General

Malware Config

Signatures

Files

• c6c29a2abe88adbae624d78ef80106f9.bin

  .zip

  Password: infected

• AudioCapture.dll

  .dll windows x86

  Password: infected

  ba7e9a7cd5ee54c14d0881068fc905c5

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  d1:2d:41:17:6e:d5:b4:71:21:d4:06:ff:29:9c:d4:70:d0:30:40:5b:4b:5d:0a:87:88:dc:ae:2c:e2:43:bc:84

  Signer

  Actual PE Digest

  d1:2d:41:17:6e:d5:b4:71:21:d4:06:ff:29:9c:d4:70:d0:30:40:5b:4b:5d:0a:87:88:dc:ae:2c:e2:43:bc:84

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  1f:0d:05:c0:04:4b:27:1a:77:4b:30:77:a7:db:c5:9d:0b:77:8b:4a

  Signer

  Actual PE Digest

  1f:0d:05:c0:04:4b:27:1a:77:4b:30:77:a7:db:c5:9d:0b:77:8b:4a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WaitForSingleObject

  GetCurrentThread

  TerminateThread

  Sleep

  SetThreadPriority

  CloseHandle

  LocalFree

  CreateThread

  GetTickCount

  GetLastError

  LCMapStringW

  LCMapStringA

  GetStringTypeW

  MultiByteToWideChar

  GetStringTypeA

  GetLocaleInfoA

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetCurrentThreadId

  GetCommandLineA

  RaiseException

  RtlUnwind

  HeapFree

  HeapAlloc

  GetModuleHandleW

  GetProcAddress

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  InterlockedDecrement

  HeapSize

  ExitProcess

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  VirtualFree

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  HeapReAlloc

  WriteFile

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  user32

  DefWindowProcW

  UnregisterDeviceNotification

  CreateWindowExW

  RegisterDeviceNotificationW

  DestroyWindow

  PostMessageW

  RegisterClassExW

  ole32

  CoTaskMemFree

  CoInitializeEx

  CoCreateInstance

  CoUninitialize

  Exports

  Exports

  AddAudioCaptureEventListener

  DeviceChange

  Initialise

  IsCapturing

  RegisterWindow

  RemoveAudioCaptureEventListener

  StartCapturing

  StopCapturing

  UnInitialise

  Sections

  .text

  Size: 53KB - Virtual size: 53KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• HTCTL32.DLL

  .dll windows x86

  Password: infected

  6ba08298dd09ea8e41ab7285d3183bba

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5

  Signer

  Actual PE Digest

  49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26

  Signer

  Actual PE Digest

  55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  getpeername

  ntohs

  socket

  setsockopt

  bind

  htons

  WSASetBlockingHook

  WSAUnhookBlockingHook

  send

  gethostname

  getsockname

  connect

  __WSAFDIsSet

  WSASetLastError

  ioctlsocket

  gethostbyname

  shutdown

  recv

  closesocket

  WSACancelBlockingCall

  inet_ntoa

  select

  WSAGetLastError

  WSAStartup

  WSACleanup

  inet_addr

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  kernel32

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetStringTypeW

  GetLocaleInfoW

  LoadLibraryW

  SetConsoleCtrlHandler

  FatalAppExitA

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapSize

  ReadFile

  GetStartupInfoW

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetCurrentProcess

  TerminateProcess

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDBCSLeadByte

  CompareStringA

  GetModuleFileNameA

  GetProcAddress

  GetModuleHandleA

  OutputDebugStringA

  LoadLibraryA

  FreeLibrary

  InitializeCriticalSection

  DeleteCriticalSection

  Sleep

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  WritePrivateProfileStringA

  CloseHandle

  FlushFileBuffers

  SetFilePointer

  GetFileSize

  GetPrivateProfileIntA

  CreateFileA

  SetStdHandle

  WriteFile

  GetLocalTime

  GetDateFormatA

  CopyFileA

  InterlockedExchange

  SetEvent

  GetVersionExA

  InterlockedDecrement

  GetTickCount

  SystemTimeToFileTime

  GetSystemTime

  OpenProcess

  GetCurrentProcessId

  GetCurrentThreadId

  InterlockedIncrement

  GetTempPathA

  ReleaseMutex

  WaitForSingleObject

  TerminateThread

  lstrlenA

  CreateMutexA

  SetThreadPriority

  CreateThread

  CreateEventA

  ExitProcess

  MultiByteToWideChar

  WideCharToMultiByte

  CreateFileW

  GetVersion

  GlobalFree

  LCMapStringW

  GetCurrentThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  IsProcessorFeaturePresent

  HeapDestroy

  HeapCreate

  GetModuleFileNameW

  GetConsoleCP

  GetConsoleMode

  WriteConsoleW

  SetEndOfFile

  GetProcessHeap

  GetLastError

  PulseEvent

  HeapAlloc

  HeapFree

  RtlUnwind

  RaiseException

  HeapReAlloc

  EncodePointer

  DecodePointer

  GetCommandLineA

  GetModuleHandleW

  GetStdHandle

  user32

  PostThreadMessageA

  PostMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  KillTimer

  PeekMessageA

  PostQuitMessage

  GetDesktopWindow

  MessageBoxA

  wvsprintfA

  wsprintfA

  advapi32

  GetTokenInformation

  LogonUserA

  ImpersonateLoggedOnUser

  RevertToSelf

  GetUserNameA

  OpenProcessToken

  Exports

  Exports

  ctl_adddomain

  ctl_addoperator

  ctl_bridgename

  ctl_broadcast

  ctl_broadcastdata

  ctl_call

  ctl_callremote

  ctl_clearpin

  ctl_clientpinrequest

  ctl_clientstatus

  ctl_close

  ctl_closeremote

  ctl_connected

  ctl_controlpinrequest

  ctl_controlsendpin

  ctl_escape

  ctl_findslaves

  ctl_findslaves2

  ctl_findslavesex

  ctl_getconnectivityinfo

  ctl_getfailedreason

  ctl_getfileinfo

  ctl_getlocalipaddressinuse

  ctl_getsession

  ctl_hangup

  ctl_helpreq

  ctl_installed

  ctl_licenseinfo

  ctl_maxpacket

  ctl_messageacknowledged

  ctl_messagereceived

  ctl_myaddr

  ctl_netname

  ctl_networks

  ctl_nsessions

  ctl_open

  ctl_openremote

  ctl_pause

  ctl_pingnet

  ctl_pittmanfunc

  ctl_publishservice

  ctl_publishserviceex

  ctl_putfile

  ctl_putfilelink

  ctl_remotename

  ctl_removedomain

  ctl_removeoperator

  ctl_send

  ctl_sendif

  ctl_sendto

  ctl_subset

  ctl_userstatus

  ctl_version

  Sections

  .text

  Size: 249KB - Virtual size: 249KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 10KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• NSM.LIC
• PCICHEK.DLL

  .dll windows x86

  Password: infected

  1233e02b30a7c416ba5aa017ff2ba312

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  70:19:fe:86:36:c1:40:67:6b:d7:25:97:c0:51:e5:67:eb:67:bc:13:2b:d0:4d:e9:c0:a6:86:94:94:24:fd:ab

  Signer

  Actual PE Digest

  70:19:fe:86:36:c1:40:67:6b:d7:25:97:c0:51:e5:67:eb:67:bc:13:2b:d0:4d:e9:c0:a6:86:94:94:24:fd:ab

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  31:07:46:8f:ed:21:e6:3d:07:54:56:b3:a3:48:b0:a4:21:17:45:d8

  Signer

  Actual PE Digest

  31:07:46:8f:ed:21:e6:3d:07:54:56:b3:a3:48:b0:a4:21:17:45:d8

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVersionExA

  DisableThreadLibraryCalls

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  ExitProcess

  user32

  LoadStringA

  MessageBoxA

  wsprintfA

  msvcr100

  _except_handler4_common

  _crt_debugger_hook

  memset

  Exports

  Exports

  CheckLicenseString

  IsILS

  IsJPIK

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 946B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 490B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PCICL32.DLL

  .dll windows x86

  Password: infected

  3e09384870fa6c1a29cc37553985fcc6

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  39:f1:c3:8f:1a:d9:c2:ff:24:db:8c:82:7e:b1:d7:d8:ae:74:a1:1b:4d:42:a8:c3:5c:7f:74:30:be:67:e4:4d

  Signer

  Actual PE Digest

  39:f1:c3:8f:1a:d9:c2:ff:24:db:8c:82:7e:b1:d7:d8:ae:74:a1:1b:4d:42:a8:c3:5c:7f:74:30:be:67:e4:4d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  5b:48:76:9b:35:e3:29:03:10:0e:18:24:5a:d4:72:ec:84:25:12:32

  Signer

  Actual PE Digest

  5b:48:76:9b:35:e3:29:03:10:0e:18:24:5a:d4:72:ec:84:25:12:32

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  secur32

  GetUserNameExA

  shfolder

  SHGetFolderPathA

  pcichek

  IsILS

  IsJPIK

  CheckLicenseString

  pcicapi

  CapiClose

  CapiOpen

  CapiListen

  CapiHangup

  mpr

  WNetAddConnection2A

  WNetCancelConnection2A

  WNetGetConnectionA

  comctl32

  ImageList_Draw

  ImageList_LoadImageA

  ImageList_Destroy

  ImageList_ReplaceIcon

  ImageList_AddMasked

  ImageList_GetImageCount

  ord17

  ImageList_DrawEx

  ImageList_GetIconSize

  ImageList_GetIcon

  ImageList_Create

  version

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  winmm

  waveOutClose

  waveOutReset

  waveInClose

  waveInUnprepareHeader

  waveInReset

  waveInStop

  waveOutUnprepareHeader

  waveInPrepareHeader

  waveOutSetVolume

  waveOutOpen

  waveInStart

  waveInOpen

  waveOutWrite

  waveOutPrepareHeader

  timeGetTime

  timeEndPeriod

  timeBeginPeriod

  PlaySoundA

  waveInAddBuffer

  wsock32

  inet_addr

  send

  setsockopt

  bind

  listen

  accept

  htons

  socket

  connect

  getpeername

  gethostbyname

  recv

  shutdown

  closesocket

  WSACleanup

  WSAStartup

  WSAGetLastError

  gethostname

  htonl

  ioctlsocket

  kernel32

  HeapFree

  HeapAlloc

  GetProcessHeap

  IsBadReadPtr

  SizeofResource

  CreateDirectoryA

  RemoveDirectoryA

  MoveFileA

  MulDiv

  GetDiskFreeSpaceA

  GetCurrentDirectoryA

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  GetVolumeInformationA

  FileTimeToDosDateTime

  FileTimeToLocalFileTime

  OpenEventA

  FindResourceA

  OutputDebugStringA

  SetCurrentDirectoryA

  LocalAlloc

  GetTimeFormatW

  GetDateFormatW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  WideCharToMultiByte

  lstrlenW

  lstrlenA

  lstrcmpiA

  FlushInstructionCache

  lstrcmpA

  FindResourceExA

  TerminateThread

  ReleaseMutex

  WaitForSingleObjectEx

  GlobalReAlloc

  CreateNamedPipeA

  ConnectNamedPipe

  SetProcessShutdownParameters

  SetConsoleCtrlHandler

  IsDBCSLeadByteEx

  DisconnectNamedPipe

  WriteProfileStringA

  DefineDosDeviceA

  QueryDosDeviceA

  TryEnterCriticalSection

  ResumeThread

  VirtualQueryEx

  GetThreadContext

  ReadProcessMemory

  PulseEvent

  CreateRemoteThread

  SetThreadContext

  PostQueuedCompletionStatus

  CreateIoCompletionPort

  GetQueuedCompletionStatus

  Beep

  GetSystemDefaultLangID

  GetSystemInfo

  SuspendThread

  OpenThread

  GetProcessVersion

  GlobalGetAtomNameA

  RtlUnwind

  DecodePointer

  EncodePointer

  InterlockedCompareExchange

  LoadResource

  LockResource

  VirtualProtectEx

  WriteProcessMemory

  GetExitCodeThread

  CompareStringA

  SetFilePointer

  GetProfileStringA

  GetOEMCP

  GetShortPathNameA

  TerminateProcess

  SystemTimeToFileTime

  CreateFileMappingA

  OpenFileMappingA

  MapViewOfFile

  UnmapViewOfFile

  CreatePipe

  DuplicateHandle

  SetHandleInformation

  FormatMessageA

  LocalFree

  SetNamedPipeHandleState

  GetPriorityClass

  WinExec

  SearchPathA

  IsValidCodePage

  SetSystemTime

  _lopen

  _lclose

  DeleteFileA

  SetFileAttributesA

  GetSystemDirectoryA

  GetDateFormatA

  GetTimeFormatA

  GlobalSize

  SetUnhandledExceptionFilter

  OpenMutexA

  CreateMutexA

  SetErrorMode

  GetACP

  SetPriorityClass

  GetFileAttributesA

  GetTempFileNameA

  CopyFileA

  FileTimeToSystemTime

  GetComputerNameA

  ExitProcess

  GetModuleHandleA

  GetExitCodeProcess

  GetCurrentProcess

  LoadLibraryExA

  ExitThread

  GetDriveTypeA

  GetWindowsDirectoryA

  IsDBCSLeadByte

  GetLocalTime

  GetFileSize

  GlobalAlloc

  GlobalLock

  ReadFile

  GlobalUnlock

  GlobalFree

  GetSystemPowerStatus

  ExpandEnvironmentStringsA

  FindFirstFileA

  FindNextFileA

  FindClose

  GetUserDefaultUILanguage

  GetUserDefaultLangID

  GetModuleFileNameA

  GetCurrentProcessId

  CreateProcessA

  DeleteCriticalSection

  InitializeCriticalSection

  GetVersion

  CreateThread

  SetThreadPriority

  InterlockedIncrement

  WaitForMultipleObjects

  GetOverlappedResult

  ResetEvent

  InterlockedDecrement

  LeaveCriticalSection

  EnterCriticalSection

  GetLastError

  DeviceIoControl

  InterlockedExchange

  SetLastError

  GetProcAddress

  FreeLibrary

  LoadLibraryA

  CreateFileA

  GetTempPathA

  WriteFile

  GetCurrentThreadId

  CreateEventA

  WaitForSingleObject

  SetEvent

  GlobalDeleteAtom

  Sleep

  GlobalAddAtomA

  OpenProcess

  GetVersionExA

  GetTickCount

  CloseHandle

  HeapReAlloc

  GetSystemTimeAsFileTime

  VirtualProtect

  VirtualAlloc

  GetModuleHandleW

  VirtualQuery

  GetConsoleMode

  GetCommandLineA

  LCMapStringW

  GetCPInfo

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  UnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapCreate

