WSAppBak[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

WSAppBak.rar
Size

39.5MB
MD5

fe199e28341533cdaff793d252a66b27
SHA1

7c36be0f3c551b98b4341b49e62e0fed8e8cc298
SHA256

08269cb552ea11d0c9bc372317c75ecd9f98c3c0655134914b8ad070c75e8bcc
SHA512

28266c82bebf7947d02e1d028615b7accc4d165b782686fbd246f6945ded4458d6c81aee13bd435e672d0870fc0a02de2be0a1d3ac432b0f5991f101684fb814
SSDEEP

786432:SbuEnnbMDlREZQ8S7MqlMLKSPuU5T8jvbJoP+4ei0L1eGKAN:SBMDMu8sMqeLKSPuAKm+hitCN

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WSAppBak/WSAppBak.exe
unpack001/WSAppBak/WSAppPkgIns.exe

Files

WSAppBak.rar
.rar
WSAppBak/Dependencies x64/Microsoft.Media.PlayReadyClient_2.11.2154.0_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.Media.PlayReadyClient_2.2.8.1947.0_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.Media.PlayReadyClient_2.3.1678.1_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.VCLibs.110.00_11.0.51106.1_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.VCLibs.120.00_12.0.20222.2_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.VCLibs.120.00_12.0.21005.1_x64.appx
.appx
WSAppBak/Dependencies x64/Microsoft.VCLibs.140.00_14.0.23816.0_x86__8wekyb3d8bbwe.Appx
.appx
WSAppBak/Dependencies x64/Microsoft.WinJS.2.0_1.0.9385.3.appx
.appx
WSAppBak/Dependencies x64/Microsoft.WinJS.2.0_1.0.9600.16408.appx
.appx
WSAppBak/Dependencies x64/Microsoft.WinJs1.0_1.0.9200.20602.appx
.appx
WSAppBak/Dependencies x86/Microsoft.Media.PlayReadyClient_2.11.2154.0_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.Media.PlayReadyClient_2.3.1678.1_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.Media.PlayReadyClient_2_2.8.1947.0_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.VCLibs.110.00_11.0.51106.1_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.VCLibs_120.00_12.0.20222.2_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.VCLibs_120.00_12.0.21005.1_x86.appx
.appx
WSAppBak/Dependencies x86/Microsoft.WinJS.2.0_1.0.9385.3.appx
.appx
WSAppBak/Dependencies x86/Microsoft.WinJS.2.0_1.0.9600.16408.appx
.appx
WSAppBak/Dependencies x86/Microsoft.WinJs1.0_1.0.9200.20602.appx
.appx
WSAppBak/How to use.mp4
WSAppBak/How to use.txt
WSAppBak/WSAppBak.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/MakeAppx.exe.manifest
.xml
WSAppBak/WSAppBak/Microsoft.Diagnostics.Tracing.EventSource.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:76:e1:db:8b:99:1d:c0:a0:de:be:a0:7d:0a:0f:4f:34:a8:77:c3:6d:79:55:c2:1a:13:ba:4e:58:25:25:88
Signer

Actual PE Digest

f6:76:e1:db:8b:99:1d:c0:a0:de:be:a0:7d:0a:0f:4f:34:a8:77:c3:6d:79:55:c2:1a:13:ba:4e:58:25:25:88

Digest Algorithm

sha256

PE Digest Matches

true

d4:53:03:5e:5d:f2:21:eb:b0:46:22:aa:75:88:e4:16:c0:14:f9:ac
Signer

Actual PE Digest

d4:53:03:5e:5d:f2:21:eb:b0:46:22:aa:75:88:e4:16:c0:14:f9:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/Microsoft.Windows.Build.Appx.AppxPackaging.dll.manifest
.xml
WSAppBak/WSAppBak/Microsoft.Windows.Build.Appx.AppxSip.dll.manifest
.xml
WSAppBak/WSAppBak/Microsoft.Windows.Build.Appx.OpcServices.dll.manifest
.xml
WSAppBak/WSAppBak/Microsoft.Windows.Build.Signing.mssign32.dll.manifest
WSAppBak/WSAppBak/Microsoft.Windows.Build.Signing.wintrust.dll.manifest
WSAppBak/WSAppBak/ProvisioningTestHelper.psd1
WSAppBak/WSAppBak/appxpackaging.dll
.dll windows x86

ca784e846e3b5a6a8c817fe6274fce20

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:ca:c7:cd:e7:8b:11:3d:be:e9:86:82:8b:3f:c8:6d:42:6a:15:0a:e6:14:1a:49:4a:80:4f:6f:e3:9a:3e:88
Signer

Actual PE Digest

5d:ca:c7:cd:e7:8b:11:3d:be:e9:86:82:8b:3f:c8:6d:42:6a:15:0a:e6:14:1a:49:4a:80:4f:6f:e3:9a:3e:88

Digest Algorithm

sha256

PE Digest Matches

true

6a:3a:77:89:35:da:c3:74:0c:c1:9c:6b:0e:77:d1:a7:2a:7c:45:c5
Signer

Actual PE Digest

6a:3a:77:89:35:da:c3:74:0c:c1:9c:6b:0e:77:d1:a7:2a:7c:45:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlEnumerateGenericTableWithoutSplayingAvl
NtQuerySystemInformation
RtlConvertSidToUnicodeString
RtlFreeHeap
RtlAllocateHeap
RtlFreeUnicodeString
wcschr
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
memmove
_wcsicmp
RtlDeleteElementGenericTableAvl
RtlNumberGenericTableElementsAvl
wcsrchr
_vsnwprintf
RtlInitializeBitMap
RtlClearAllBits
RtlSetBits
RtlNtStatusToDosError
memcpy_s
_wcsupr
RtlAllocateAndInitializeSid
RtlDowncaseUnicodeString
RtlInitUnicodeString
RtlFreeSid
wcsstr
qsort
RtlIsGenericTableEmptyAvl
memcmp
memcpy
memset
wcsncmp
RtlUnwind

