile
OutputDebugStringA
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
CreateFileMappingA
MapViewOfFile
DuplicateHandle
VirtualAlloc
VirtualProtect
CreateDirectoryA
UnmapViewOfFile
GetCurrentProcess
SetFilePointer
IsDBCSLeadByte
HeapAlloc
HeapReAlloc
GetVersionExA
InitializeCriticalSection
FindClose
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetLastError
TlsSetValue
TlsGetValue
FreeLibrary
LoadLibraryA
TlsAlloc
TlsFree
DeleteCriticalSection
HeapDestroy
HeapCreate
FlushViewOfFile

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymCleanup
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
itoldyouso
lmi
lminfo
omap
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/msmdlocal.dll
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.1MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

AssertDa
Size: 512B - Virtual size: 230B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer/Other/en-US/ActiveXInstallService.adml
.xml
Installer/Other/en-US/AddRemovePrograms.adml
.xml
Installer/Other/en-US/AppCompat.adml
.xml
Installer/Other/en-US/AppXRuntime.adml
.xml
Installer/Other/en-US/AppxPackageManager.adml
.xml
Installer/Other/en-US/AttachmentManager.adml
.xml
Installer/Other/en-US/AuditSettings.adml
.xml
Installer/Other/en-US/AutoPlay.adml
.xml
Installer/Other/en-US/Biometrics.adml
.xml
Installer/Other/en-US/Bits.adml
.xml
Installer/Other/en-US/CEIPEnable.adml
.xml
Installer/Other/en-US/COM.adml
.xml
Installer/Other/en-US/CipherSuiteOrder.adml
.xml
Installer/Other/en-US/Conf.adml
.xml
Installer/Other/en-US/ControlPanel.adml
.xml
Installer/Other/en-US/ControlPanelDisplay.adml
.xml
Installer/Other/en-US/Cpls.adml
.xml
Installer/Other/en-US/CredSsp.adml
.xml
Installer/Other/en-US/CredUI.adml
.xml
Installer/Other/en-US/CredentialProviders.adml
.xml
Installer/Other/en-US/CtrlAltDel.adml
.xml
Installer/Other/en-US/DCOM.adml
.xml
Installer/Other/en-US/DFS.adml
.xml
Installer/Other/en-US/DWM.adml
.xml
Installer/Other/en-US/Desktop.adml
.xml
Installer/Other/en-US/DeviceCompat.adml
.xml
Installer/Other/en-US/DeviceInstallation.adml
.xml
Installer/Other/en-US/DeviceSetup.adml
.xml
Installer/Other/en-US/DigitalLocker.adml
.xml
Installer/Other/en-US/DiskDiagnostic.adml
.xml
Installer/Other/en-US/DiskNVCache.adml
.xml
Installer/Other/en-US/DiskQuota.adml
.xml
Installer/Other/en-US/DistributedLinkTracking.adml
.xml
Installer/Other/en-US/DnsClient.adml
.xml
Installer/Other/en-US/EAIME.adml
.xml
Installer/Other/en-US/EarlyLaunchAM.adml
Installer/Other/en-US/EdgeUI.adml
.xml
Installer/Other/en-US/EncryptFilesonMove.adml
.xml
Installer/Other/en-US/ErrorReporting.adml
.xml
Installer/Other/en-US/EventForwarding.adml
.xml
Installer/Other/en-US/EventLog.adml
.xml
Installer/Other/en-US/EventViewer.adml
.xml
Installer/Other/en-US/Explorer.adml
.xml
Installer/Other/en-US/ExternalBoot.adml
.xml
Installer/Other/en-US/FileHistory.adml
.xml
Installer/Other/en-US/FileRecovery.adml
.xml
Installer/Other/en-US/FileRevocation.adml