  HeapDestroy

  GetStdHandle

  GetModuleFileNameW

  HeapSize

  GetLocaleInfoW

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetConsoleCP

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  GetStringTypeW

  GetTimeZoneInformation

  CreateFileW

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  FlushFileBuffers

  LoadLibraryW

  WriteConsoleW

  CompareStringW

  SetEnvironmentVariableA

  SetEndOfFile

  InterlockedPushEntrySList

  VirtualFree

  InterlockedPopEntrySList

  MultiByteToWideChar

  user32

  CreateCursor

  HideCaret

  OemToCharBuffA

  ScrollWindow

  SetScrollPos

  SetScrollRange

  ClipCursor

  DrawIconEx

  RemoveMenu

  SetActiveWindow

  AdjustWindowRectEx

  TrackPopupMenuEx

  SetMenuDefaultItem

  InsertMenuItemA

  EndMenu

  LoadStringW

  SetMenuInfo

  GetMenuInfo

  GetScrollInfo

  SetScrollInfo

  TileWindows

  GetScrollRange

  GetWindowRgn

  GetAsyncKeyState

  EnumThreadWindows

  EnumDisplaySettingsA

  CreateDesktopA

  PostMessageW

  OpenInputDesktop

  GetMenuItemRect

  mouse_event

  MapVirtualKeyA

  CharLowerBuffA

  ShowCursor

  SwitchDesktop

  AttachThreadInput

  GetCursor

  CreateDialogIndirectParamA

  DialogBoxIndirectParamA

  DialogBoxParamA

  SetClassLongA

  MapDialogRect

  CreateAcceleratorTableA

  DestroyAcceleratorTable

  RedrawWindow

  InvalidateRgn

  CharNextA

  LoadAcceleratorsA

  ScreenToClient

  ModifyMenuA

  CreateMenu

  MoveWindow

  SetCursorPos

  DrawTextW

  IsDialogMessageA

  UnionRect

  DrawFocusRect

  wsprintfW

  EndDialog

  OpenWindowStationA

  GetProcessWindowStation

  SetProcessWindowStation

  CloseWindowStation

  MsgWaitForMultipleObjects

  GetUserObjectSecurity

  SetUserObjectSecurity

  MessageBoxIndirectA

  WinHelpA

  UnhookWindowsHookEx

  SetWindowsHookExA

  CreateDialogParamA

  GetLastActivePopup

  CallNextHookEx

  GetUpdateRect

  BeginDeferWindowPos

  EndDeferWindowPos

  GetTopWindow

  DestroyCursor

  GetActiveWindow

  IsZoomed

  CreatePopupMenu

  AppendMenuA

  CopyRect

  EqualRect

  LoadStringA

  ClientToScreen

  DeferWindowPos

  IsChild

  GetWindowPlacement

  TranslateAcceleratorA

  SetRectEmpty

  SetMenu

  SetWindowPlacement

  GetForegroundWindow

  CharUpperBuffA

  WindowFromPoint

  WaitForInputIdle

  GetUserObjectInformationA

  GetCursorPos

  CheckDlgButton

  SetForegroundWindow

  EnumChildWindows

  RegisterClipboardFormatA

  CountClipboardFormats

  EnumClipboardFormats

  GetClipboardData

  IsClipboardFormatAvailable

  GetClipboardFormatNameA

  RegisterWindowMessageA

  DestroyIcon

  CharUpperA

  ExitWindowsEx

  GetDesktopWindow

  MessageBoxA

  keybd_event

  GetThreadDesktop

  SetThreadDesktop

  wvsprintfA

  CreateCaret

  ShowCaret

  UnregisterClassA

  SetTimer

  KillTimer

  SetDlgItemTextA

  SendMessageA

  SendDlgItemMessageA

  PostMessageA

  ShowWindow

  DefWindowProcA

  CallWindowProcA

  PostThreadMessageA

  GetQueueStatus

  GetDlgItem

  GetDlgCtrlID

  GetDC

  ReleaseDC

  InvalidateRect

  DestroyCaret

  GetKeyState

  PeekMessageA

  SetCaretPos

  DrawMenuBar

  GetSystemMenu

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  MessageBeep

  CloseClipboard

  FindWindowExA

  DeleteMenu

  GetWindowTextLengthA

  GetFocus

  GetClassInfoExA

  DestroyWindow

  DefDlgProcA

  RegisterClassExA

  IsDlgButtonChecked

  GetDlgItemTextA

  IsIconic

  GetMenu

  SystemParametersInfoA

  IntersectRect

  GetCursorInfo

  GetIconInfo

  IsWindowVisible

  GetWindow

  SendMessageTimeoutA

  GetClassLongA

  CopyIcon

  CopyImage

  LoadImageA

  OpenDesktopA

  EnumDesktopWindows

  CloseDesktop

  EnumWindows

  GetClassNameA

  GetClassInfoA

  LoadIconA

  RegisterClassA

  BringWindowToTop

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetPropA

  GetPropA

  RemovePropA

  GetCapture

  SetCapture

  ReleaseCapture

  CreateWindowExA

  BeginPaint

  EndPaint

  wsprintfA

  PostQuitMessage

  GetMenuItemID

  CheckMenuItem

  EnableMenuItem

  GetMenuItemInfoA

  SetMenuItemInfoA

  PtInRect

  GetWindowDC

  LoadMenuA

  GetSubMenu

  GetMenuItemCount

  DestroyMenu

  InflateRect

  GetSystemMetrics

  FindWindowA

  GetWindowThreadProcessId

  IsWindow

  SetFocus

  SetWindowPos

  GetParent

  GetWindowTextA

  SetWindowTextA

  GetWindowLongA

  MapWindowPoints

  GetClientRect

  DrawTextA

  OffsetRect

  IsWindowEnabled

  SetRect

  GetWindowRect

  FillRect

  LoadBitmapA

  GetSysColor

  SetCursor

  LoadCursorA

  UpdateWindow

  EnableWindow

  SetWindowLongA

  gdi32

  EndPage

  StartPage

  ExtEscape

  ExtTextOutA

  AddFontResourceA

  RemoveFontResourceA

  SelectPalette

  RealizePalette

  EqualRgn

  CreatePalette

  CreateBrushIndirect

  GetDCOrgEx

  SetBrushOrgEx

  PatBlt

  CreatePatternBrush

  GetTextMetricsA

  StretchBlt

  GetSystemPaletteEntries

  GetNearestPaletteIndex

  GetBkMode

  CreateFontIndirectW

  SetBitmapBits

  UnrealizeObject

  SetDIBits

  SetTextCharacterExtra

  SetRectRgn

  CreatePenIndirect

  GetClipRgn

  GetWindowOrgEx

  IntersectClipRect

  Arc

  Chord

  Pie

  Polyline

  RoundRect

  SetPolyFillMode

  CreateDIBitmap

  SetTextJustification

  SetBkMode

  SetTextColor

  CreateCompatibleDC

  CreateCompatibleBitmap

  GetDIBits

  CreateDIBSection

  GdiFlush

  GetRegionData

  CombineRgn

  CreateRectRgn

  CreateRectRgnIndirect

  PtInRegion

  SelectObject

  GetObjectA

  BitBlt

  DeleteDC

  RectVisible

  SetWindowOrgEx

  DeleteObject

  GetPaletteEntries

  GetTextColor

  GetBkColor

  GetTextExtentPoint32A

  GetMapMode

  SetMapMode

  GetStretchBltMode

  SetStretchBltMode

  GetBitmapBits

  BeginPath

  TextOutA

  EndPath

  PathToRegion

  GetRgnBox

  OffsetRgn

  FillRgn

  FrameRgn

  CreateBitmap

  CreateDCA

  SelectClipRgn

  LineDDA

  Polygon

  CreateFontIndirectA

  CreateHatchBrush

  GetDeviceCaps

  SetBkColor

  ExtFloodFill

  GetPixel

  SetPixel

  SetPixelV

  Ellipse

  Rectangle

  SetROP2

  MoveToEx

  LineTo

  GetStockObject

  CreatePen

  CreateSolidBrush

  GetTextExtentPointA

  RectInRegion

  winspool.drv

  EnumPrinterDriversA

  DeletePrinter

  AddPrinterA

  EnumPrintersA

  ord201

  ord202

  EnumJobsA

  SetJobA

  AbortPrinter

  StartPagePrinter

  WritePrinter

  StartDocPrinterA

  OpenPrinterA

  ClosePrinter

  EndPagePrinter

  EndDocPrinter

  GetPrinterA

  comdlg32

  PageSetupDlgA

  GetOpenFileNameA

  GetSaveFileNameA

  ChooseFontA

  advapi32

  EnumServicesStatusA

  RegisterServiceCtrlHandlerA

  RegisterEventSourceA

  ReportEventA

  DeregisterEventSource

  RegCreateKeyA

  SetTokenInformation

  SetServiceStatus

  StartServiceCtrlDispatcherA

  LogonUserA

  ControlService

  StartServiceA

  RegQueryInfoKeyW

  CryptGetProvParam

  CryptReleaseContext

  AllocateLocallyUniqueId

  FreeSid

  GetSecurityDescriptorSacl

  SetSecurityDescriptorSacl

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  QueryServiceConfigA

  CreateProcessAsUserA

  GetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  GetAclInformation

  InitializeAcl

  GetAce

  AddAce

  AddAccessAllowedAce

  IsValidSid

  GetLengthSid

  CopySid

  RegQueryInfoKeyA

  RegDeleteKeyA

  RegEnumKeyExA

  RegEnumValueA

  RegCreateKeyExA

  RegSetValueExA

  RegDeleteValueA

  RegFlushKey

  RegOpenKeyExA

  RegCloseKey

  OpenSCManagerA

  OpenServiceA

  QueryServiceStatus

  CloseServiceHandle

  GetUserNameA

  LookupPrivilegeNameA

  RegQueryValueExA

  GetTokenInformation

  LookupAccountSidA

  GetSidIdentifierAuthority

  GetSidSubAuthorityCount

  GetSidSubAuthority

  AllocateAndInitializeSid

  EqualSid

  RevertToSelf

  OpenProcessToken

  ImpersonateLoggedOnUser

  GetUserNameW

  shell32

  ExtractIconExA

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  SHGetMalloc

  SHGetDesktopFolder

  SHGetPathFromIDListA

  FindExecutableA

  ExtractIconA

  Shell_NotifyIconA

  ShellExecuteA

  ole32

  CoUninitialize

  CoInitialize

  CoCreateInstance

  CreateStreamOnHGlobal

  StringFromGUID2

  ReleaseStgMedium

  OleDuplicateData

  CreateDataAdviseHolder

  CoTaskMemFree

  CLSIDFromProgID

  OleInitialize

  OleUninitialize

  CoTaskMemAlloc

  CoTaskMemRealloc

  OleLockRunning

  CoInitializeSecurity

  CoInitializeEx

  OleCreateStaticFromData

  CreateILockBytesOnHGlobal

  StgCreateDocfileOnILockBytes

  OleSetContainedObject

  IIDFromString

  CLSIDFromString

  CoGetClassObject

  oleaut32

  SysStringByteLen

  OleLoadPicture

  SysFreeString

  SysAllocString

  VariantClear

  VariantInit

  VariantChangeType

  SysStringLen

  SysAllocStringLen

  VarUI4FromStr

  OleCreateFontIndirect

  LoadRegTypeLi

  LoadTypeLi

  OleCreatePictureIndirect

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayGetElemsize

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayGetDim

  SafeArrayCreate

  VariantCopy

  oleacc

  AccessibleObjectFromWindow

  netapi32

  NetUserEnum

  NetApiBufferFree

  wininet

  InternetCrackUrlA

  Exports

  Exports

  _GetRawWMIStringW@16

  _GetWMIStringW@16

  _IsAcerA@8

  _NSMClient32@8

  _NSMFindClass@12

  br_close

  br_open

  br_poll

  br_status

  Sections

  .text

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 312KB - Virtual size: 311KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 47KB - Virtual size: 73KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 21B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .hhshare

  Size: 512B - Virtual size: 28B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 141KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• TCCTL32.DLL

  .dll windows x86

  Password: infected

  2c4d798bb87ec57193b7625c4259da43

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  a3:3f:41:12:a2:5c:25:dd:c6:a7:1a:1b:c7:28:0d:33:9b:79:75:b3:2b:2d:fd:bb:9b:37:a4:83:e9:a3:46:17

  Signer

  Actual PE Digest

  a3:3f:41:12:a2:5c:25:dd:c6:a7:1a:1b:c7:28:0d:33:9b:79:75:b3:2b:2d:fd:bb:9b:37:a4:83:e9:a3:46:17

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:10

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  0f:54:fc:aa:4d:b0:4d:d4:93:19:dd:0b:92:d9:85:18:59:22:b6:56