kernel32

CompareStringOrdinal
GetLastError
CloseHandle
GetCurrentThread
DebugBreak
LoadLibraryExW
GetProcAddress
FreeLibrary
GetTempPathW
GetModuleHandleW
GetFileAttributesW
CreateDirectoryW
FormatMessageW
LocalFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
DecodePointer
AcquireSRWLockExclusive
FindStringOrdinal
SizeofResource
LoadResource
FindResourceW
DelayLoadFailureHook
LoadLibraryExA
CreateFileW
WideCharToMultiByte
GetFullPathNameW
VirtualFree
VirtualAlloc
GetSystemTime
DeleteFileA
DeleteFileW
ReleaseSRWLockExclusive
RaiseException
LockResource
CompareStringEx
DosDateTimeToFileTime
CompareStringA
CompareStringW
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
GetEnvironmentVariableW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RevertToSelf
ImpersonateLoggedOnUser
OpenThreadToken
EventWrite
EventUnregister
EventRegister

ole32

CoGetMalloc
CoInitializeEx
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

GetErrorInfo
SysFreeString
SysAllocStringLen
CreateErrorInfo
SysAllocString
SysStringLen
VariantInit
SetErrorInfo

opcservices

ord9
ord12
ord15
ord16
ord8
ord7
ord4
ord10
ord11

urlmon

CreateUri

xmllite

CreateXmlReader

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 382KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/appxsip.dll
.dll regsvr32 windows x86

d76858137b19e149cea001d45d4f920b

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:4b:28:95:7a:b6:a6:55:8b:30:88:9a:85:4b:75:e1:c2:b3:7a:c8:dd:ce:d7:3b:93:cc:09:b8:28:c9:5d:a1
Signer

Actual PE Digest

ed:4b:28:95:7a:b6:a6:55:8b:30:88:9a:85:4b:75:e1:c2:b3:7a:c8:dd:ce:d7:3b:93:cc:09:b8:28:c9:5d:a1

Digest Algorithm

sha256

PE Digest Matches

true

dc:77:83:4c:42:4f:4b:84:db:a9:4b:4b:5e:83:61:29:f5:b7:08:fa
Signer

Actual PE Digest

dc:77:83:4c:42:4f:4b:84:db:a9:4b:4b:5e:83:61:29:f5:b7:08:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
_vsnwprintf
RtlNtStatusToDosError
memmove
memcpy_s
swprintf_s
qsort
RtlNumberGenericTableElementsAvl
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
wcsrchr
RtlFreeHeap
RtlAllocateHeap
memcmp
memcpy
memset

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemAlloc

oleaut32

SysStringLen
SysFreeString
SysAllocString

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetProcessHeap
MoveFileExW
GetSystemTimeAsFileTime
CompareStringA
DosDateTimeToFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
CloseHandle
SetLastError
DeleteFileW
GetEnvironmentVariableW
GetStdHandle
WideCharToMultiByte
WriteFile
FormatMessageW
LocalFree
CompareStringW
DeleteFileA
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetProcAddress
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLocalTime
SystemTimeToFileTime
GetLastError
RaiseException
ReplaceFileW
CompareStringOrdinal
GetTempPathW
GetFileAttributesW
CompareStringEx
CreateFileW
HeapAlloc
HeapFree
FileTimeToDosDateTime
CopyFileW

advapi32

EventUnregister
EventWrite
RegGetValueW
EventRegister

crypt32

CryptMsgClose
CertFreeCertificateContext
CertNameToStrW
CertGetSubjectCertificateFromStore
CryptMsgGetParam
CryptEncodeObject
CryptSIPRemoveProvider
CryptSIPAddProvider
CryptQueryObject
CryptFindOIDInfo
CertCloseStore

opcservices

ord15
ord12
ord16

shlwapi

SHCreateStreamOnFileEx

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

Exports

Exports

AppxBundleSipCreateIndirectData
AppxBundleSipGetSignedDataMsg
AppxBundleSipIsFileSupportedName
AppxBundleSipPutSignedDataMsg
AppxBundleSipRemoveSignedDataMsg
AppxBundleSipVerifyIndirectData
AppxSipCreateIndirectData
AppxSipGetSignedDataMsg
AppxSipIsFileSupportedName
AppxSipPutSignedDataMsg
AppxSipRemoveSignedDataMsg
AppxSipVerifyIndirectData
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
EappxBundleSipCreateIndirectData
EappxBundleSipGetSignedDataMsg
EappxBundleSipIsFileSupportedName
EappxBundleSipPutSignedDataMsg
EappxBundleSipRemoveSignedDataMsg
EappxBundleSipVerifyIndirectData
EappxSipCreateIndirectData
EappxSipGetSignedDataMsg
EappxSipIsFileSupportedName
EappxSipPutSignedDataMsg
EappxSipRemoveSignedDataMsg
EappxSipVerifyIndirectData
P7xSipCreateIndirectData
P7xSipGetSignedDataMsg
P7xSipIsFileSupportedName
P7xSipPutSignedDataMsg
P7xSipRemoveSignedDataMsg
P7xSipVerifyIndirectData

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/makeappx.exe
.exe windows x86

676ce12eb6c11167eb6751af9e9bfb08

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:62:da:89:e6:0f:81:7a:24:89:e2:c0:3c:58:bb:3c:2e:1c:92:d2:22:64:5c:70:17:83:73:79:3d:6e:57:61
Signer

Actual PE Digest

9e:62:da:89:e6:0f:81:7a:24:89:e2:c0:3c:58:bb:3c:2e:1c:92:d2:22:64:5c:70:17:83:73:79:3d:6e:57:61

Digest Algorithm

sha256

PE Digest Matches

true

f4:a2:61:a3:fa:7f:b4:13:d2:81:df:36:fd:2b:47:f9:c2:7a:1b:be
Signer

Actual PE Digest

f4:a2:61:a3:fa:7f:b4:13:d2:81:df:36:fd:2b:47:f9:c2:7a:1b:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