.xml
Installer/Other/en-US/FileServerVSSProvider.adml
.xml
Installer/Other/en-US/FileSys.adml
.xml
Installer/Other/en-US/FolderRedirection.adml
.xml
Installer/Other/en-US/FramePanes.adml
.xml
Installer/Other/en-US/GameExplorer.adml
.xml
Installer/Other/en-US/Globalization.adml
.xml
Installer/Other/en-US/GroupPolicy-Server.adml
.xml
Installer/Other/en-US/GroupPolicy.adml
.xml
Installer/Other/en-US/GroupPolicyPreferences.adml
.xml
Installer/Other/en-US/Help.adml
.xml
Installer/Other/en-US/HelpAndSupport.adml
.xml
Installer/Other/en-US/ICM.adml
.xml
Installer/Other/en-US/IIS.adml
.xml
Installer/Other/en-US/InetRes.adml
.xml
Installer/Other/en-US/InkWatson.adml
.xml
Installer/Other/en-US/KDC.adml
.xml
Installer/Other/en-US/Kerberos.adml
.xml
Installer/Other/en-US/LanmanServer.adml
.xml
Installer/Other/en-US/LeakDiagnostic.adml
.xml
Installer/Other/en-US/LinkLayerTopologyDiscovery.adml
.xml
Installer/Other/en-US/LocationProviderAdm.adml
.xml
Installer/Other/en-US/Logon.adml
.xml
Installer/Other/en-US/MMC.adml
.xml
Installer/Other/en-US/MMCSnapIns2.adml
.xml
Installer/Other/en-US/MMCSnapins.adml
.xml
Installer/Other/en-US/MSDT.adml
.xml
Installer/Other/en-US/MSI.adml
.xml
Installer/Other/en-US/MediaCenter.adml
.xml
Installer/Other/en-US/MobilePCMobilityCenter.adml
.xml
Installer/Other/en-US/MobilePCPresentationSettings.adml
.xml
Installer/Other/en-US/Msi-FileRecovery.adml
.xml
Installer/Other/en-US/NAPXPQec.adml
.xml
Installer/Other/en-US/NCSI.adml
.xml
Installer/Other/en-US/Netlogon.adml
.xml
Installer/Other/en-US/NetworkConnections.adml
.xml
Installer/Other/en-US/NetworkIsolation.adml
Installer/Other/en-US/NetworkProjection.adml
.xml
Installer/Other/en-US/OfflineFiles.adml
.xml
Installer/Other/en-US/P2P-pnrp.adml
.xml
Installer/Other/en-US/ParentalControls.adml
.xml
Installer/Other/en-US/PeerToPeerCaching.adml
.xml
Installer/Other/en-US/PenTraining.adml
.xml
Installer/Other/en-US/PerformanceDiagnostics.adml
.xml
Installer/Other/en-US/PerformancePerftrack.adml
.xml
Installer/Other/en-US/Power.adml
.xml
Installer/Other/en-US/PowerShellExecutionPolicy.adml
.xml
Installer/Other/en-US/PreviousVersions.adml
.xml
Installer/Other/en-US/Printing.adml
.xml
Installer/Other/en-US/Printing2.adml
.xml
Installer/Other/en-US/Programs.adml
.xml
Installer/Other/en-US/PswdSync.adml
.xml
Installer/Other/en-US/QOS.adml
.xml
Installer/Other/en-US/RPC.adml
.xml
Installer/Other/en-US/RacWmiProv.adml
.xml
Installer/Other/en-US/Radar.adml
.xml
Installer/Other/en-US/ReAgent.adml
.xml
Installer/Other/en-US/Reliability.adml
.xml
Installer/Other/en-US/RemoteAssistance.adml
.xml
Installer/Other/en-US/RemovableStorage.adml
.xml
Installer/Other/en-US/Scripts.adml
.xml
Installer/Other/en-US/Securitycenter.adml
.xml
Installer/Other/en-US/Sensors.adml
.xml
Installer/Other/en-US/ServerManager.adml
.xml
Installer/Other/en-US/Servicing.adml
.xml
Installer/Other/en-US/SettingSync.adml
.xml
Installer/Other/en-US/Setup.adml
.xml
Installer/Other/en-US/SharedFolders.adml