  Signer

  Actual PE Digest

  0f:54:fc:aa:4d:b0:4d:d4:93:19:dd:0b:92:d9:85:18:59:22:b6:56

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:10

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  kernel32

  GetLastError

  WriteFile

  ReadFile

  Sleep

  ClearCommError

  InterlockedIncrement

  EnterCriticalSection

  LeaveCriticalSection

  InterlockedDecrement

  GetModuleFileNameA

  DeleteCriticalSection

  CloseHandle

  TerminateThread

  SetEvent

  CreateEventA

  GetTickCount

  SetThreadPriority

  CreateThread

  SetCommTimeouts

  InitializeCriticalSection

  GetCommState

  IsDBCSLeadByte

  CompareStringA

  GetProcAddress

  LoadLibraryA

  FreeLibrary

  GetModuleHandleA

  OutputDebugStringA

  OpenProcess

  GetCurrentProcessId

  GetVersionExA

  GetLocalTime

  GetOverlappedResult

  GetCurrentThreadId

  ExitProcess

  MultiByteToWideChar

  WideCharToMultiByte

  LocalAlloc

  LocalFree

  PulseEvent

  InterlockedExchange

  GetExitCodeThread

  ResetEvent

  GetVersion

  SetLastError

  EscapeCommFunction

  GetCommModemStatus

  CreateDirectoryA

  GetDateFormatA

  GetTimeFormatA

  GetSystemTimeAsFileTime

  lstrlenW

  lstrlenA

  CreateFileW

  GetProcessHeap

  SetEndOfFile

  WriteConsoleW

  CreateFileA

  FlushFileBuffers

  SetStdHandle

  LoadLibraryW

  GetLocaleInfoA

  IsValidLocale

  EnumSystemLocalesA

  WaitForSingleObject

  GetStringTypeW

  FatalAppExitA

  GetUserDefaultLCID

  GetTempPathA

  SetConsoleCtrlHandler

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetConsoleMode

  GetConsoleCP

  GetLocaleInfoW

  HeapSize

  SetFilePointer

  GetStartupInfoW

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  HeapDestroy

  HeapAlloc

  HeapFree

  RtlUnwind

  HeapReAlloc

  RaiseException

  EncodePointer

  DecodePointer

  GetCommandLineA

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  GetCurrentThread

  LCMapStringW

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetStdHandle

  GetModuleFileNameW

  HeapCreate

  user32

  CharLowerA

  PostThreadMessageA

  PostMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  MessageBoxA

  KillTimer

  PeekMessageA

  PostQuitMessage

  wsprintfA

  wvsprintfA

  advapi32

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  OpenProcessToken

  GetTokenInformation

  GetUserNameA

  oleaut32

  SysAllocStringLen

  SafeArrayCreate

  SafeArrayGetDim

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayGetElemsize

  SafeArrayAccessData

  SafeArrayUnaccessData

  VariantChangeType

  VariantClear

  SysStringByteLen

  CreateErrorInfo

  GetErrorInfo

  SysAllocString

  SetErrorInfo

  SysFreeString

  VariantInit

  Exports

  Exports

  ?RemoteNotify@@YAXP6GHHPAXPATCTL_CALLBACK@@@Z0@Z

  ctl_bridgename

  ctl_broadcastdata

  ctl_call

  ctl_callremote

  ctl_close

  ctl_closeremote

  ctl_connected

  ctl_escape

  ctl_findslaves

  ctl_findslavesex

  ctl_getcodepage

  ctl_getlocalipaddressinuse

  ctl_getsession

  ctl_hangup

  ctl_helpreq

  ctl_installed

  ctl_maxpacket

  ctl_myaddr

  ctl_netname

  ctl_networks

  ctl_nsessions

  ctl_open

  ctl_openremote

  ctl_pause

  ctl_pingnet

  ctl_remotename

  ctl_send

  ctl_sendex

  ctl_sendif

  ctl_sendname

  ctl_sendto

  ctl_subset

  ctl_version

  Sections

  .text

  Size: 305KB - Virtual size: 305KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• client32.exe

  .exe windows x86

  Password: infected

  a9d50692e95b79723f3e76fcf70d023e

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  15-09-2017 00:00

  Not After

  22-09-2020 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  15-09-2017 00:00

  Not After

  22-09-2020 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  f0:4c:42:33:10:18:6b:d4:d1:2b:84:e5:6d:0e:d2:be:97:91:36:83:d5:b5:d0:c8:cf:b8:44:f5:8f:70:cf:be

  Signer

  Actual PE Digest

  f0:4c:42:33:10:18:6b:d4:d1:2b:84:e5:6d:0e:d2:be:97:91:36:83:d5:b5:d0:c8:cf:b8:44:f5:8f:70:cf:be

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  26-02-2018 13:06

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  e3:78:a0:be:d8:3f:4e:f7:b3:ee:17:90:af:23:a7:10:e5:1d:f3:2d

  Signer

  Actual PE Digest

  e3:78:a0:be:d8:3f:4e:f7:b3:ee:17:90:af:23:a7:10:e5:1d:f3:2d

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  26-02-2018 13:06

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  pcicl32

  _NSMClient32@8

  kernel32

  GetCommandLineW

  ExitProcess

  GetModuleHandleW

  GetStartupInfoW

  Sections

  .text

  Size: 512B - Virtual size: 194B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 350B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 91KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 108B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• client32.ini
• f00ea9c93fd6b52f6ce2f0c374b6d63381094b358f1a83e87abfad08d617435d.zip

  .zip

  Password: infected

• AudioCapture.dll

  .dll windows x86

  Password: infected

  ba7e9a7cd5ee54c14d0881068fc905c5

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  d1:2d:41:17:6e:d5:b4:71:21:d4:06:ff:29:9c:d4:70:d0:30:40:5b:4b:5d:0a:87:88:dc:ae:2c:e2:43:bc:84

  Signer

  Actual PE Digest

  d1:2d:41:17:6e:d5:b4:71:21:d4:06:ff:29:9c:d4:70:d0:30:40:5b:4b:5d:0a:87:88:dc:ae:2c:e2:43:bc:84

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  1f:0d:05:c0:04:4b:27:1a:77:4b:30:77:a7:db:c5:9d:0b:77:8b:4a

  Signer

  Actual PE Digest

  1f:0d:05:c0:04:4b:27:1a:77:4b:30:77:a7:db:c5:9d:0b:77:8b:4a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WaitForSingleObject

  GetCurrentThread

  TerminateThread

  Sleep

  SetThreadPriority

  CloseHandle

  LocalFree

  CreateThread

  GetTickCount

  GetLastError

  LCMapStringW

  LCMapStringA

  GetStringTypeW

  MultiByteToWideChar

  GetStringTypeA

  GetLocaleInfoA

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetCurrentThreadId

  GetCommandLineA

  RaiseException

  RtlUnwind

  HeapFree

  HeapAlloc

  GetModuleHandleW

  GetProcAddress

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  InterlockedDecrement

  HeapSize

  ExitProcess

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  VirtualFree

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  HeapReAlloc

  WriteFile

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  user32

  DefWindowProcW

  UnregisterDeviceNotification

  CreateWindowExW

  RegisterDeviceNotificationW

  DestroyWindow

  PostMessageW

  RegisterClassExW

  ole32

  CoTaskMemFree

  CoInitializeEx

  CoCreateInstance

  CoUninitialize

  Exports

  Exports

  AddAudioCaptureEventListener

  DeviceChange

  Initialise

  IsCapturing

  RegisterWindow

  RemoveAudioCaptureEventListener

  StartCapturing

  StopCapturing

  UnInitialise

  Sections

  .text

  Size: 53KB - Virtual size: 53KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• HTCTL32.DLL

  .dll windows x86

  6ba08298dd09ea8e41ab7285d3183bba

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5

  Signer

  Actual PE Digest

  49:9a:ad:c7:dc:6b:64:28:d9:9b:28:3b:14:85:83:63:08:60:5c:14:e0:60:b3:f1:ce:19:61:68:8b:29:63:f5

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26

  Signer

  Actual PE Digest

  55:a2:2c:85:ec:8b:5f:16:52:a8:7d:e3:fd:3a:49:f5:1f:08:59:26

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:03

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  getpeername

  ntohs

  socket

  setsockopt

  bind

  htons

  WSASetBlockingHook

  WSAUnhookBlockingHook

  send

  gethostname

  getsockname

  connect

  __WSAFDIsSet

  WSASetLastError

  ioctlsocket

  gethostbyname

  shutdown

  recv

  closesocket

  WSACancelBlockingCall

  inet_ntoa

  select

  WSAGetLastError

  WSAStartup

  WSACleanup

  inet_addr

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  kernel32

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetStringTypeW

  GetLocaleInfoW

  LoadLibraryW

  SetConsoleCtrlHandler

  FatalAppExitA

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapSize

  ReadFile

  GetStartupInfoW

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetCurrentProcess

  TerminateProcess

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDBCSLeadByte

  CompareStringA

  GetModuleFileNameA

  GetProcAddress

  GetModuleHandleA

  OutputDebugStringA

  LoadLibraryA

  FreeLibrary

  InitializeCriticalSection

  DeleteCriticalSection

  Sleep

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  WritePrivateProfileStringA

  CloseHandle

  FlushFileBuffers

  SetFilePointer

  GetFileSize

  GetPrivateProfileIntA

  CreateFileA

  SetStdHandle

  WriteFile

  GetLocalTime

  GetDateFormatA

  CopyFileA

  InterlockedExchange

  SetEvent

  GetVersionExA

  InterlockedDecrement

  GetTickCount

  SystemTimeToFileTime

  GetSystemTime

  OpenProcess

  GetCurrentProcessId

  GetCurrentThreadId

  InterlockedIncrement

  GetTempPathA

  ReleaseMutex

  WaitForSingleObject

  TerminateThread

  lstrlenA

  CreateMutexA

  SetThreadPriority

  CreateThread

  CreateEventA

  ExitProcess

  MultiByteToWideChar

  WideCharToMultiByte

  CreateFileW

  GetVersion

  GlobalFree

  LCMapStringW

  GetCurrentThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  IsProcessorFeaturePresent

  HeapDestroy

  HeapCreate

  GetModuleFileNameW

  GetConsoleCP

  GetConsoleMode

  WriteConsoleW

  SetEndOfFile

  GetProcessHeap

  GetLastError

  PulseEvent

  HeapAlloc

  HeapFree

  RtlUnwind

  RaiseException

  HeapReAlloc

  EncodePointer

  DecodePointer

  GetCommandLineA

  GetModuleHandleW

  GetStdHandle

  user32

  PostThreadMessageA

  PostMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  KillTimer

  PeekMessageA

  PostQuitMessage

  GetDesktopWindow

  MessageBoxA

  wvsprintfA

  wsprintfA

  advapi32

  GetTokenInformation

  LogonUserA

  ImpersonateLoggedOnUser

  RevertToSelf

  GetUserNameA

  OpenProcessToken

  Exports

  Exports

  ctl_adddomain

  ctl_addoperator

  ctl_bridgename

  ctl_broadcast

  ctl_broadcastdata

  ctl_call

  ctl_callremote

  ctl_clearpin

  ctl_clientpinrequest

  ctl_clientstatus

  ctl_close

  ctl_closeremote

  ctl_connected

  ctl_controlpinrequest

  ctl_controlsendpin

  ctl_escape

  ctl_findslaves

  ctl_findslaves2

  ctl_findslavesex

  ctl_getconnectivityinfo

  ctl_getfailedreason

  ctl_getfileinfo

  ctl_getlocalipaddressinuse

  ctl_getsession

  ctl_hangup

  ctl_helpreq

  ctl_installed

  ctl_licenseinfo

  ctl_maxpacket

  ctl_messageacknowledged

  ctl_messagereceived

  ctl_myaddr

  ctl_netname

  ctl_networks

  ctl_nsessions

  ctl_open

  ctl_openremote

  ctl_pause

  ctl_pingnet

  ctl_pittmanfunc

  ctl_publishservice

  ctl_publishserviceex

  ctl_putfile

  ctl_putfilelink

  ctl_remotename

  ctl_removedomain

  ctl_removeoperator

  ctl_send

  ctl_sendif

  ctl_sendto

  ctl_subset

  ctl_userstatus

  ctl_version

  Sections

  .text

  Size: 249KB - Virtual size: 249KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 10KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• NSM.LIC
• PCICHEK.DLL

  .dll windows x86

  1233e02b30a7c416ba5aa017ff2ba312

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  70:19:fe:86:36:c1:40:67:6b:d7:25:97:c0:51:e5:67:eb:67:bc:13:2b:d0:4d:e9:c0:a6:86:94:94:24:fd:ab

  Signer

  Actual PE Digest

  70:19:fe:86:36:c1:40:67:6b:d7:25:97:c0:51:e5:67:eb:67:bc:13:2b:d0:4d:e9:c0:a6:86:94:94:24:fd:ab

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  31:07:46:8f:ed:21:e6:3d:07:54:56:b3:a3:48:b0:a4:21:17:45:d8

  Signer

  Actual PE Digest

  31:07:46:8f:ed:21:e6:3d:07:54:56:b3:a3:48:b0:a4:21:17:45:d8

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetVersionExA

  DisableThreadLibraryCalls

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  ExitProcess

  user32

  LoadStringA

  MessageBoxA

  wsprintfA

  msvcr100

  _except_handler4_common

  _crt_debugger_hook

  memset

  Exports

  Exports

  CheckLicenseString

  IsILS

  IsJPIK

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 946B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 490B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• PCICL32.DLL

  .dll windows x86

  3e09384870fa6c1a29cc37553985fcc6

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  39:f1:c3:8f:1a:d9:c2:ff:24:db:8c:82:7e:b1:d7:d8:ae:74:a1:1b:4d:42:a8:c3:5c:7f:74:30:be:67:e4:4d

  Signer

  Actual PE Digest

  39:f1:c3:8f:1a:d9:c2:ff:24:db:8c:82:7e:b1:d7:d8:ae:74:a1:1b:4d:42:a8:c3:5c:7f:74:30:be:67:e4:4d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  5b:48:76:9b:35:e3:29:03:10:0e:18:24:5a:d4:72:ec:84:25:12:32