IsTextUnicode

kernel32

FormatMessageW
GetLastError
LocalFree
CompareStringOrdinal
CompareStringEx
CloseHandle
CreateFileW
ReadFile
SetFilePointer
MultiByteToWideChar
GetFileAttributesW
HeapSetInformation
MoveFileExW
DeleteFileW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetFileAttributesExW
DelayLoadFailureHook
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
SetStdHandle
VirtualQuery
VirtualProtect
GetSystemInfo
FlushFileBuffers
LCMapStringA
GetVersionExA
RaiseException
GetConsoleCP
GetConsoleMode
ReadConsoleInputA
ReadConsoleInputW
SetConsoleMode
SetUnhandledExceptionFilter
SetLastError
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
ExitProcess
GetStdHandle
WriteFile
GetModuleFileNameA
HeapCreate
HeapFree
VirtualFree
GetFileType
DeleteCriticalSection
GetStartupInfoA
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleA
WriteConsoleW
CreateFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LCMapStringW
Sleep
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
HeapAlloc
HeapReAlloc
VirtualAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
GetErrorInfo
SysAllocString

ntdll

RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlDeleteElementGenericTableAvl
RtlUnwind
RtlFreeHeap
RtlAllocateHeap
RtlEnumerateGenericTableWithoutSplayingAvl

urlmon

CreateUri

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/makecert.exe
.exe windows x86

354a583c3440cd01d72ba52a484a1534

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:55:2b:96:a6:f4:49:67:5d:7b:27:0a:2a:1b:c7:87:33:0f:19:96:9c:82:27:5e:95:0b:c9:31:e4:5a:3d:2d
Signer

Actual PE Digest

9f:55:2b:96:a6:f4:49:67:5d:7b:27:0a:2a:1b:c7:87:33:0f:19:96:9c:82:27:5e:95:0b:c9:31:e4:5a:3d:2d

Digest Algorithm

sha256

PE Digest Matches

true

40:b9:19:b4:9f:8c:e3:c0:40:11:34:39:55:fa:71:91:fd:13:d6:ef
Signer

Actual PE Digest

40:b9:19:b4:9f:8c:e3:c0:40:11:34:39:55:fa:71:91:fd:13:d6:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptAcquireContextA
CryptGetProvParam
CryptGenKey
CryptDestroyKey
CryptGetUserKey

kernel32

LocalAlloc
MultiByteToWideChar
CreateFileW
CreateFileMappingA
WideCharToMultiByte
WriteFile
MapViewOfFile
GetFileSize
GetTickCount
GetLastError
SetLastError
GetProcAddress
SizeofResource
GetSystemTimeAsFileTime
GetProcessHeap
CompareFileTime
LoadLibraryA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
FindResourceA
FreeResource
UnmapViewOfFile
FreeLibrary
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
LocalFree
DeleteFileW
FileTimeToLocalFileTime
CloseHandle
HeapSetInformation
GetModuleHandleA
LockResource
FileTimeToSystemTime

msvcrt

memset
_ftol2_sse
memcmp
memcpy
strtok
_wtol
free
malloc
_callnewh
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
_wcsicmp
_wcsnicmp
wprintf
_vsnwprintf
vwprintf
_ftol2

mssign32

SignError
FreeCryptProvFromCert
PvkPrivateKeySave
PvkFreeCryptProv
PvkGetCryptProv
GetCryptProvFromCert
PvkPrivateKeyAcquireContextFromMemory

crypt32

CryptHashPublicKeyInfo
CertSetCertificateContextProperty
CryptEncodeObject
CertComparePublicKeyInfo
CertDuplicateCertificateContext
CryptSignAndEncodeCertificate
CertCreateCRLContext
CertEnumCertificatesInStore
CryptHashCertificate
CertGetCertificateContextProperty
CertCloseStore
CertStrToNameW
CertFindCertificateInStore
CertFreeCertificateContext
CertGetPublicKeyLength
CertCompareIntegerBlob
CertOpenStore
CertAddEncodedCertificateToStore
CertFreeCRLContext
CryptQueryObject
CryptDecodeObject
CertCreateCertificateContext
CryptExportPublicKeyInfo

user32

LoadStringW
LoadStringA

ole32

CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

VarDateFromStr

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/mfdetours.dll
.dll windows x86

f03a853f0155acfcd2a74383479126a1

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:d7:27:e9:c9:f7:d6:fa:ad:0b:cd:18:e1:a7:46:fb:c8:77:93:bf:b9:fb:2e:2a:6a:9f:d8:87:69:25:73:67
Signer

Actual PE Digest

16:d7:27:e9:c9:f7:d6:fa:ad:0b:cd:18:e1:a7:46:fb:c8:77:93:bf:b9:fb:2e:2a:6a:9f:d8:87:69:25:73:67

Digest Algorithm

sha256

PE Digest Matches

true

c7:d1:32:fc:98:d1:fa:54:ca:47:36:3d:d7:6b:de:e7:fd:98:27:04
Signer

Actual PE Digest

c7:d1:32:fc:98:d1:fa:54:ca:47:36:3d:d7:6b:de:e7:fd:98:27:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
_mbsinc
_vscprintf
vsprintf_s
_except_handler4_common
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_ultoa_s
_gcvt_s
_ftol2
_amsg_exit
_XcptFilter
calloc
_callnewh
malloc
free
memset
memcpy
_vsnprintf
_vscwprintf
vswprintf_s
_wtoi
memmove_s
memcpy_s
memcmp