.xml
Installer/Other/en-US/Sharing.adml
.xml
Installer/Other/en-US/Shell-CommandPrompt-RegEditTools.adml
.xml
Installer/Other/en-US/ShellWelcomeCenter.adml
.xml
Installer/Other/en-US/Sidebar.adml
.xml
Installer/Other/en-US/SkyDrive.adml
.xml
Installer/Other/en-US/Smartcard.adml
.xml
Installer/Other/en-US/Snis.adml
.xml
Installer/Other/en-US/Snmp.adml
.xml
Installer/Other/en-US/SoundRec.adml
.xml
Installer/Other/en-US/StartMenu.adml
.xml
Installer/Other/en-US/SystemRestore.adml
.xml
Installer/Other/en-US/TPM.adml
.xml
Installer/Other/en-US/TabletPCInputPanel.adml
.xml
Installer/Other/en-US/TabletShell.adml
.xml
Installer/Other/en-US/TaskScheduler.adml
.xml
Installer/Other/en-US/Taskbar.adml
.xml
Installer/Other/en-US/TerminalServer-Server.adml
.xml
Installer/Other/en-US/TerminalServer.adml
.xml
Installer/Other/en-US/Thumbnails.adml
.xml
Installer/Other/en-US/TouchInput.adml
.xml
Installer/Other/en-US/UserProfiles.adml
.xml
Installer/Other/en-US/VolumeEncryption.adml
.xml
Installer/Other/en-US/W32Time.adml
.xml
Installer/Other/en-US/WCM.adml
.xml
Installer/Other/en-US/WDI.adml
.xml
Installer/Other/en-US/WPN.adml
.xml
Installer/Other/en-US/WinCal.adml
.xml
Installer/Other/en-US/WinInit.adml
.xml
Installer/Other/en-US/WinLogon.adml
.xml
Installer/Other/en-US/Windows.adml
.xml
Installer/Other/en-US/WindowsAnytimeUpgrade.adml
.xml
Installer/Other/en-US/WindowsBackup.adml
.xml
Installer/Other/en-US/WindowsColorSystem.adml
.xml
Installer/Other/en-US/WindowsConnectNow.adml
.xml
Installer/Other/en-US/WindowsDefender.adml
Installer/Other/en-US/WindowsExplorer.adml
.xml
Installer/Other/en-US/WindowsFileProtection.adml
.xml
Installer/Other/en-US/WindowsFirewall.adml
.xml
Installer/Other/en-US/WindowsMail.adml
.xml
Installer/Other/en-US/WindowsMediaDRM.adml
.xml
Installer/Other/en-US/WindowsMediaPlayer.adml
.xml
Installer/Other/en-US/WindowsMessenger.adml
.xml
Installer/Other/en-US/WindowsProducts.adml
.xml
Installer/Other/en-US/WindowsRemoteManagement.adml
.xml
Installer/Other/en-US/WindowsRemoteShell.adml
.xml
Installer/Other/en-US/WindowsServer.adml
.xml
Installer/Other/en-US/WindowsUpdate.adml
.xml
Installer/Other/en-US/Winsrv.adml
.xml
Installer/Other/en-US/WordWheel.adml
.xml
Installer/Other/en-US/WorkFolders-Client.adml
.xml
Installer/Other/en-US/WorkplaceJoin.adml
.xml
Installer/Other/en-US/fthsvc.adml
.xml
Installer/Other/en-US/hotspotauth.adml
.xml
Installer/Other/en-US/iSCSI.adml
.xml
Installer/Other/en-US/msched.adml
.xml
Installer/Other/en-US/nca.adml
Installer/Other/en-US/pca.adml
.xml
Installer/Other/en-US/sdiageng.adml
.xml
Installer/Other/en-US/srm-fci.adml
.xml
Installer/Other/en-US/tcpip.adml
.xml
Installer/Other/en-US/wlansvc.adml
.xml
Installer/Other/en-US/wwansvc.adml
.xml
Installer/Other/fthsvc.admx
Installer/Other/hotspotauth.admx
Installer/Other/iSCSI.admx
Installer/Other/inetres.admx
.xml
Installer/Other/kdc.admx
Installer/Other/msched.admx
.xml
Installer/Other/nca.admx
Installer/Other/pca.admx