  Signer

  Actual PE Digest

  5b:48:76:9b:35:e3:29:03:10:0e:18:24:5a:d4:72:ec:84:25:12:32

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  secur32

  GetUserNameExA

  shfolder

  SHGetFolderPathA

  pcichek

  IsILS

  IsJPIK

  CheckLicenseString

  pcicapi

  CapiClose

  CapiOpen

  CapiListen

  CapiHangup

  mpr

  WNetAddConnection2A

  WNetCancelConnection2A

  WNetGetConnectionA

  comctl32

  ImageList_Draw

  ImageList_LoadImageA

  ImageList_Destroy

  ImageList_ReplaceIcon

  ImageList_AddMasked

  ImageList_GetImageCount

  ord17

  ImageList_DrawEx

  ImageList_GetIconSize

  ImageList_GetIcon

  ImageList_Create

  version

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  winmm

  waveOutClose

  waveOutReset

  waveInClose

  waveInUnprepareHeader

  waveInReset

  waveInStop

  waveOutUnprepareHeader

  waveInPrepareHeader

  waveOutSetVolume

  waveOutOpen

  waveInStart

  waveInOpen

  waveOutWrite

  waveOutPrepareHeader

  timeGetTime

  timeEndPeriod

  timeBeginPeriod

  PlaySoundA

  waveInAddBuffer

  wsock32

  inet_addr

  send

  setsockopt

  bind

  listen

  accept

  htons

  socket

  connect

  getpeername

  gethostbyname

  recv

  shutdown

  closesocket

  WSACleanup

  WSAStartup

  WSAGetLastError

  gethostname

  htonl

  ioctlsocket

  kernel32

  HeapFree

  HeapAlloc

  GetProcessHeap

  IsBadReadPtr

  SizeofResource

  CreateDirectoryA

  RemoveDirectoryA

  MoveFileA

  MulDiv

  GetDiskFreeSpaceA

  GetCurrentDirectoryA

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  GetVolumeInformationA

  FileTimeToDosDateTime

  FileTimeToLocalFileTime

  OpenEventA

  FindResourceA

  OutputDebugStringA

  SetCurrentDirectoryA

  LocalAlloc

  GetTimeFormatW

  GetDateFormatW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  WideCharToMultiByte

  lstrlenW

  lstrlenA

  lstrcmpiA

  FlushInstructionCache

  lstrcmpA

  FindResourceExA

  TerminateThread

  ReleaseMutex

  WaitForSingleObjectEx

  GlobalReAlloc

  CreateNamedPipeA

  ConnectNamedPipe

  SetProcessShutdownParameters

  SetConsoleCtrlHandler

  IsDBCSLeadByteEx

  DisconnectNamedPipe

  WriteProfileStringA

  DefineDosDeviceA

  QueryDosDeviceA

  TryEnterCriticalSection

  ResumeThread

  VirtualQueryEx

  GetThreadContext

  ReadProcessMemory

  PulseEvent

  CreateRemoteThread

  SetThreadContext

  PostQueuedCompletionStatus

  CreateIoCompletionPort

  GetQueuedCompletionStatus

  Beep

  GetSystemDefaultLangID

  GetSystemInfo

  SuspendThread

  OpenThread

  GetProcessVersion

  GlobalGetAtomNameA

  RtlUnwind

  DecodePointer

  EncodePointer

  InterlockedCompareExchange

  LoadResource

  LockResource

  VirtualProtectEx

  WriteProcessMemory

  GetExitCodeThread

  CompareStringA

  SetFilePointer

  GetProfileStringA

  GetOEMCP

  GetShortPathNameA

  TerminateProcess

  SystemTimeToFileTime

  CreateFileMappingA

  OpenFileMappingA

  MapViewOfFile

  UnmapViewOfFile

  CreatePipe

  DuplicateHandle

  SetHandleInformation

  FormatMessageA

  LocalFree

  SetNamedPipeHandleState

  GetPriorityClass

  WinExec

  SearchPathA

  IsValidCodePage

  SetSystemTime

  _lopen

  _lclose

  DeleteFileA

  SetFileAttributesA

  GetSystemDirectoryA

  GetDateFormatA

  GetTimeFormatA

  GlobalSize

  SetUnhandledExceptionFilter

  OpenMutexA

  CreateMutexA

  SetErrorMode

  GetACP

  SetPriorityClass

  GetFileAttributesA

  GetTempFileNameA

  CopyFileA

  FileTimeToSystemTime

  GetComputerNameA

  ExitProcess

  GetModuleHandleA

  GetExitCodeProcess

  GetCurrentProcess

  LoadLibraryExA

  ExitThread

  GetDriveTypeA

  GetWindowsDirectoryA

  IsDBCSLeadByte

  GetLocalTime

  GetFileSize

  GlobalAlloc

  GlobalLock

  ReadFile

  GlobalUnlock

  GlobalFree

  GetSystemPowerStatus

  ExpandEnvironmentStringsA

  FindFirstFileA

  FindNextFileA

  FindClose

  GetUserDefaultUILanguage

  GetUserDefaultLangID

  GetModuleFileNameA

  GetCurrentProcessId

  CreateProcessA

  DeleteCriticalSection

  InitializeCriticalSection

  GetVersion

  CreateThread

  SetThreadPriority

  InterlockedIncrement

  WaitForMultipleObjects

  GetOverlappedResult

  ResetEvent

  InterlockedDecrement

  LeaveCriticalSection

  EnterCriticalSection

  GetLastError

  DeviceIoControl

  InterlockedExchange

  SetLastError

  GetProcAddress

  FreeLibrary

  LoadLibraryA

  CreateFileA

  GetTempPathA

  WriteFile

  GetCurrentThreadId

  CreateEventA

  WaitForSingleObject

  SetEvent

  GlobalDeleteAtom

  Sleep

  GlobalAddAtomA

  OpenProcess

  GetVersionExA

  GetTickCount

  CloseHandle

  HeapReAlloc

  GetSystemTimeAsFileTime

  VirtualProtect

  VirtualAlloc

  GetModuleHandleW

  VirtualQuery

  GetConsoleMode

  GetCommandLineA

  LCMapStringW

  GetCPInfo

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  UnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapCreate

  HeapDestroy

  GetStdHandle

  GetModuleFileNameW

  HeapSize

  GetLocaleInfoW

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetConsoleCP

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  GetStringTypeW

  GetTimeZoneInformation

  CreateFileW

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  FlushFileBuffers

  LoadLibraryW

  WriteConsoleW

  CompareStringW

  SetEnvironmentVariableA

  SetEndOfFile

  InterlockedPushEntrySList

  VirtualFree

  InterlockedPopEntrySList

  MultiByteToWideChar

  user32

  CreateCursor

  HideCaret

  OemToCharBuffA

  ScrollWindow

  SetScrollPos

  SetScrollRange

  ClipCursor

  DrawIconEx

  RemoveMenu

  SetActiveWindow

  AdjustWindowRectEx

  TrackPopupMenuEx

  SetMenuDefaultItem

  InsertMenuItemA

  EndMenu

  LoadStringW

  SetMenuInfo

  GetMenuInfo

  GetScrollInfo

  SetScrollInfo

  TileWindows

  GetScrollRange

  GetWindowRgn

  GetAsyncKeyState

  EnumThreadWindows

  EnumDisplaySettingsA

  CreateDesktopA

  PostMessageW

  OpenInputDesktop

  GetMenuItemRect

  mouse_event

  MapVirtualKeyA

  CharLowerBuffA

  ShowCursor

  SwitchDesktop

  AttachThreadInput

  GetCursor

  CreateDialogIndirectParamA

  DialogBoxIndirectParamA

  DialogBoxParamA

  SetClassLongA

  MapDialogRect

  CreateAcceleratorTableA

  DestroyAcceleratorTable

  RedrawWindow

  InvalidateRgn

  CharNextA

  LoadAcceleratorsA

  ScreenToClient

  ModifyMenuA

  CreateMenu

  MoveWindow

  SetCursorPos

  DrawTextW

  IsDialogMessageA

  UnionRect

  DrawFocusRect

  wsprintfW

  EndDialog

  OpenWindowStationA

  GetProcessWindowStation

  SetProcessWindowStation

  CloseWindowStation

  MsgWaitForMultipleObjects

  GetUserObjectSecurity

  SetUserObjectSecurity

  MessageBoxIndirectA

  WinHelpA

  UnhookWindowsHookEx

  SetWindowsHookExA

  CreateDialogParamA

  GetLastActivePopup

  CallNextHookEx

  GetUpdateRect

  BeginDeferWindowPos

  EndDeferWindowPos

  GetTopWindow

  DestroyCursor

  GetActiveWindow

  IsZoomed

  CreatePopupMenu

  AppendMenuA

  CopyRect

  EqualRect

  LoadStringA

  ClientToScreen

  DeferWindowPos

  IsChild

  GetWindowPlacement

  TranslateAcceleratorA

  SetRectEmpty

  SetMenu

  SetWindowPlacement

  GetForegroundWindow

  CharUpperBuffA

  WindowFromPoint

  WaitForInputIdle

  GetUserObjectInformationA

  GetCursorPos

  CheckDlgButton

  SetForegroundWindow

  EnumChildWindows

  RegisterClipboardFormatA

  CountClipboardFormats

  EnumClipboardFormats

  GetClipboardData

  IsClipboardFormatAvailable

  GetClipboardFormatNameA

  RegisterWindowMessageA

  DestroyIcon

  CharUpperA

  ExitWindowsEx

  GetDesktopWindow

  MessageBoxA

  keybd_event

  GetThreadDesktop

  SetThreadDesktop

  wvsprintfA

  CreateCaret

  ShowCaret

  UnregisterClassA

  SetTimer

  KillTimer

  SetDlgItemTextA

  SendMessageA

  SendDlgItemMessageA

  PostMessageA

  ShowWindow

  DefWindowProcA

  CallWindowProcA

  PostThreadMessageA

  GetQueueStatus

  GetDlgItem

  GetDlgCtrlID

  GetDC

  ReleaseDC

  InvalidateRect

  DestroyCaret

  GetKeyState

  PeekMessageA

  SetCaretPos

  DrawMenuBar

  GetSystemMenu

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  MessageBeep

  CloseClipboard

  FindWindowExA

  DeleteMenu

  GetWindowTextLengthA

  GetFocus

  GetClassInfoExA

  DestroyWindow

  DefDlgProcA

  RegisterClassExA

  IsDlgButtonChecked

  GetDlgItemTextA

  IsIconic

  GetMenu

  SystemParametersInfoA

  IntersectRect

  GetCursorInfo

  GetIconInfo

  IsWindowVisible

  GetWindow

  SendMessageTimeoutA

  GetClassLongA

  CopyIcon

  CopyImage

  LoadImageA

  OpenDesktopA

  EnumDesktopWindows

  CloseDesktop

  EnumWindows

  GetClassNameA

  GetClassInfoA

  LoadIconA

  RegisterClassA

  BringWindowToTop

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetPropA

  GetPropA

  RemovePropA

  GetCapture

  SetCapture

  ReleaseCapture

  CreateWindowExA

  BeginPaint

  EndPaint

  wsprintfA

  PostQuitMessage

  GetMenuItemID

  CheckMenuItem

  EnableMenuItem

  GetMenuItemInfoA

  SetMenuItemInfoA

  PtInRect

  GetWindowDC

  LoadMenuA

  GetSubMenu

  GetMenuItemCount

  DestroyMenu

  InflateRect

  GetSystemMetrics

  FindWindowA

  GetWindowThreadProcessId

  IsWindow

  SetFocus

  SetWindowPos

  GetParent

  GetWindowTextA

  SetWindowTextA

  GetWindowLongA

  MapWindowPoints

  GetClientRect

  DrawTextA

  OffsetRect

  IsWindowEnabled

  SetRect

  GetWindowRect

  FillRect

  LoadBitmapA

  GetSysColor

  SetCursor

  LoadCursorA

  UpdateWindow

  EnableWindow

  SetWindowLongA

  gdi32

  EndPage

  StartPage

  ExtEscape

  ExtTextOutA

  AddFontResourceA

  RemoveFontResourceA

  SelectPalette

  RealizePalette

  EqualRgn

  CreatePalette

  CreateBrushIndirect

  GetDCOrgEx

  SetBrushOrgEx

  PatBlt

  CreatePatternBrush

  GetTextMetricsA

  StretchBlt

  GetSystemPaletteEntries

  GetNearestPaletteIndex

  GetBkMode

  CreateFontIndirectW

  SetBitmapBits

  UnrealizeObject

  SetDIBits

  SetTextCharacterExtra

  SetRectRgn

  CreatePenIndirect

  GetClipRgn

  GetWindowOrgEx

  IntersectClipRect

  Arc

  Chord

  Pie

  Polyline

  RoundRect

  SetPolyFillMode

  CreateDIBitmap

  SetTextJustification

  SetBkMode

  SetTextColor

  CreateCompatibleDC

  CreateCompatibleBitmap

  GetDIBits

  CreateDIBSection

  GdiFlush

  GetRegionData

  CombineRgn

  CreateRectRgn

  CreateRectRgnIndirect

  PtInRegion

  SelectObject

  GetObjectA

  BitBlt

  DeleteDC

  RectVisible

  SetWindowOrgEx

  DeleteObject

  GetPaletteEntries

  GetTextColor

  GetBkColor

  GetTextExtentPoint32A

  GetMapMode

  SetMapMode

  GetStretchBltMode

  SetStretchBltMode

  GetBitmapBits

  BeginPath

  TextOutA

  EndPath

  PathToRegion

  GetRgnBox

  OffsetRgn

  FillRgn

  FrameRgn

  CreateBitmap

  CreateDCA

  SelectClipRgn

  LineDDA

  Polygon

  CreateFontIndirectA

  CreateHatchBrush

  GetDeviceCaps

  SetBkColor

  ExtFloodFill

  GetPixel

  SetPixel

  SetPixelV

  Ellipse

  Rectangle

  SetROP2

  MoveToEx

  LineTo

  GetStockObject

  CreatePen

  CreateSolidBrush

  GetTextExtentPointA

  RectInRegion

  winspool.drv

  EnumPrinterDriversA

  DeletePrinter

  AddPrinterA

  EnumPrintersA

  ord201

  ord202

  EnumJobsA

  SetJobA

  AbortPrinter

  StartPagePrinter

  WritePrinter

  StartDocPrinterA

  OpenPrinterA

  ClosePrinter

  EndPagePrinter

  EndDocPrinter

  GetPrinterA

  comdlg32

  PageSetupDlgA

  GetOpenFileNameA

  GetSaveFileNameA

  ChooseFontA

  advapi32

  EnumServicesStatusA

  RegisterServiceCtrlHandlerA

  RegisterEventSourceA

  ReportEventA

  DeregisterEventSource

  RegCreateKeyA

  SetTokenInformation

  SetServiceStatus

  StartServiceCtrlDispatcherA

  LogonUserA

  ControlService

  StartServiceA

  RegQueryInfoKeyW

  CryptGetProvParam

  CryptReleaseContext

  AllocateLocallyUniqueId

  FreeSid

  GetSecurityDescriptorSacl

  SetSecurityDescriptorSacl

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  QueryServiceConfigA

  CreateProcessAsUserA

  GetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  GetAclInformation

  InitializeAcl

  GetAce

  AddAce

  AddAccessAllowedAce

  IsValidSid

  GetLengthSid

  CopySid

  RegQueryInfoKeyA

  RegDeleteKeyA

  RegEnumKeyExA

  RegEnumValueA

  RegCreateKeyExA

  RegSetValueExA

  RegDeleteValueA

  RegFlushKey

  RegOpenKeyExA

  RegCloseKey

  OpenSCManagerA

  OpenServiceA

  QueryServiceStatus

  CloseServiceHandle

  GetUserNameA

  LookupPrivilegeNameA

  RegQueryValueExA

  GetTokenInformation

  LookupAccountSidA

  GetSidIdentifierAuthority

  GetSidSubAuthorityCount

  GetSidSubAuthority

  AllocateAndInitializeSid

  EqualSid

  RevertToSelf

  OpenProcessToken

  ImpersonateLoggedOnUser

  GetUserNameW

  shell32

  ExtractIconExA

  SHGetSpecialFolderPathA

  SHGetFileInfoA

  SHGetMalloc

  SHGetDesktopFolder

  SHGetPathFromIDListA

  FindExecutableA

  ExtractIconA

  Shell_NotifyIconA

  ShellExecuteA

  ole32

  CoUninitialize

  CoInitialize

  CoCreateInstance

  CreateStreamOnHGlobal

  StringFromGUID2

  ReleaseStgMedium

  OleDuplicateData

  CreateDataAdviseHolder

  CoTaskMemFree

  CLSIDFromProgID

  OleInitialize

  OleUninitialize

  CoTaskMemAlloc

  CoTaskMemRealloc

  OleLockRunning

  CoInitializeSecurity

  CoInitializeEx

  OleCreateStaticFromData

  CreateILockBytesOnHGlobal

  StgCreateDocfileOnILockBytes

  OleSetContainedObject

  IIDFromString

  CLSIDFromString

  CoGetClassObject

  oleaut32

  SysStringByteLen

  OleLoadPicture

  SysFreeString

  SysAllocString

  VariantClear

  VariantInit

  VariantChangeType

  SysStringLen

  SysAllocStringLen

  VarUI4FromStr

  OleCreateFontIndirect

  LoadRegTypeLi

  LoadTypeLi

  OleCreatePictureIndirect

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayGetElemsize

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayGetDim

  SafeArrayCreate

  VariantCopy

  oleacc

  AccessibleObjectFromWindow

  netapi32

  NetUserEnum

  NetApiBufferFree

  wininet

  InternetCrackUrlA

  Exports

  Exports

  _GetRawWMIStringW@16

  _GetWMIStringW@16

  _IsAcerA@8

  _NSMClient32@8

  _NSMFindClass@12

  br_close

  br_open

  br_poll

  br_status

  Sections

  .text

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 312KB - Virtual size: 311KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 47KB - Virtual size: 73KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 21B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .hhshare

  Size: 512B - Virtual size: 28B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 141KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• TCCTL32.DLL

  .dll windows x86

  2c4d798bb87ec57193b7625c4259da43

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  a3:3f:41:12:a2:5c:25:dd:c6:a7:1a:1b:c7:28:0d:33:9b:79:75:b3:2b:2d:fd:bb:9b:37:a4:83:e9:a3:46:17

  Signer

  Actual PE Digest

  a3:3f:41:12:a2:5c:25:dd:c6:a7:1a:1b:c7:28:0d:33:9b:79:75:b3:2b:2d:fd:bb:9b:37:a4:83:e9:a3:46:17

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:10

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  0f:54:fc:aa:4d:b0:4d:d4:93:19:dd:0b:92:d9:85:18:59:22:b6:56

  Signer

  Actual PE Digest

  0f:54:fc:aa:4d:b0:4d:d4:93:19:dd:0b:92:d9:85:18:59:22:b6:56

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:10

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  kernel32

  GetLastError

  WriteFile

  ReadFile

  Sleep

  ClearCommError

  InterlockedIncrement

  EnterCriticalSection

  LeaveCriticalSection

  InterlockedDecrement

  GetModuleFileNameA

  DeleteCriticalSection

  CloseHandle

  TerminateThread

  SetEvent

  CreateEventA

  GetTickCount

  SetThreadPriority

  CreateThread

  SetCommTimeouts

  InitializeCriticalSection

  GetCommState

  IsDBCSLeadByte

  CompareStringA

  GetProcAddress

  LoadLibraryA

  FreeLibrary

  GetModuleHandleA

  OutputDebugStringA

  OpenProcess

  GetCurrentProcessId

  GetVersionExA

  GetLocalTime

  GetOverlappedResult

  GetCurrentThreadId

  ExitProcess

  MultiByteToWideChar

  WideCharToMultiByte

  LocalAlloc

  LocalFree

  PulseEvent

  InterlockedExchange

  GetExitCodeThread

  ResetEvent

  GetVersion

  SetLastError

  EscapeCommFunction

  GetCommModemStatus

  CreateDirectoryA

  GetDateFormatA

  GetTimeFormatA

  GetSystemTimeAsFileTime

  lstrlenW

  lstrlenA

  CreateFileW

  GetProcessHeap

  SetEndOfFile

  WriteConsoleW

  CreateFileA

  FlushFileBuffers

  SetStdHandle

  LoadLibraryW

  GetLocaleInfoA

  IsValidLocale

  EnumSystemLocalesA

  WaitForSingleObject

  GetStringTypeW

  FatalAppExitA

  GetUserDefaultLCID

  GetTempPathA

  SetConsoleCtrlHandler

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetConsoleMode

  GetConsoleCP

  GetLocaleInfoW

  HeapSize

  SetFilePointer

  GetStartupInfoW

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  HeapDestroy

  HeapAlloc

  HeapFree

  RtlUnwind

  HeapReAlloc

  RaiseException

  EncodePointer

  DecodePointer

  GetCommandLineA

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetModuleHandleW

  GetCurrentThread

  LCMapStringW

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  IsProcessorFeaturePresent

  GetStdHandle

  GetModuleFileNameW

  HeapCreate

  user32

  CharLowerA

  PostThreadMessageA

  PostMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  MessageBoxA

  KillTimer

  PeekMessageA

  PostQuitMessage

  wsprintfA

  wvsprintfA

  advapi32

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  OpenProcessToken

  GetTokenInformation

  GetUserNameA

  oleaut32

  SysAllocStringLen

  SafeArrayCreate

  SafeArrayGetDim

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayGetElemsize

  SafeArrayAccessData

  SafeArrayUnaccessData

  VariantChangeType

  VariantClear

  SysStringByteLen

  CreateErrorInfo

  GetErrorInfo

  SysAllocString

  SetErrorInfo

  SysFreeString

  VariantInit

  Exports

  Exports

  ?RemoteNotify@@YAXP6GHHPAXPATCTL_CALLBACK@@@Z0@Z

  ctl_bridgename

  ctl_broadcastdata

  ctl_call

  ctl_callremote

  ctl_close

  ctl_closeremote

  ctl_connected

  ctl_escape

  ctl_findslaves

  ctl_findslavesex

  ctl_getcodepage

  ctl_getlocalipaddressinuse

  ctl_getsession

  ctl_hangup

  ctl_helpreq

  ctl_installed

  ctl_maxpacket

  ctl_myaddr

  ctl_netname

  ctl_networks

  ctl_nsessions

  ctl_open

  ctl_openremote

  ctl_pause

  ctl_pingnet

  ctl_remotename

  ctl_send

  ctl_sendex

  ctl_sendif

  ctl_sendname

  ctl_sendto

  ctl_subset

  ctl_version

  Sections

  .text

  Size: 305KB - Virtual size: 305KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• client32.exe

  .exe windows x86

  a9d50692e95b79723f3e76fcf70d023e

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  15-09-2017 00:00

  Not After

  22-09-2020 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  15-09-2017 00:00

  Not After

  22-09-2020 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  f0:4c:42:33:10:18:6b:d4:d1:2b:84:e5:6d:0e:d2:be:97:91:36:83:d5:b5:d0:c8:cf:b8:44:f5:8f:70:cf:be

  Signer

  Actual PE Digest

  f0:4c:42:33:10:18:6b:d4:d1:2b:84:e5:6d:0e:d2:be:97:91:36:83:d5:b5:d0:c8:cf:b8:44:f5:8f:70:cf:be

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  26-02-2018 13:06

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  e3:78:a0:be:d8:3f:4e:f7:b3:ee:17:90:af:23:a7:10:e5:1d:f3:2d

  Signer

  Actual PE Digest

  e3:78:a0:be:d8:3f:4e:f7:b3:ee:17:90:af:23:a7:10:e5:1d:f3:2d

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  26-02-2018 13:06

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  pcicl32

  _NSMClient32@8

  kernel32

  GetCommandLineW

  ExitProcess

  GetModuleHandleW

  GetStartupInfoW

  Sections

  .text

  Size: 512B - Virtual size: 194B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 350B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 91KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 108B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• client32.ini
• msvcr100.dll

  .dll windows x86

  5271d5ce8b44dd47bc92563e27585466

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

  Signer

  Actual PE Digest

  8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  11-06-2011 08:50

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  EncodePointer

  DecodePointer

  RaiseException

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleW

  GetProcAddress

  ExitProcess

  WriteFile

  GetStdHandle

  GetCurrentThreadId

  TlsGetValue

  GetCommandLineW

  GetCommandLineA

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  ExitThread

  CloseHandle

  GetLastError

  ResumeThread

  CreateThread

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  InterlockedDecrement

  GetCurrentThread

  FindNextFileA

  FindFirstFileExA

  FindClose

  FindNextFileW

  FindFirstFileExW

  GetLogicalDrives

  GetDiskFreeSpaceA

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  SetErrorMode

  Sleep

  Beep

  GetFileAttributesA

  SetFileAttributesA

  SetEnvironmentVariableA

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetFullPathNameA

  GetDriveTypeW

  GetCurrentProcessId

  CreateDirectoryA

  MoveFileA

  RemoveDirectoryA

  GetDriveTypeA

  DeleteFileA

  GetFileAttributesW

  SetEnvironmentVariableW

  SetFileAttributesW

  GetFullPathNameW

  CreateDirectoryW

  MoveFileW

  RemoveDirectoryW

  DeleteFileW

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessA

  LoadLibraryA

  FreeLibrary

  CreateProcessW

  ReadFile

  DuplicateHandle

  GetCurrentProcess

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  GetLocalTime

  WideCharToMultiByte

  SetFileTime

  LocalFileTimeToFileTime

  SystemTimeToFileTime

  SetLocalTime

  InterlockedPopEntrySList

  InterlockedFlushSList

  QueryDepthSList

  InterlockedPushEntrySList

  CreateTimerQueue

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  SetEvent

  CreateEventW

  SwitchToThread

  SignalObjectAndWait

  TryEnterCriticalSection

  GetTickCount

  VirtualFree

  GetVersionExW

  SetThreadPriority

  VirtualAlloc

  GetSystemInfo

  GetProcessAffinityMask

  VirtualProtect

  SetThreadAffinityMask

  InitializeSListHead

  ReleaseSemaphore

  CreateSemaphoreW

  WaitForMultipleObjects

  GetThreadPriority

  LoadLibraryW

  SleepEx

  OutputDebugStringW

  FreeLibraryAndExitThread

  GetModuleHandleA

  GetThreadTimes

  DebugBreak

  MultiByteToWideChar

  GetStringTypeW

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  GetTimeFormatA

  GetDateFormatA

  GetTimeFormatW

  GetDateFormatW

  RtlUnwind

  HeapAlloc

  HeapFree

  HeapCreate

  HeapDestroy

  HeapQueryInformation

  HeapReAlloc

  HeapSize

  HeapValidate

  HeapCompact

  HeapWalk

  VirtualQuery

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetFileInformationByHandle

  PeekNamedPipe

  CreateFileA

  CreateFileW

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  CreatePipe

  SetStdHandle

  ReadConsoleInputA

  SetConsoleMode

  PeekConsoleInputA

  GetNumberOfConsoleInputEvents

  ReadConsoleInputW

  WriteConsoleW

  ReadConsoleW

  SetEndOfFile

  GetProcessHeap

  InterlockedExchange

  LockFile

  UnlockFile

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  SetConsoleCtrlHandler

  GetLocaleInfoW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  LCMapStringW

  CompareStringW

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  IsProcessorFeaturePresent

  Exports

  Exports

  $I10_OUTPUT

  ??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z

  ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z

  ??0SchedulerPolicy@Concurrency@@QAA@IZZ

  ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z

  ??0SchedulerPolicy@Concurrency@@QAE@XZ

  ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z

  ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z

  ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z

  ??0_TaskCollection@details@Concurrency@@QAE@XZ

  ??0_Timer@details@Concurrency@@IAE@I_N@Z

  ??0__non_rtti_object@std@@QAE@ABV01@@Z

  ??0__non_rtti_object@std@@QAE@PBD@Z

  ??0bad_cast@std@@AAE@PBQBD@Z

  ??0bad_cast@std@@QAE@ABV01@@Z

  ??0bad_cast@std@@QAE@PBD@Z

  ??0bad_target@Concurrency@@QAE@PBD@Z

  ??0bad_target@Concurrency@@QAE@XZ

  ??0bad_typeid@std@@QAE@ABV01@@Z

  ??0bad_typeid@std@@QAE@PBD@Z

  ??0context_self_unblock@Concurrency@@QAE@PBD@Z

  ??0context_self_unblock@Concurrency@@QAE@XZ

  ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z

  ??0context_unblock_unbalanced@Concurrency@@QAE@XZ

  ??0critical_section@Concurrency@@QAE@XZ

  ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z

  ??0default_scheduler_exists@Concurrency@@QAE@XZ

  ??0event@Concurrency@@QAE@XZ

  ??0exception@std@@QAE@ABQBD@Z

  ??0exception@std@@QAE@ABQBDH@Z

  ??0exception@std@@QAE@ABV01@@Z

  ??0exception@std@@QAE@XZ

  ??0improper_lock@Concurrency@@QAE@PBD@Z

  ??0improper_lock@Concurrency@@QAE@XZ

  ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_attach@Concurrency@@QAE@XZ

  ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_detach@Concurrency@@QAE@XZ

  ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_reference@Concurrency@@QAE@XZ