kernel32

GetModuleFileNameA
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
CreateProcessA
ReadProcessMemory
VirtualQueryEx
CreateProcessW
LoadLibraryA
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
DebugBreak
GetProcAddress
GetEnvironmentVariableW
SetEnvironmentVariableW
RaiseException
GetLastError
DisableThreadLibraryCalls
FreeLibrary
CloseHandle
MultiByteToWideChar
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
WideCharToMultiByte
GetEnvironmentVariableA
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
OutputDebugStringA
FindResourceExW
LoadResource
LockResource
SizeofResource
GetModuleHandleExW
SetLastError
GetModuleHandleW
ResumeThread
VirtualProtect
VirtualAlloc
FlushInstructionCache
VirtualFree
VirtualQuery
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetThreadContext
SetThreadContext

advapi32

RegGetValueA
EventWrite
EventUnregister
EventRegister
RegGetValueW

mfplat

MFCreateAttributes
MFStartup
MFShutdown

user32

UnregisterClassA

ole32

PropVariantClear
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc

mf

MFCreateTopology
MFGetService
MFCreateMediaSession

dbghelp

SymRegisterCallback64
SymFromName
SymGetModuleInfo64
SymLoadModuleEx
SymInitialize
ImagehlpApiVersionEx
SymSetOptions
SymGetOptions
SymCleanup

Exports

Exports

DllGetMFDebugHlp
Shutdown
Startup

Sections

.text
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/midlrtmd.dll
.dll windows x86

b5eba33161bf4f9d771a64493d6419c5

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:d7:fd:55:9e:77:a7:55:7b:bc:55:2c:03:3c:af:61:74:c2:46:23:fa:44:34:41:60:18:52:90:80:9c:0e:a6
Signer

Actual PE Digest

4e:d7:fd:55:9e:77:a7:55:7b:bc:55:2c:03:3c:af:61:74:c2:46:23:fa:44:34:41:60:18:52:90:80:9c:0e:a6

Digest Algorithm

sha256

PE Digest Matches

true

f7:82:e4:2a:0e:40:37:3b:a3:be:e5:ba:3c:2b:64:6b:84:6a:49:16
Signer

Actual PE Digest

f7:82:e4:2a:0e:40:37:3b:a3:be:e5:ba:3c:2b:64:6b:84:6a:49:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SetErrorInfo

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptExportKey
CryptImportKey
CryptCreateHash
CryptGetHashParam
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW

kernel32

IsProcessorFeaturePresent
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
GetLastError
CreateMutexW
TlsGetValue
VirtualQuery
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
CloseHandle
TlsFree
GetCPInfo
WideCharToMultiByte
FormatMessageW
IsDBCSLeadByte
GetACP
MultiByteToWideChar
LocalFree
LCMapStringW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
GetEnvironmentVariableW
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapSize
WriteFile
GetModuleFileNameW
RtlUnwind
IsValidCodePage
GetOEMCP
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
GetFileAttributesExW
GetSystemInfo
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReadFile
SwitchToThread

ole32

CoCreateGuid
IIDFromString
CoTaskMemFree

Exports

Exports

CreatePEFile
MetaDataGetDispenser
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameTokenFromPublicKey

Sections

.text
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/mrmsupport.dll
.dll windows x86

89ab43f88927b6c9cb01544e35db14a3

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:50:ab:e6:12:f2:33:04:da:6a:6d:07:33:1d:f1:e6:6b:31:1c:9f:17:83:4e:af:4e:1d:14:de:1c:e3:41:5a
Signer

Actual PE Digest

6e:50:ab:e6:12:f2:33:04:da:6a:6d:07:33:1d:f1:e6:6b:31:1c:9f:17:83:4e:af:4e:1d:14:de:1c:e3:41:5a

Digest Algorithm

sha256

PE Digest Matches

true

01:05:71:69:8c:4f:ee:e3:5a:5f:45:e6:0f:bc:f9:90:74:e3:d5:27
Signer

Actual PE Digest

01:05:71:69:8c:4f:ee:e3:5a:5f:45:e6:0f:bc:f9:90:74:e3:d5:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strcspn
localeconv
memchr
sprintf_s
wcscspn
_wcsnicmp
memcpy
memcmp
_wfopen
fgetwc
_filelengthi64
fread
_fileno
_wtof
strtol
isalpha
isdigit
isxdigit
setlocale
___mb_cur_max_func
memmove_s
_errno
___lc_handle_func
___lc_codepage_func
__pctype_func
__mb_cur_max
__iob_func
__crtLCMapStringW
bsearch
wcsrchr
towupper
iswalnum
iswspace
_ui64tow_s
wcsncpy_s
qsort_s
qsort
vwprintf_s
wprintf_s
iswdigit
fclose
wprintf
_vsnwprintf
wcschr
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
wcscpy_s
_purecall
_wtoi
towlower
_wcsicmp
wcsncmp
wcsnlen
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
__CxxFrameHandler3
_CxxThrowException
memcpy_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_ftol2_sse
__crtGetStringTypeW
abort
__uncaught_exception
?terminate@@YAXXZ
_ftol2
memset

kernel32

CompareFileTime
CreateDirectoryW
GetTempPathW
DeleteFileW
SystemTimeToFileTime
Sleep
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryW
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTime
FlushFileBuffers
WriteFile
InitOnceExecuteOnce
GetFinalPathNameByHandleW
GetFileAttributesExW
CreateFileMappingW
GetFileSizeEx
UnmapViewOfFile
MapViewOfFile
GetModuleHandleW
GetProcAddress
FreeLibrary
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetVolumePathNameW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LocalFree
FindNextFileW
FindClose
FindFirstFileW
LCMapStringEx
AcquireSRWLockShared
CompareStringOrdinal
GetVolumeNameForVolumeMountPointW
CloseHandle
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
GetFullPathNameW
GetFileAttributesW
OutputDebugStringW
GetModuleFileNameA
GetModuleHandleExW
FormatMessageW
GetProcessHeap
HeapFree
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
InitializeSRWLock
HeapAlloc
WideCharToMultiByte
GetLastError

advapi32

EventRegister
FreeSid
SetNamedSecurityInfoW
AddAccessAllowedAceEx
GetLengthSid
EqualSid
GetAce
AllocateAndInitializeSid
GetNamedSecurityInfoW
EventUnregister
EventWrite

ole32

CoCreateInstance

oleaut32

SysFreeString
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantChangeType
VariantChangeTypeEx
SysAllocString

shlwapi

PathIsNetworkPathW
PathRelativePathToW
PathIsRelativeW
ord156
PathRemoveBackslashW
PathFileExistsW