Sharing

General

Malware Config

Signatures

Files

Password: 1515

0b195d0b0828f122e1c234d175811fd7

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 528B

.rdata Size: 10KB - Virtual size: 10KB

.pdata Size: 1024B - Virtual size: 768B

.xdata Size: 1024B - Virtual size: 712B

.bss Size: - Virtual size: 2KB

.edata Size: 512B - Virtual size: 218B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 788B

/4 Size: 512B - Virtual size: 20B

Password: 1515

1ede8ff23b8ed751df2548ed9dd2bc40

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 58KB - Virtual size: 57KB

.data Size: 512B - Virtual size: 96B

.rdata Size: 10KB - Virtual size: 10KB

.pdata Size: 2KB - Virtual size: 2KB

.xdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 2KB

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.reloc Size: 512B - Virtual size: 104B

/4 Size: 5KB - Virtual size: 5KB

/19 Size: 127KB - Virtual size: 126KB

/31 Size: 22KB - Virtual size: 21KB

/45 Size: 25KB - Virtual size: 24KB

/57 Size: 10KB - Virtual size: 9KB

/70 Size: 512B - Virtual size: 261B

/81 Size: 137KB - Virtual size: 137KB

/92 Size: 11KB - Virtual size: 10KB

Password: 1515

499904276cb63533308f9af02f163226

Headers

File Characteristics

Imports

advapi32

libintl-8

kernel32

msvcrt

ole32

shell32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 671KB

.data Size: 3KB - Virtual size: 3KB

.rdata Size: 421KB - Virtual size: 420KB

.pdata Size: 27KB - Virtual size: 26KB

.xdata Size: 25KB - Virtual size: 24KB

.bss Size: - Virtual size: 7KB

.edata Size: 48KB - Virtual size: 48KB

.text
Size: 14KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 528B

.rdata
Size: 10KB - Virtual size: 10KB

.pdata
Size: 1024B - Virtual size: 768B

.xdata
Size: 1024B - Virtual size: 712B

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 218B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 788B

/4
Size: 512B - Virtual size: 20B

.text
Size: 58KB - Virtual size: 57KB

.data
Size: 512B - Virtual size: 96B

.rdata
Size: 10KB - Virtual size: 10KB

.pdata
Size: 2KB - Virtual size: 2KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 104B

/4
Size: 5KB - Virtual size: 5KB

/19
Size: 127KB - Virtual size: 126KB

/31
Size: 22KB - Virtual size: 21KB

/45
Size: 25KB - Virtual size: 24KB

/57
Size: 10KB - Virtual size: 9KB

/70
Size: 512B - Virtual size: 261B

/81
Size: 137KB - Virtual size: 137KB

/92
Size: 11KB - Virtual size: 10KB

.text
Size: 672KB - Virtual size: 671KB

.data
Size: 3KB - Virtual size: 3KB

.rdata
Size: 421KB - Virtual size: 420KB

.pdata
Size: 27KB - Virtual size: 26KB

.xdata
Size: 25KB - Virtual size: 24KB

.bss
Size: - Virtual size: 7KB

.edata
Size: 48KB - Virtual size: 48KB

.idata
Size: 8KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 1KB - Virtual size: 1KB

/4
Size: 512B - Virtual size: 28B

.text
Size: 63KB - Virtual size: 62KB

.data
Size: 1024B - Virtual size: 944B

.rdata
Size: 20KB - Virtual size: 20KB

.pdata
Size: 2KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 4KB

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

/4
Size: 512B - Virtual size: 24B

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 80B

.rdata
Size: 3KB - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 648B

.xdata
Size: 1024B - Virtual size: 556B

.bss
Size: - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 361B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 104B

/4
Size: 1024B - Virtual size: 800B

/19
Size: 19KB - Virtual size: 18KB

/31
Size: 4KB - Virtual size: 3KB

/45
Size: 3KB - Virtual size: 2KB

/57
Size: 1KB - Virtual size: 1KB

/70
Size: 512B - Virtual size: 77B

/81
Size: 9KB - Virtual size: 8KB

/92
Size: 1024B - Virtual size: 640B