  ??0invalid_link_target@Concurrency@@QAE@PBD@Z

  ??0invalid_link_target@Concurrency@@QAE@XZ

  ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z

  ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ

  ??0invalid_operation@Concurrency@@QAE@PBD@Z

  ??0invalid_operation@Concurrency@@QAE@XZ

  ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z

  ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ

  ??0message_not_found@Concurrency@@QAE@PBD@Z

  ??0message_not_found@Concurrency@@QAE@XZ

  ??0missing_wait@Concurrency@@QAE@PBD@Z

  ??0missing_wait@Concurrency@@QAE@XZ

  ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z

  ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ

  ??0operation_timed_out@Concurrency@@QAE@PBD@Z

  ??0operation_timed_out@Concurrency@@QAE@XZ

  ??0reader_writer_lock@Concurrency@@QAE@XZ

  ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z

  ??0scheduler_not_attached@Concurrency@@QAE@XZ

  ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z

  ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z

  ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z

  ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z

  ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z

  ??0task_canceled@details@Concurrency@@QAE@PBD@Z

  ??0task_canceled@details@Concurrency@@QAE@XZ

  ??0unsupported_os@Concurrency@@QAE@PBD@Z

  ??0unsupported_os@Concurrency@@QAE@XZ

  ??1SchedulerPolicy@Concurrency@@QAE@XZ

  ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??1_SpinLock@details@Concurrency@@QAE@XZ

  ??1_TaskCollection@details@Concurrency@@QAE@XZ

  ??1_Timer@details@Concurrency@@IAE@XZ

  ??1__non_rtti_object@std@@UAE@XZ

  ??1bad_cast@std@@UAE@XZ

  ??1bad_typeid@std@@UAE@XZ

  ??1critical_section@Concurrency@@QAE@XZ

  ??1event@Concurrency@@QAE@XZ

  ??1exception@std@@UAE@XZ

  ??1reader_writer_lock@Concurrency@@QAE@XZ

  ??1scoped_lock@critical_section@Concurrency@@QAE@XZ

  ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ

  ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ

  ??1type_info@@UAE@XZ

  ??2@YAPAXI@Z

  ??2@YAPAXIHPBDH@Z

  ??3@YAXPAX@Z

  ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z

  ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z

  ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z

  ??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z

  ??4bad_cast@std@@QAEAAV01@ABV01@@Z

  ??4bad_typeid@std@@QAEAAV01@ABV01@@Z

  ??4exception@std@@QAEAAV01@ABV01@@Z

  ??8type_info@@QBE_NABV0@@Z

  ??9type_info@@QBE_NABV0@@Z

  ??_7__non_rtti_object@std@@6B@

  ??_7bad_cast@std@@6B@

  ??_7bad_typeid@std@@6B@

  ??_7exception@@6B@

  ??_7exception@std@@6B@

  ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ

  ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ

  ??_Fbad_cast@std@@QAEXXZ

  ??_Fbad_typeid@std@@QAEXXZ

  ??_U@YAPAXI@Z

  ??_U@YAPAXIHPBDH@Z

  ??_V@YAXPAX@Z

  ?Alloc@Concurrency@@YAPAXI@Z

  ?Block@Context@Concurrency@@SAXXZ

  ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z

  ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z

  ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ

  ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ

  ?CurrentContext@Context@Concurrency@@SAPAV12@XZ

  ?Detach@CurrentScheduler@Concurrency@@SAXXZ

  ?DisableTracing@Concurrency@@YAJXZ

  ?EnableTracing@Concurrency@@YAJXZ

  ?Free@Concurrency@@YAXPAX@Z

  ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ

  ?GetExecutionContextId@Concurrency@@YAIXZ

  ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ

  ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ

  ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ

  ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z

  ?GetProcessorCount@Concurrency@@YAIXZ

  ?GetProcessorNodeCount@Concurrency@@YAIXZ

  ?GetSchedulerId@Concurrency@@YAIXZ

  ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ

  ?Id@Context@Concurrency@@SAIXZ

  ?Id@CurrentScheduler@Concurrency@@SAIXZ

  ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ

  ?Log2@details@Concurrency@@YAKI@Z

  ?Oversubscribe@Context@Concurrency@@SAX_N@Z

  ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z

  ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ

  ?ScheduleGroupId@Context@Concurrency@@SAIXZ

  ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z

  ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z

  ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z

  ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z

  ?VirtualProcessorId@Context@Concurrency@@SAIXZ

  ?Yield@Context@Concurrency@@SAXXZ

  ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ

  ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z

  ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z

  ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ

  ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ

  ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ

  ?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z

  ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z

  ?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ

  ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ

  ?_Copy_str@exception@std@@AAEXPBD@Z

  ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ

  ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ

  ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ

  ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ

  ?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z

  ?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z

  ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ

  ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ

  ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ

  ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ

  ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ

  ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z

  ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z

  ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z

  ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z

  ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z

  ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z

  ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ

  ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ

  ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ

  ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ

  ?_SpinYield@Context@Concurrency@@SAXXZ

  ?_Start@_Timer@details@Concurrency@@IAEXXZ

  ?_Stop@_Timer@details@Concurrency@@IAEXXZ

  ?_Tidy@exception@std@@AAEXXZ

  ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z

  ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ

  ?_Type_info_dtor@type_info@@CAXPAV1@@Z

  ?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z

  ?_UnderlyingYield@details@Concurrency@@YAXXZ

  ?_ValidateExecute@@YAHP6GHXZ@Z

  ?_ValidateRead@@YAHPBXI@Z

  ?_ValidateWrite@@YAHPAXI@Z

  ?_Value@_SpinCount@details@Concurrency@@SAIXZ

  ?__ExceptionPtrAssign@@YAXPAXPBX@Z

  ?__ExceptionPtrCompare@@YA_NPBX0@Z

  ?__ExceptionPtrCopy@@YAXPAXPBX@Z

  ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z

  ?__ExceptionPtrCreate@@YAXPAX@Z

  ?__ExceptionPtrCurrentException@@YAXPAX@Z

  ?__ExceptionPtrDestroy@@YAXPAX@Z

  ?__ExceptionPtrRethrow@@YAXPBX@Z

  ?_inconsistency@@YAXXZ

  ?_invalid_parameter@@YAXPBG00II@Z

  ?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z

  ?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z

  ?_open@@YAHPBDHH@Z

  ?_query_new_handler@@YAP6AHI@ZXZ

  ?_query_new_mode@@YAHXZ

  ?_set_new_handler@@YAP6AHI@ZH@Z

  ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

  ?_set_new_mode@@YAHH@Z

  ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z

  ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

  ?_sopen@@YAHPBDHHH@Z

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  ?_wopen@@YAHPB_WHH@Z

  ?_wsopen@@YAHPB_WHHH@Z

  ?before@type_info@@QBEHABV1@@Z

  ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ

  ?lock@critical_section@Concurrency@@QAEXXZ

  ?lock@reader_writer_lock@Concurrency@@QAEXXZ

  ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ

  ?name@type_info@@QBEPBDPAU__type_info_node@@@Z

  ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ

  ?raw_name@type_info@@QBEPBDXZ

  ?reset@event@Concurrency@@QAEXXZ

  ?set@event@Concurrency@@QAEXXZ

  ?set_new_handler@@YAP6AXXZP6AXXZ@Z

  ?set_terminate@@YAP6AXXZH@Z

  ?set_terminate@@YAP6AXXZP6AXXZ@Z

  ?set_unexpected@@YAP6AXXZH@Z

  ?set_unexpected@@YAP6AXXZP6AXXZ@Z

  ?swprintf@@YAHPAGIPBGZZ

  ?swprintf@@YAHPA_WIPB_WZZ

  ?terminate@@YAXXZ

  ?try_lock@critical_section@Concurrency@@QAE_NXZ

  ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ

  ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ

  ?unexpected@@YAXXZ

  ?unlock@critical_section@Concurrency@@QAEXXZ

  ?unlock@reader_writer_lock@Concurrency@@QAEXXZ

  ?vswprintf@@YAHPA_WIPB_WPAD@Z

  ?wait@Concurrency@@YAXI@Z

  ?wait@event@Concurrency@@QAEII@Z

  ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z

  ?what@exception@std@@UBEPBDXZ

  _CIacos

  _CIasin

  _CIatan

  _CIatan2

  _CIcos

  _CIcosh

  _CIexp

  _CIfmod

  _CIlog

  _CIlog10

  _CIpow

  _CIsin

  _CIsinh

  _CIsqrt

  _CItan

  _CItanh

  _CRT_RTC_INIT

  _CRT_RTC_INITW

  _CreateFrameInfo

  _CxxThrowException

  _EH_prolog

  _FindAndUnlinkFrame

  _Getdays

  _Getmonths

  _Gettnames

  _HUGE

  _IsExceptionObjectToBeDestroyed

  _NLG_Dispatch2

  _NLG_Return

  _NLG_Return2

  _Strftime

  _XcptFilter

  __AdjustPointer

  __BuildCatchObject

  __BuildCatchObjectHelper

  __CppXcptFilter

  __CxxCallUnwindDelDtor

  __CxxCallUnwindDtor

  __CxxCallUnwindStdDelDtor

  __CxxCallUnwindVecDtor

  __CxxDetectRethrow

  __CxxExceptionFilter

  __CxxFrameHandler

  __CxxFrameHandler2

  __CxxFrameHandler3

  __CxxLongjmpUnwind

  __CxxQueryExceptionSize

  __CxxRegisterExceptionObject

  __CxxUnregisterExceptionObject

  __DestructExceptionObject

  __FrameUnwindFilter

  __RTCastToVoid

  __RTDynamicCast

  __RTtypeid

  __STRINGTOLD

  __STRINGTOLD_L

  __TypeMatch

  ___fls_getvalue@4

  ___fls_setvalue@8

  ___lc_codepage_func

  ___lc_collate_cp_func

  ___lc_handle_func

  ___mb_cur_max_func

  ___mb_cur_max_l_func

  ___setlc_active_func

  ___unguarded_readlc_active_add_func

  __argc

  __argv

  __badioinfo

  __clean_type_info_names_internal

  __control87_2

  __create_locale

  __crtCompareStringA

  __crtCompareStringW

  __crtLCMapStringA

  __crtLCMapStringW

  __daylight

  __dllonexit

  __doserrno

  __dstbias

  __fpecode

  __free_locale

  __get_current_locale

  __get_flsindex

  __get_tlsindex

  __getmainargs

  __initenv

  __iob_func

  __isascii

  __iscsym

  __iscsymf

  __iswcsym

  __iswcsymf

  __lconv

  __lconv_init

  __libm_sse2_acos

  __libm_sse2_acosf

  __libm_sse2_asin

  __libm_sse2_asinf

  __libm_sse2_atan

  __libm_sse2_atan2

  __libm_sse2_atanf

  __libm_sse2_cos

  __libm_sse2_cosf

  __libm_sse2_exp

  __libm_sse2_expf

  __libm_sse2_log

  __libm_sse2_log10

  __libm_sse2_log10f

  __libm_sse2_logf

  __libm_sse2_pow

  __libm_sse2_powf

  __libm_sse2_sin

  __libm_sse2_sinf

  __libm_sse2_tan

  __libm_sse2_tanf

  __mb_cur_max

  __p___argc

  __p___argv

  __p___initenv

  __p___mb_cur_max

  __p___wargv

  __p___winitenv

  __p__acmdln

  __p__commode

  __p__daylight

  __p__dstbias

  __p__environ

  __p__fmode

  __p__iob

  __p__mbcasemap

  __p__mbctype

  __p__pctype

  __p__pgmptr

  __p__pwctype

  __p__timezone

  __p__tzname

  __p__wcmdln

  __p__wenviron

  __p__wpgmptr

  __pctype_func

  __pioinfo

  __pwctype_func

  __pxcptinfoptrs

  __report_gsfailure

  __set_app_type

  __set_flsgetvalue

  __setlc_active

  __setusermatherr

  __strncnt

  __swprintf_l

  __sys_errlist

  __sys_nerr

  __threadhandle

  __threadid

  __timezone

  __toascii

  __tzname

  __unDName

  __unDNameEx

  __unDNameHelper

  __uncaught_exception

  __unguarded_readlc_active

  __vswprintf_l

  __wargv

  __wcserror

  __wcserror_s

  __wcsncnt

  __wgetmainargs

  __winitenv

  _abnormal_termination

  _abs64

  _access

  _access_s

  _acmdln

  _aligned_free

  _aligned_malloc

  _aligned_msize

  _aligned_offset_malloc

  _aligned_offset_realloc

  _aligned_offset_recalloc

  _aligned_realloc

  _aligned_recalloc

  _amsg_exit

  _assert

  _atodbl

  _atodbl_l

  _atof_l

  _atoflt

  _atoflt_l

  _atoi64

  _atoi64_l

  _atoi_l

  _atol_l

  _atoldbl

  _atoldbl_l

  _beep

  _beginthread

  _beginthreadex

  _byteswap_uint64

  _byteswap_ulong

  _byteswap_ushort

  _c_exit

  _cabs

  _callnewh

  _calloc_crt

  _cexit

  _cgets

  _cgets_s

  _cgetws

  _cgetws_s

  _chdir

  _chdrive

  _chgsign

  _chkesp

  _chmod

  _chsize

  _chsize_s

  _clearfp

  _close

  _commit

  _commode

  _configthreadlocale

  _control87

  _controlfp

  _controlfp_s

  _copysign

  _cprintf

  _cprintf_l

  _cprintf_p

  Sections

  .text

  Size: 709KB - Virtual size: 708KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• nskbfltr.inf
• nsm_vpro.ini
• pcicapi.dll