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

Exports

Exports

CreateResourceIndexer
DestroyIndexedResults
DestroyResourceIndexer
IndexFilePath

Sections

.text
Size: 547KB - Virtual size: 547KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/msisip.dll
.dll regsvr32 windows x86

edb6b549120311afbb4c6581a089eea5

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:12:07:f8:30:53:41:f0:67:94:cb:84:81:e2:92:e3:9e:ea:19:e2:49:e6:84:14:bb:8c:29:3d:5d:cb:d4:44
Signer

Actual PE Digest

6a:12:07:f8:30:53:41:f0:67:94:cb:84:81:e2:92:e3:9e:ea:19:e2:49:e6:84:14:bb:8c:29:3d:5d:cb:d4:44

Digest Algorithm

sha256

PE Digest Matches

true

07:92:b7:c6:9a:7f:25:40:85:30:02:fa:c1:83:ab:e6:ed:46:ca:09
Signer

Actual PE Digest

07:92:b7:c6:9a:7f:25:40:85:30:02:fa:c1:83:ab:e6:ed:46:ca:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
memcmp
memcpy
memset

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
FreeLibrary
WaitForSingleObject
SetEvent
LoadLibraryW
ReleaseSemaphore
GetLastError
SetLastError
GetProcAddress
CreateSemaphoreW
LocalAlloc
CreateEventW
GetCurrentThreadId
LocalFree
CreateThread
Sleep
QueryPerformanceCounter
GetCurrentProcessId
CloseHandle

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

Exports

Exports

DllRegisterServer
DllUnregisterServer
MsiSIPCreateIndirectData
MsiSIPGetSignedDataMsg
MsiSIPIsMyTypeOfFile
MsiSIPPutSignedDataMsg
MsiSIPRemoveSignedDataMsg
MsiSIPVerifyIndirectData

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/mssign32.dll
.dll regsvr32 windows x86

a8aea89b117ea57f3c2b24582166e23d

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:f7:62:bb:72:3c:f2:4e:86:34:f7:ae:55:42:d1:75:d6:51:aa:9f:24:c5:95:b7:da:6e:c8:fb:db:e6:be:d1
Signer

Actual PE Digest

26:f7:62:bb:72:3c:f2:4e:86:34:f7:ae:55:42:d1:75:d6:51:aa:9f:24:c5:95:b7:da:6e:c8:fb:db:e6:be:d1

Digest Algorithm

sha256

PE Digest Matches

true

a8:03:78:bd:74:44:40:92:1f:e6:38:f3:06:f7:d4:36:04:e5:db:46
Signer

Actual PE Digest

a8:03:78:bd:74:44:40:92:1f:e6:38:f3:06:f7:d4:36:04:e5:db:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_initterm
_except_handler4_common
memcpy_s
memcpy
qsort_s
_amsg_exit
_XcptFilter
_wtol
??3@YAXPAX@Z
realloc
_vsnprintf
atoi
_strnicmp
free
malloc
memcmp
memset

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextW
CryptExportKey
CryptGetUserKey
CryptCreateHash
CryptSignHashA
CryptSetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptDestroyKey
CryptImportKey
CryptGenRandom

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptExportPublicKeyInfo
CertComparePublicKeyInfo
CertCompareCertificateName
CertSetCertificateContextProperty
CryptEncodeObject
CertFindRDNAttr
CertCreateCertificateContext
CryptFindOIDInfo
CryptSIPLoad
CertCompareCertificate
CryptSIPRetrieveSubjectGuid
CryptMsgOpenToDecode
CryptMsgGetParam
CryptDecodeObject
CryptEncodeObjectEx
CertVerifyTimeValidity
CertFindAttribute
CertOpenStore
CertCloseStore
CertCreateCTLContext
CryptMsgOpenToEncode
CryptMsgUpdate
CryptMsgSignCTL
CryptMsgClose
CertFreeCertificateContext
CertFreeCTLContext
CryptMemFree
CryptDecodeObjectEx
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgVerifyCountersignatureEncoded
CertEnumCertificatesInStore
CertGetCRLFromStore
CertFreeCRLContext
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptAcquireCertificatePrivateKey
CertFindExtension

kernel32

GetProcAddress
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
CloseHandle
GetFileInformationByHandle
SetLastError
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
WideCharToMultiByte
WriteFile
ReadFile
GetFileSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryExA
FreeLibrary
HeapReAlloc
DisableThreadLibraryCalls
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
CreateFileW
MultiByteToWideChar
LocalAlloc

ncrypt

NCryptIsKeyHandle
NCryptSignHash
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
NCryptFreeObject

ole32

StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoCreateGuid

user32

GetWindowLongA
SetWindowLongA
GetDlgItem
SetFocus
SetDlgItemTextA
MessageBoxW
GetWindowTextW
GetDlgItemTextA
LoadStringW
DialogBoxParamA
SendDlgItemMessageA
EndDialog

wininet

InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetOpenA

Exports

Exports

DllRegisterServer
DllUnregisterServer
FreeCryptProvFromCert
FreeCryptProvFromCertEx
GetCryptProvFromCert
GetCryptProvFromCertEx
PvkFreeCryptProv
PvkGetCryptProv
PvkPrivateKeyAcquireContext
PvkPrivateKeyAcquireContextA
PvkPrivateKeyAcquireContextFromMemory
PvkPrivateKeyAcquireContextFromMemoryA
PvkPrivateKeyLoad
PvkPrivateKeyLoadA
PvkPrivateKeyLoadFromMemory
PvkPrivateKeyLoadFromMemoryA
PvkPrivateKeyReleaseContext
PvkPrivateKeyReleaseContextA
PvkPrivateKeySave
PvkPrivateKeySaveA
PvkPrivateKeySaveToMemory
PvkPrivateKeySaveToMemoryA
SignError
SignerAddTimeStampResponse
SignerAddTimeStampResponseEx
SignerCreateTimeStampRequest
SignerFreeSignerContext
SignerSign
SignerSignEx
SignerSignEx2
SignerSignEx3
SignerTimeStamp
SignerTimeStampEx
SignerTimeStampEx2
SignerTimeStampEx3
SpcGetCertFromKey

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/opcservices.dll
.dll windows x86

f9fdda647370d9c0075994ce12fd954a

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:66:d5:08:6e:62:2c:68:c9:12:6a:7c:a4:ae:92:5d:3c:a9:d3:6d:cd:ee:d6:68:d6:d7:b2:2d:97:e9:5b:fb
Signer

Actual PE Digest

46:66:d5:08:6e:62:2c:68:c9:12:6a:7c:a4:ae:92:5d:3c:a9:d3:6d:cd:ee:d6:68:d6:d7:b2:2d:97:e9:5b:fb

Digest Algorithm

sha256

PE Digest Matches

true

29:7f:6c:25:cb:69:c1:d7:dd:f3:eb:69:06:52:0d:cc:80:d1:54:7c
Signer

Actual PE Digest

29:7f:6c:25:cb:69:c1:d7:dd:f3:eb:69:06:52:0d:cc:80:d1:54:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

isupper
__crtLCMapStringA
__mb_cur_max
__crtLCMapStringW
__crtGetStringTypeW
tolower
abort
isalnum
isdigit
?terminate@@YAXXZ
__uncaught_exception
__pctype_func
___lc_codepage_func
___lc_handle_func
_errno
___mb_cur_max_func
setlocale
__CxxFrameHandler3
wcsstr
isspace
ldiv
strcspn
sprintf_s
localeconv
memchr
_strtoui64
_strtoi64
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
memmove_s
_purecall
_vsnwprintf
_vsnprintf
??0exception@@QAE@ABQBD@Z
_ftol2
memcmp
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_wcsicmp
islower
malloc
free
memcpy_s
_callnewh
memset

kernel32

FileTimeToLocalFileTime
FileTimeToDosDateTime
CreateThread
CreateFiber
ConvertThreadToFiber
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
SetLastError
GetLastError
CreateFileW
FlushFileBuffers
CloseHandle
DelayLoadFailureHook
OutputDebugStringW
GetTempPathW
GetProcAddress
LoadLibraryW
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReadFile
WriteFile
GetFileSizeEx
OutputDebugStringA
SetFilePointerEx
CompareStringOrdinal
InitOnceBeginInitialize
InitOnceComplete
DeleteFiber
SwitchToFiber
GetProcessHeap
HeapAlloc
GetModuleHandleExW
LoadLibraryExA
HeapFree
GetModuleFileNameA
InitializeCriticalSection
lstrlenW
GetLocalTime
GetDynamicTimeZoneInformation
LoadLibraryExW
WideCharToMultiByte
SetEndOfFile
SetEvent
WaitForSingleObject
CreateEventW
GetModuleHandleW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
StringFromGUID2
CoUninitialize
CoCreateGuid

advapi32

RegQueryValueExW
RegOpenKeyExW
RegisterTraceGuidsW
GetTraceEnableLevel
EventRegister
UnregisterTraceGuids
GetTraceLoggerHandle
EventUnregister
EventWrite
GetTraceEnableFlags
TraceMessage
RegCloseKey

oleaut32

SysReAllocString
SysStringLen
SysAllocStringLen
SetErrorInfo
SysFreeString
GetErrorInfo
VariantInit
VariantClear
SysAllocString

urlmon

CreateUri

shlwapi

ord12

xmllite

CreateXmlWriter

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/provisioningtesthelper.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:2a:62:55:e2:46:af:4e:d1:04:a1:10:e5:f0:78:55:e5:92:3d:81:a7:b1:5d:62:a4:12:b9:f1:b5:b3:dc:4e
Signer

Actual PE Digest

58:2a:62:55:e2:46:af:4e:d1:04:a1:10:e5:f0:78:55:e5:92:3d:81:a7:b1:5d:62:a4:12:b9:f1:b5:b3:dc:4e

Digest Algorithm

sha256

PE Digest Matches

true

19:ce:1c:0e:54:38:d5:9f:90:1c:a6:27:a6:53:0c:d2:7f:e6:30:51
Signer

Actual PE Digest

19:ce:1c:0e:54:38:d5:9f:90:1c:a6:27:a6:53:0c:d2:7f:e6:30:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/pvk2pfx.exe
.exe windows x86

f67d883758dba759656b42b79eaa042c

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:33:ae:21:e7:95:8f:fd:72:94:dd:f3:15:e4:c3:5c:65:e6:f3:61:d0:3b:81:b7:59:ba:a5:b3:59:51:c2:af
Signer

Actual PE Digest

cf:33:ae:21:e7:95:8f:fd:72:94:dd:f3:15:e4:c3:5c:65:e6:f3:61:d0:3b:81:b7:59:ba:a5:b3:59:51:c2:af

Digest Algorithm

sha256

PE Digest Matches

true

90:28:e4:3d:53:b1:c8:f5:06:cf:2f:12:48:2c:c6:df:88:21:7c:fe
Signer

Actual PE Digest

90:28:e4:3d:53:b1:c8:f5:06:cf:2f:12:48:2c:c6:df:88:21:7c:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptGetProvParam
CryptImportKey
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
CryptHashData

kernel32

CloseHandle
LocalFree
Sleep
HeapSetInformation
LocalAlloc
GetLastError
CreateFileW
ReadFile
FormatMessageW
GetConsoleWindow
WideCharToMultiByte
WriteFile
GetProcessHeap
GetModuleHandleW
GetFileSize
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
GetModuleHandleA
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter

msvcrt

_initterm
_controlfp
_except_handler4_common
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_vsnwprintf
fprintf
vfwprintf
_wcsicmp
?terminate@@YAXXZ
__iob_func
memset

user32

DialogBoxParamW
GetWindowLongW
SetWindowLongW
EndDialog
SendDlgItemMessageW
LoadStringW
GetDlgItemTextW
SetDlgItemTextW

crypt32

CertOIDToAlgId
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertComparePublicKeyInfo
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptExportPublicKeyInfo

cryptui

CryptUIWizExport

rpcrt4

UuidCreate

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/signtool.exe
.exe windows x86