  .dll windows x86

  d78463f91aa83e9c39d2e594035ae4bb

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb

  Signer

  Actual PE Digest

  3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc

  Signer

  Actual PE Digest

  9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  GetModuleHandleA

  OutputDebugStringA

  LoadLibraryA

  FreeLibrary

  CloseHandle

  OpenProcess

  GetCurrentProcessId

  CreateEventA

  InterlockedIncrement

  GetVersionExA

  GetLocalTime

  GetTempPathA

  GetCurrentThreadId

  GetTickCount

  GetLastError

  ExitProcess

  SetLastError

  DisableThreadLibraryCalls

  GetModuleFileNameA

  LeaveCriticalSection

  EnterCriticalSection

  SetEvent

  InterlockedDecrement

  WaitForSingleObject

  DeleteCriticalSection

  CreateThread

  InitializeCriticalSection

  QueryPerformanceCounter

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  InterlockedCompareExchange

  InterlockedExchange

  DecodePointer

  EncodePointer

  GetSystemTimeAsFileTime

  Sleep

  IsDBCSLeadByte

  user32

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  MessageBoxA

  KillTimer

  PeekMessageA

  PostQuitMessage

  wvsprintfA

  wsprintfA

  advapi32

  GetTokenInformation

  OpenProcessToken

  msvcr100

  strncpy

  _except_handler4_common

  strrchr

  isdigit

  fclose

  fopen

  strncat

  fputs

  memset

  memcpy

  _malloc_crt

  free

  _encoded_null

  _initterm

  _initterm_e

  _amsg_exit

  __CppXcptFilter

  _crt_debugger_hook

  __clean_type_info_names_internal

  _unlock

  __dllonexit

  _lock

  _onexit

  Exports

  Exports

  CapiClose

  CapiConnected

  CapiDial

  CapiHangup

  CapiListen

  CapiNotify

  CapiOpen

  CapiOpen2

  CapiRead

  CapiSend

  Sections

  .text

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 52KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• remcmdstub.exe

  .exe windows x86

  99c0cd957fc7334714fefa3daa61a6ea

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  ef:61:d3:a3:35:35:25:ab:43:9a:4d:ec:76:a3:86:24:8a:7c:88:7c:b4:33:c7:c9:13:32:88:a1:47:22:6b:2c

  Signer

  Actual PE Digest

  ef:61:d3:a3:35:35:25:ab:43:9a:4d:ec:76:a3:86:24:8a:7c:88:7c:b4:33:c7:c9:13:32:88:a1:47:22:6b:2c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:01

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  34:75:78:92:8b:99:18:cd:b0:19:b2:3d:03:63:f3:20:51:e8:a3:33

  Signer

  Actual PE Digest

  34:75:78:92:8b:99:18:cd:b0:19:b2:3d:03:63:f3:20:51:e8:a3:33

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:01

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LoadLibraryA

  FreeLibrary

  GetProcAddress

  SetLastError

  GetVersionExA

  GetLastError

  GetModuleFileNameA

  WaitForSingleObject

  Sleep

  WriteFile

  GetExitCodeProcess

  GenerateConsoleCtrlEvent

  WaitForMultipleObjects

  CloseHandle

  CreateProcessA

  SetConsoleCtrlHandler

  SetConsoleMode

  GetConsoleMode

  GetStdHandle

  ExpandEnvironmentStringsA

  SetStdHandle

  WriteConsoleW

  HeapSize

  SetFilePointer

  FlushFileBuffers

  GetCommandLineA

  HeapSetInformation

  GetCPInfo

  InterlockedIncrement

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  DecodePointer

  TlsFree

  GetModuleHandleW

  GetCurrentThreadId

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  WideCharToMultiByte

  LCMapStringW

  MultiByteToWideChar

  EnterCriticalSection

  LeaveCriticalSection

  IsProcessorFeaturePresent

  ExitProcess

  GetModuleFileNameW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetStartupInfoW

  DeleteCriticalSection

  HeapCreate

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetStringTypeW

  HeapFree

  HeapAlloc

  RtlUnwind

  LoadLibraryW

  HeapReAlloc

  GetConsoleCP

  CreateFileW

  user32

  EnumWindows

  GetClassNameA

  SendMessageA

  EnumThreadWindows

  Sections

  .text

  Size: 32KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• msvcr100.dll

  .dll windows x86

  5271d5ce8b44dd47bc92563e27585466

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

  Signer

  Actual PE Digest

  8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  11-06-2011 08:50

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  EncodePointer

  DecodePointer

  RaiseException

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleW

  GetProcAddress

  ExitProcess

  WriteFile

  GetStdHandle

  GetCurrentThreadId

  TlsGetValue

  GetCommandLineW

  GetCommandLineA

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  ExitThread

  CloseHandle

  GetLastError

  ResumeThread

  CreateThread

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  InterlockedDecrement

  GetCurrentThread

  FindNextFileA

  FindFirstFileExA

  FindClose

  FindNextFileW

  FindFirstFileExW

  GetLogicalDrives

  GetDiskFreeSpaceA

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  SetErrorMode

  Sleep

  Beep

  GetFileAttributesA

  SetFileAttributesA

  SetEnvironmentVariableA

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetFullPathNameA

  GetDriveTypeW

  GetCurrentProcessId

  CreateDirectoryA

  MoveFileA

  RemoveDirectoryA

  GetDriveTypeA

  DeleteFileA

  GetFileAttributesW

  SetEnvironmentVariableW

  SetFileAttributesW

  GetFullPathNameW

  CreateDirectoryW

  MoveFileW

  RemoveDirectoryW

  DeleteFileW

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessA

  LoadLibraryA

  FreeLibrary

  CreateProcessW

  ReadFile

  DuplicateHandle

  GetCurrentProcess

  GetSystemTimeAsFileTime

  GetTimeZoneInformation

  GetLocalTime

  WideCharToMultiByte

  SetFileTime

  LocalFileTimeToFileTime

  SystemTimeToFileTime

  SetLocalTime

  InterlockedPopEntrySList

  InterlockedFlushSList

  QueryDepthSList

  InterlockedPushEntrySList

  CreateTimerQueue

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  SetEvent

  CreateEventW

  SwitchToThread

  SignalObjectAndWait

  TryEnterCriticalSection

  GetTickCount

  VirtualFree

  GetVersionExW

  SetThreadPriority

  VirtualAlloc

  GetSystemInfo

  GetProcessAffinityMask

  VirtualProtect

  SetThreadAffinityMask

  InitializeSListHead

  ReleaseSemaphore

  CreateSemaphoreW

  WaitForMultipleObjects

  GetThreadPriority

  LoadLibraryW

  SleepEx

  OutputDebugStringW

  FreeLibraryAndExitThread

  GetModuleHandleA

  GetThreadTimes

  DebugBreak

  MultiByteToWideChar

  GetStringTypeW

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  GetTimeFormatA

  GetDateFormatA

  GetTimeFormatW

  GetDateFormatW

  RtlUnwind

  HeapAlloc

  HeapFree

  HeapCreate

  HeapDestroy

  HeapQueryInformation

  HeapReAlloc

  HeapSize

  HeapValidate

  HeapCompact

  HeapWalk

  VirtualQuery

  SetHandleCount

  GetFileType

  GetStartupInfoW

  GetFileInformationByHandle

  PeekNamedPipe

  CreateFileA

  CreateFileW

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  CreatePipe

  SetStdHandle

  ReadConsoleInputA

  SetConsoleMode

  PeekConsoleInputA

  GetNumberOfConsoleInputEvents

  ReadConsoleInputW

  WriteConsoleW

  ReadConsoleW

  SetEndOfFile

  GetProcessHeap

  InterlockedExchange

  LockFile

  UnlockFile

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  SetConsoleCtrlHandler

  GetLocaleInfoW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  LCMapStringW

  CompareStringW

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  IsProcessorFeaturePresent

  Exports

  Exports

  $I10_OUTPUT

  ??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z

  ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z

  ??0SchedulerPolicy@Concurrency@@QAA@IZZ

  ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z

  ??0SchedulerPolicy@Concurrency@@QAE@XZ

  ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantLock@details@Concurrency@@QAE@XZ

  ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z

  ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z

  ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z

  ??0_TaskCollection@details@Concurrency@@QAE@XZ

  ??0_Timer@details@Concurrency@@IAE@I_N@Z

  ??0__non_rtti_object@std@@QAE@ABV01@@Z

  ??0__non_rtti_object@std@@QAE@PBD@Z

  ??0bad_cast@std@@AAE@PBQBD@Z

  ??0bad_cast@std@@QAE@ABV01@@Z

  ??0bad_cast@std@@QAE@PBD@Z

  ??0bad_target@Concurrency@@QAE@PBD@Z

  ??0bad_target@Concurrency@@QAE@XZ

  ??0bad_typeid@std@@QAE@ABV01@@Z

  ??0bad_typeid@std@@QAE@PBD@Z

  ??0context_self_unblock@Concurrency@@QAE@PBD@Z

  ??0context_self_unblock@Concurrency@@QAE@XZ

  ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z

  ??0context_unblock_unbalanced@Concurrency@@QAE@XZ

  ??0critical_section@Concurrency@@QAE@XZ

  ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z

  ??0default_scheduler_exists@Concurrency@@QAE@XZ

  ??0event@Concurrency@@QAE@XZ

  ??0exception@std@@QAE@ABQBD@Z

  ??0exception@std@@QAE@ABQBDH@Z

  ??0exception@std@@QAE@ABV01@@Z

  ??0exception@std@@QAE@XZ

  ??0improper_lock@Concurrency@@QAE@PBD@Z

  ??0improper_lock@Concurrency@@QAE@XZ

  ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_attach@Concurrency@@QAE@XZ

  ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_detach@Concurrency@@QAE@XZ

  ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z

  ??0improper_scheduler_reference@Concurrency@@QAE@XZ

  ??0invalid_link_target@Concurrency@@QAE@PBD@Z

  ??0invalid_link_target@Concurrency@@QAE@XZ

  ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z

  ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ

  ??0invalid_operation@Concurrency@@QAE@PBD@Z

  ??0invalid_operation@Concurrency@@QAE@XZ

  ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z

  ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ

  ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z

  ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ

  ??0message_not_found@Concurrency@@QAE@PBD@Z

  ??0message_not_found@Concurrency@@QAE@XZ

  ??0missing_wait@Concurrency@@QAE@PBD@Z

  ??0missing_wait@Concurrency@@QAE@XZ

  ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z

  ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ

  ??0operation_timed_out@Concurrency@@QAE@PBD@Z

  ??0operation_timed_out@Concurrency@@QAE@XZ

  ??0reader_writer_lock@Concurrency@@QAE@XZ

  ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z

  ??0scheduler_not_attached@Concurrency@@QAE@XZ

  ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z

  ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z

  ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z

  ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z

  ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z

  ??0task_canceled@details@Concurrency@@QAE@PBD@Z

  ??0task_canceled@details@Concurrency@@QAE@XZ

  ??0unsupported_os@Concurrency@@QAE@PBD@Z

  ??0unsupported_os@Concurrency@@QAE@XZ

  ??1SchedulerPolicy@Concurrency@@QAE@XZ

  ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ

  ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ

  ??1_SpinLock@details@Concurrency@@QAE@XZ

  ??1_TaskCollection@details@Concurrency@@QAE@XZ

  ??1_Timer@details@Concurrency@@IAE@XZ

  ??1__non_rtti_object@std@@UAE@XZ

  ??1bad_cast@std@@UAE@XZ

  ??1bad_typeid@std@@UAE@XZ

  ??1critical_section@Concurrency@@QAE@XZ

  ??1event@Concurrency@@QAE@XZ

  ??1exception@std@@UAE@XZ

  ??1reader_writer_lock@Concurrency@@QAE@XZ

  ??1scoped_lock@critical_section@Concurrency@@QAE@XZ

  ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ

  ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ

  ??1type_info@@UAE@XZ

  ??2@YAPAXI@Z

  ??2@YAPAXIHPBDH@Z

  ??3@YAXPAX@Z

  ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z

  ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z

  ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z

  ??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z

  ??4bad_cast@std@@QAEAAV01@ABV01@@Z

  ??4bad_typeid@std@@QAEAAV01@ABV01@@Z

  ??4exception@std@@QAEAAV01@ABV01@@Z

  ??8type_info@@QBE_NABV0@@Z

  ??9type_info@@QBE_NABV0@@Z

  ??_7__non_rtti_object@std@@6B@

  ??_7bad_cast@std@@6B@

  ??_7bad_typeid@std@@6B@

  ??_7exception@@6B@

  ??_7exception@std@@6B@

  ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ

  ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ

  ??_Fbad_cast@std@@QAEXXZ

  ??_Fbad_typeid@std@@QAEXXZ

  ??_U@YAPAXI@Z

  ??_U@YAPAXIHPBDH@Z

  ??_V@YAXPAX@Z

  ?Alloc@Concurrency@@YAPAXI@Z

  ?Block@Context@Concurrency@@SAXXZ

  ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z

  ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z

  ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ

  ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ

  ?CurrentContext@Context@Concurrency@@SAPAV12@XZ

  ?Detach@CurrentScheduler@Concurrency@@SAXXZ

  ?DisableTracing@Concurrency@@YAJXZ

  ?EnableTracing@Concurrency@@YAJXZ

  ?Free@Concurrency@@YAXPAX@Z

  ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ

  ?GetExecutionContextId@Concurrency@@YAIXZ

  ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ

  ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ

  ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ

  ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z

  ?GetProcessorCount@Concurrency@@YAIXZ

  ?GetProcessorNodeCount@Concurrency@@YAIXZ

  ?GetSchedulerId@Concurrency@@YAIXZ

  ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ

  ?Id@Context@Concurrency@@SAIXZ

  ?Id@CurrentScheduler@Concurrency@@SAIXZ

  ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ

  ?Log2@details@Concurrency@@YAKI@Z

  ?Oversubscribe@Context@Concurrency@@SAX_N@Z

  ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z

  ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ

  ?ScheduleGroupId@Context@Concurrency@@SAIXZ

  ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z

  ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z

  ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z

  ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z

  ?VirtualProcessorId@Context@Concurrency@@SAIXZ

  ?Yield@Context@Concurrency@@SAXXZ

  ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ

  ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z

  ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ

  ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z

  ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ

  ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ

  ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ

  ?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z

  ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z

  ?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ

  ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ

  ?_Copy_str@exception@std@@AAEXPBD@Z

  ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ

  ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ

  ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ

  ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ

  ?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z

  ?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z

  ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ

  ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ

  ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ

  ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ

  ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ

  ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ

  ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ

  ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z

  ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z

  ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z

  ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z

  ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z

  ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z

  ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ

  ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ

  ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ

  ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ

  ?_SpinYield@Context@Concurrency@@SAXXZ

  ?_Start@_Timer@details@Concurrency@@IAEXXZ

  ?_Stop@_Timer@details@Concurrency@@IAEXXZ

  ?_Tidy@exception@std@@AAEXXZ

  ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z

  ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ

  ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ

  ?_Type_info_dtor@type_info@@CAXPAV1@@Z

  ?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z

  ?_UnderlyingYield@details@Concurrency@@YAXXZ

  ?_ValidateExecute@@YAHP6GHXZ@Z

  ?_ValidateRead@@YAHPBXI@Z

  ?_ValidateWrite@@YAHPAXI@Z

  ?_Value@_SpinCount@details@Concurrency@@SAIXZ

  ?__ExceptionPtrAssign@@YAXPAXPBX@Z

  ?__ExceptionPtrCompare@@YA_NPBX0@Z

  ?__ExceptionPtrCopy@@YAXPAXPBX@Z

  ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z

  ?__ExceptionPtrCreate@@YAXPAX@Z

  ?__ExceptionPtrCurrentException@@YAXPAX@Z

  ?__ExceptionPtrDestroy@@YAXPAX@Z

  ?__ExceptionPtrRethrow@@YAXPBX@Z

  ?_inconsistency@@YAXXZ

  ?_invalid_parameter@@YAXPBG00II@Z

  ?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z

  ?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z

  ?_open@@YAHPBDHH@Z

  ?_query_new_handler@@YAP6AHI@ZXZ

  ?_query_new_mode@@YAHXZ

  ?_set_new_handler@@YAP6AHI@ZH@Z

  ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

  ?_set_new_mode@@YAHH@Z

  ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z

  ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

  ?_sopen@@YAHPBDHHH@Z

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  ?_wopen@@YAHPB_WHH@Z

  ?_wsopen@@YAHPB_WHHH@Z

  ?before@type_info@@QBEHABV1@@Z

  ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ

  ?lock@critical_section@Concurrency@@QAEXXZ

  ?lock@reader_writer_lock@Concurrency@@QAEXXZ

  ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ

  ?name@type_info@@QBEPBDPAU__type_info_node@@@Z

  ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ

  ?raw_name@type_info@@QBEPBDXZ

  ?reset@event@Concurrency@@QAEXXZ

  ?set@event@Concurrency@@QAEXXZ

  ?set_new_handler@@YAP6AXXZP6AXXZ@Z

  ?set_terminate@@YAP6AXXZH@Z

  ?set_terminate@@YAP6AXXZP6AXXZ@Z

  ?set_unexpected@@YAP6AXXZH@Z

  ?set_unexpected@@YAP6AXXZP6AXXZ@Z

  ?swprintf@@YAHPAGIPBGZZ

  ?swprintf@@YAHPA_WIPB_WZZ

  ?terminate@@YAXXZ

  ?try_lock@critical_section@Concurrency@@QAE_NXZ

  ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ

  ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ

  ?unexpected@@YAXXZ

  ?unlock@critical_section@Concurrency@@QAEXXZ

  ?unlock@reader_writer_lock@Concurrency@@QAEXXZ

  ?vswprintf@@YAHPA_WIPB_WPAD@Z

  ?wait@Concurrency@@YAXI@Z

  ?wait@event@Concurrency@@QAEII@Z

  ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z

  ?what@exception@std@@UBEPBDXZ

  _CIacos

  _CIasin

  _CIatan

  _CIatan2

  _CIcos

  _CIcosh

  _CIexp

  _CIfmod

  _CIlog

  _CIlog10

  _CIpow

  _CIsin

  _CIsinh

  _CIsqrt

  _CItan

  _CItanh

  _CRT_RTC_INIT

  _CRT_RTC_INITW

  _CreateFrameInfo

  _CxxThrowException

  _EH_prolog

  _FindAndUnlinkFrame

  _Getdays

  _Getmonths

  _Gettnames

  _HUGE

  _IsExceptionObjectToBeDestroyed

  _NLG_Dispatch2

  _NLG_Return

  _NLG_Return2

  _Strftime

  _XcptFilter

  __AdjustPointer

  __BuildCatchObject

  __BuildCatchObjectHelper

  __CppXcptFilter

  __CxxCallUnwindDelDtor

  __CxxCallUnwindDtor

  __CxxCallUnwindStdDelDtor

  __CxxCallUnwindVecDtor

  __CxxDetectRethrow

  __CxxExceptionFilter

  __CxxFrameHandler

  __CxxFrameHandler2

  __CxxFrameHandler3

  __CxxLongjmpUnwind

  __CxxQueryExceptionSize

  __CxxRegisterExceptionObject

  __CxxUnregisterExceptionObject

  __DestructExceptionObject

  __FrameUnwindFilter

  __RTCastToVoid

  __RTDynamicCast

  __RTtypeid

  __STRINGTOLD

  __STRINGTOLD_L

  __TypeMatch

  ___fls_getvalue@4

  ___fls_setvalue@8

  ___lc_codepage_func

  ___lc_collate_cp_func

  ___lc_handle_func

  ___mb_cur_max_func

  ___mb_cur_max_l_func

  ___setlc_active_func

  ___unguarded_readlc_active_add_func

  __argc

  __argv

  __badioinfo

  __clean_type_info_names_internal

  __control87_2

  __create_locale

  __crtCompareStringA

  __crtCompareStringW

  __crtLCMapStringA

  __crtLCMapStringW

  __daylight

  __dllonexit

  __doserrno

  __dstbias

  __fpecode

  __free_locale

  __get_current_locale

  __get_flsindex

  __get_tlsindex

  __getmainargs

  __initenv

  __iob_func

  __isascii

  __iscsym

  __iscsymf

  __iswcsym

  __iswcsymf

  __lconv

  __lconv_init

  __libm_sse2_acos

  __libm_sse2_acosf

  __libm_sse2_asin

  __libm_sse2_asinf

  __libm_sse2_atan

  __libm_sse2_atan2

  __libm_sse2_atanf

  __libm_sse2_cos

  __libm_sse2_cosf

  __libm_sse2_exp

  __libm_sse2_expf

  __libm_sse2_log

  __libm_sse2_log10

  __libm_sse2_log10f

  __libm_sse2_logf

  __libm_sse2_pow

  __libm_sse2_powf

  __libm_sse2_sin

  __libm_sse2_sinf

  __libm_sse2_tan

  __libm_sse2_tanf

  __mb_cur_max

  __p___argc

  __p___argv

  __p___initenv

  __p___mb_cur_max

  __p___wargv

  __p___winitenv

  __p__acmdln

  __p__commode

  __p__daylight

  __p__dstbias

  __p__environ

  __p__fmode

  __p__iob

  __p__mbcasemap

  __p__mbctype

  __p__pctype

  __p__pgmptr

  __p__pwctype

  __p__timezone

  __p__tzname

  __p__wcmdln

  __p__wenviron

  __p__wpgmptr

  __pctype_func

  __pioinfo

  __pwctype_func

  __pxcptinfoptrs

  __report_gsfailure

  __set_app_type

  __set_flsgetvalue

  __setlc_active

  __setusermatherr

  __strncnt

  __swprintf_l

  __sys_errlist

  __sys_nerr

  __threadhandle

  __threadid

  __timezone

  __toascii

  __tzname

  __unDName

  __unDNameEx

  __unDNameHelper

  __uncaught_exception

  __unguarded_readlc_active

  __vswprintf_l

  __wargv

  __wcserror

  __wcserror_s

  __wcsncnt

  __wgetmainargs

  __winitenv

  _abnormal_termination

  _abs64

  _access

  _access_s

  _acmdln

  _aligned_free

  _aligned_malloc

  _aligned_msize

  _aligned_offset_malloc

  _aligned_offset_realloc

  _aligned_offset_recalloc

  _aligned_realloc

  _aligned_recalloc

  _amsg_exit

  _assert

  _atodbl

  _atodbl_l

  _atof_l

  _atoflt

  _atoflt_l

  _atoi64

  _atoi64_l

  _atoi_l

  _atol_l

  _atoldbl

  _atoldbl_l

  _beep

  _beginthread

  _beginthreadex

  _byteswap_uint64

  _byteswap_ulong

  _byteswap_ushort

  _c_exit

  _cabs

  _callnewh

  _calloc_crt

  _cexit

  _cgets

  _cgets_s

  _cgetws

  _cgetws_s

  _chdir

  _chdrive

  _chgsign

  _chkesp

  _chmod

  _chsize

  _chsize_s

  _clearfp

  _close

  _commit

  _commode

  _configthreadlocale

  _control87

  _controlfp

  _controlfp_s

  _copysign

  _cprintf

  _cprintf_l

  _cprintf_p

  Sections

  .text

  Size: 709KB - Virtual size: 708KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• nskbfltr.inf
• nsm_vpro.ini
• pcicapi.dll

  .dll windows x86

  d78463f91aa83e9c39d2e594035ae4bb

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb

  Signer

  Actual PE Digest

  3d:b6:09:02:28:e8:91:ba:e3:c0:b6:7b:de:e7:37:ed:39:79:47:84:74:cf:7c:5d:2d:36:3d:d8:2c:05:0b:fb

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc

  Signer

  Actual PE Digest

  9c:33:79:f7:f1:bd:90:f4:a1:94:37:e4:f2:5a:58:25:b4:bb:94:cc

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:07

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  GetModuleHandleA

  OutputDebugStringA

  LoadLibraryA

  FreeLibrary

  CloseHandle

  OpenProcess

  GetCurrentProcessId

  CreateEventA

  InterlockedIncrement

  GetVersionExA

  GetLocalTime

  GetTempPathA

  GetCurrentThreadId

  GetTickCount

  GetLastError

  ExitProcess

  SetLastError

  DisableThreadLibraryCalls

  GetModuleFileNameA

  LeaveCriticalSection

  EnterCriticalSection

  SetEvent

  InterlockedDecrement

  WaitForSingleObject

  DeleteCriticalSection

  CreateThread

  InitializeCriticalSection

  QueryPerformanceCounter

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  InterlockedCompareExchange

  InterlockedExchange

  DecodePointer

  EncodePointer

  GetSystemTimeAsFileTime

  Sleep

  IsDBCSLeadByte

  user32

  GetMessageA

  TranslateMessage

  DispatchMessageA

  SetTimer

  MessageBoxA

  KillTimer

  PeekMessageA

  PostQuitMessage

  wvsprintfA

  wsprintfA

  advapi32

  GetTokenInformation

  OpenProcessToken

  msvcr100

  strncpy

  _except_handler4_common

  strrchr

  isdigit

  fclose

  fopen

  strncat

  fputs

  memset

  memcpy

  _malloc_crt

  free

  _encoded_null

  _initterm

  _initterm_e

  _amsg_exit

  __CppXcptFilter

  _crt_debugger_hook

  __clean_type_info_names_internal

  _unlock

  __dllonexit

  _lock

  _onexit

  Exports

  Exports

  CapiClose

  CapiConnected

  CapiDial

  CapiHangup

  CapiListen

  CapiNotify

  CapiOpen

  CapiOpen2

  CapiRead

  CapiSend

  Sections

  .text

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 52KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• remcmdstub.exe

  .exe windows x86

  99c0cd957fc7334714fefa3daa61a6ea

  
  

  Code Sign

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2a:7c:96:b4:a7:61:a9:74:76:06:bd:10:56:00:3d:49

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  12-01-2016 00:00

  Not After

  21-09-2017 23:59

  Subject

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  ef:61:d3:a3:35:35:25:ab:43:9a:4d:ec:76:a3:86:24:8a:7c:88:7c:b4:33:c7:c9:13:32:88:a1:47:22:6b:2c

  Signer

  Actual PE Digest

  ef:61:d3:a3:35:35:25:ab:43:9a:4d:ec:76:a3:86:24:8a:7c:88:7c:b4:33:c7:c9:13:32:88:a1:47:22:6b:2c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:01

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  34:75:78:92:8b:99:18:cd:b0:19:b2:3d:03:63:f3:20:51:e8:a3:33

  Signer

  Actual PE Digest

  34:75:78:92:8b:99:18:cd:b0:19:b2:3d:03:63:f3:20:51:e8:a3:33

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  07-12-2016 08:01

  Valid: true

  Chain 1

  CN=NetSupport Ltd,O=NetSupport Ltd,L=Peterborough,ST=Cambridgeshire,C=GB

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LoadLibraryA

  FreeLibrary

  GetProcAddress

  SetLastError

  GetVersionExA

  GetLastError

  GetModuleFileNameA

  WaitForSingleObject

  Sleep

  WriteFile

  GetExitCodeProcess

  GenerateConsoleCtrlEvent

  WaitForMultipleObjects

  CloseHandle

  CreateProcessA

  SetConsoleCtrlHandler

  SetConsoleMode

  GetConsoleMode

  GetStdHandle

  ExpandEnvironmentStringsA

  SetStdHandle

  WriteConsoleW

  HeapSize

  SetFilePointer

  FlushFileBuffers

  GetCommandLineA

  HeapSetInformation

  GetCPInfo

  InterlockedIncrement

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  DecodePointer

  TlsFree

  GetModuleHandleW

  GetCurrentThreadId

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  TerminateProcess

  GetCurrentProcess

  WideCharToMultiByte

  LCMapStringW

  MultiByteToWideChar

  EnterCriticalSection

  LeaveCriticalSection

  IsProcessorFeaturePresent

  ExitProcess

  GetModuleFileNameW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  GetStartupInfoW

  DeleteCriticalSection

  HeapCreate

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  GetStringTypeW

  HeapFree

  HeapAlloc

  RtlUnwind

  LoadLibraryW

  HeapReAlloc

  GetConsoleCP

  CreateFileW

  user32

  EnumWindows

  GetClassNameA

  SendMessageA

  EnumThreadWindows

  Sections

  .text

  Size: 32KB - Virtual size: 32KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