874663bdc1338d9d0380b306908b34f5

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:50:ae:52:da:58:06:fd:3e:2f:ab:d9:aa:4c:f2:6a:26:fc:e6:96:86:05:09:d4:76:39:32:7d:6d:fe:c5:56
Signer

Actual PE Digest

5f:50:ae:52:da:58:06:fd:3e:2f:ab:d9:aa:4c:f2:6a:26:fc:e6:96:86:05:09:d4:76:39:32:7d:6d:fe:c5:56

Digest Algorithm

sha256

PE Digest Matches

true

8b:f6:c0:c1:b5:97:1b:3b:d5:f5:7b:91:d0:5b:19:1a:f4:72:91:2b
Signer

Actual PE Digest

8b:f6:c0:c1:b5:97:1b:3b:d5:f5:7b:91:d0:5b:19:1a:f4:72:91:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptDestroyKey
CryptReleaseContext
CryptGetUserKey
CryptEnumProvidersW
CryptAcquireContextW
CryptDestroyHash
CryptCreateHash
CryptSetHashParam
CryptSignHashA

kernel32

GetLastError
GetProcessHeap
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileW
GetFullPathNameW
FindClose
GetDateFormatEx
GetTimeFormatEx
GetModuleHandleW
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
ExpandEnvironmentStringsW
GetFileType
WriteFile
EnumResourceNamesW
EnumResourceLanguagesW
LockResource
LoadResource
SizeofResource
FindResourceExW
HeapSetInformation
HeapAlloc
GetEnvironmentVariableW
MapViewOfFile
CreateFileMappingA
GetFileSize
GetSystemInfo
UnmapViewOfFile
LocalFree
FormatMessageW
CloseHandle
SetLastError
CreateFileW
GetCurrentProcess
GetProcAddress
GetModuleHandleA
FreeLibrary
FindFirstFileW
LoadLibraryA
LoadLibraryW

mfc42

ord823
ord825

msvcrt

__crtLCMapStringA
isupper
setlocale
malloc
___lc_codepage_func
___lc_handle_func
__pctype_func
_errno
___mb_cur_max_func
fputc
__uncaught_exception
strerror
__mb_cur_max
memset
memcpy
__CxxFrameHandler3
memcpy_s
ungetwc
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
_XcptFilter
calloc
fflush
__iob_func
_CxxThrowException
_purecall
puts
_wsetlocale
_time64
realloc
??4exception@@QAEAAV0@ABV0@@Z
_exit
swscanf
_wtoi
towlower
_except_handler4_common
_controlfp
?terminate@@YAXXZ
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
_mktime64
_onexit
__dllonexit
_unlock
__crtLCMapStringW
??0exception@@QAE@XZ
___lc_collate_cp_func
__crtCompareStringW
memcmp
islower
fgetc
abort
fclose
fseek
fgetpos
wcsncmp
_lock
??1type_info@@UAE@XZ
_initterm
exit
_wfopen
_wcsnicmp
_wcsicmp
towupper
iswdigit
iswalpha
fgetwc
fwprintf
wcsstr
wprintf
free
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??_V@YAXPAX@Z
memmove_s
strcspn
memchr
localeconv
sprintf_s
putchar
_wctime64
mktime
fputwc
memmove
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
__p__fmode
_cexit
strchr
__setusermatherr
qsort_s

ntdll

RtlAllocateHeap
RtlFreeHeap

crypt32

CertDuplicateCertificateContext
CertFreeCertificateChain
CryptMsgGetParam
CryptDecodeObject
CryptFindOIDInfo
CertFindAttribute
CertGetEnhancedKeyUsage
CertCreateCertificateContext
CertCompareCertificate
CryptMsgControl
CryptMsgClose
CertDuplicateStore
CertCloseStore
CertDuplicateCertificateChain
CryptEncodeObjectEx
CertGetCertificateContextProperty
CryptQueryObject
CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore
CryptMemFree
CryptVerifyMessageSignature
CryptMsgOpenToDecode
CryptMsgUpdate
CryptExportPublicKeyInfoEx
CryptAcquireCertificatePrivateKey
CertGetNameStringW
CertFindExtension
CertGetValidUsages
CertGetCertificateChain
CryptHashCertificate2
CertSetCertificateContextProperty
CryptBinaryToStringA
CryptStringToBinaryA
CryptBinaryToStringW
CertAddStoreToCollection
CertControlStore
PFXImportCertStore
CertFindCertificateInStore
CryptMsgOpenToEncode
CertComparePublicKeyInfo
CryptSIPLoad
CryptDecodeObjectEx
CryptSIPRetrieveSubjectGuid
CertFreeCertificateContext

user32

LoadStringW

ole32

CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString
GetErrorInfo

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

shlwapi

PathCanonicalizeW
SHCreateStreamOnFileW

bcrypt

BCryptCreateHash
BCryptFinishHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty

ncrypt

NCryptSignHash

xmllite

CreateXmlWriter

mssign32

SignerTimeStamp
SignerFreeSignerContext
SignerSign

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/signtool.exe.manifest
.xml
WSAppBak/WSAppBak/tedutil.dll
.dll regsvr32 windows x86

1cad076a7d36290f5f33e58d74831807

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:05:ae:a8:0c:0e:77:e8:16:50:43:21:40:90:76:4c:c7:76:f7:35:5c:e7:4e:45:b3:d2:52:71:af:ec:e8:f0
Signer

Actual PE Digest

4e:05:ae:a8:0c:0e:77:e8:16:50:43:21:40:90:76:4c:c7:76:f7:35:5c:e7:4e:45:b3:d2:52:71:af:ec:e8:f0

Digest Algorithm

sha256

PE Digest Matches

true

99:3a:8e:00:64:76:60:5f:2a:65:fe:8f:ee:aa:c6:12:34:7e:6a:a6
Signer

Actual PE Digest

99:3a:8e:00:64:76:60:5f:2a:65:fe:8f:ee:aa:c6:12:34:7e:6a:a6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
wcslen
_callnewh
swprintf_s
wcschr
strcpy_s
_vscprintf
vsprintf_s
sprintf_s
_wtoi64
_wtoi
_wtof
wcstoul
wcstod
_ftol2
_wtol
_ftol2_sse
_vscwprintf
vswprintf_s
calloc
wcsrchr
memmove_s
memset
memcmp
malloc
free
wcsncpy_s
wcscpy_s
wcscat_s
memcpy_s
_purecall

oleaut32

UnRegisterTypeLi
VariantInit
SysFreeString
LoadRegTypeLi
LoadTypeLi
VariantClear
VarBstrCmp
RegisterTypeLi
VarUI4FromStr
SysStringLen
SysAllocString

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EnterCriticalSection
Sleep

api-ms-win-core-libraryloader-l1-2-0

LockResource
GetModuleHandleW
FindResourceExW
SizeofResource
LoadResource
GetModuleFileNameW
LoadLibraryExW
LoadLibraryExA
GetProcAddress
FreeLibrary

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-localization-l1-2-1

GetThreadLocale
SetThreadLocale

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

api-ms-win-core-com-l1-1-1

StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID
PropVariantClear
IIDFromString
CoTaskMemAlloc

api-ms-win-core-file-l1-2-1

CreateFileW
WriteFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-processthreads-l1-1-2

FlushInstructionCache
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
IsProcessorFeaturePresent
GetCurrentProcessId

api-ms-win-core-heap-l1-2-0

HeapDestroy
HeapReAlloc
HeapSize
GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualFree

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

gdi32

DeleteDC
CreateSolidBrush
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
LineTo
Rectangle
SelectObject
SetBkColor
SetTextColor
MoveToEx

kernel32

lstrcmpiW

mf

MFCreateTopologyNode
MFRequireProtectedEnvironment
MFCreateAudioRendererActivate
MFCreateVideoRendererActivate
MFCreateMPEG4MediaSink
MFCreateTopology
MFCreateSequencerSource
MFCreateTranscodeProfile
MFCreateTranscodeSinkActivate
MFCreateASFProfile
MFCreateASFMediaSink

mfplat

MFCreateAttributes
MFCreateFile
MFCreateSourceResolver
MFTEnumEx
MFCreateEventQueue
MFCreateMediaType
MFInitAMMediaTypeFromMFMediaType
MFCreateCollection

propsys

VariantToPropVariant
PropVariantToVariant

user32

ShowScrollBar
GetWindowLongW
UnregisterClassA
LoadCursorW
CreateWindowExW
GetClassInfoExW
SetWindowLongW
FillRect
DefWindowProcW
SendMessageW
GetClientRect
SetScrollInfo
EndPaint
BeginPaint
DrawTextW
GetScrollInfo
MessageBoxW
InvalidateRect
CallWindowProcW
RegisterClassExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID

Sections

.text
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/wintrust.dll
.dll regsvr32 windows x86

39a556803ee667978320a9ce17da85e7

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:f3:32:65:84:17:8a:19:6f:d4:13:a4:3b:61:73:e6:b7:0f:9c:a1:13:73:9f:e3:5d:19:25:68:5b:e5:8a:bd
Signer

Actual PE Digest

22:f3:32:65:84:17:8a:19:6f:d4:13:a4:3b:61:73:e6:b7:0f:9c:a1:13:73:9f:e3:5d:19:25:68:5b:e5:8a:bd

Digest Algorithm

sha256

PE Digest Matches

true

30:99:43:de:63:16:bc:e4:be:01:8a:35:f5:40:7c:f7:7a:56:c2:61
Signer

Actual PE Digest

30:99:43:de:63:16:bc:e4:be:01:8a:35:f5:40:7c:f7:7a:56:c2:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcpy_s
_stricmp
_wcsnicmp
qsort
wcsrchr
_memicmp
towupper
_wtol
qsort_s
__CxxFrameHandler3
memmove
_ltoa
_vsnprintf
_vsnwprintf
wcstol
wcschr
bsearch
memcmp
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcscat_s
_itow_s
_errno
_wcsicmp
atol
memset

crypt32

CertFindCertificateInStore
CertGetCertificateContextProperty
CryptEnumOIDInfo
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CryptSIPRemoveProvider
CryptSIPAddProvider
CryptFindOIDInfo
CryptEncodeObject
CertFindAttribute
CryptEncodeObjectEx
I_CryptGetDefaultCryptProv
CryptStringToBinaryW
CertFindSubjectInSortedCTL
I_CryptGetTls
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptMsgEncodeAndSignCTL
CryptMsgDuplicate
CertVerifyCertificateChainPolicy
CertDeleteCertificateFromStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetNameStringW
CryptExportPublicKeyInfo
CertOpenSystemStoreA
CertCreateCertificateContext
CertSetCertificateContextProperty
CertRDNValueToStrW
CertFindRDNAttr
CryptMsgUpdate
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgControl
CryptMsgVerifyCountersignatureEncodedEx
CryptImportPublicKeyInfoEx2
CryptMemFree
CertGetSubjectCertificateFromStore
CryptHashCertificate2
CertCompareCertificate
I_CryptReadTrustedPublisherDWORDValueFromRegistry
CryptMsgClose
CertOIDToAlgId
CertVerifyTimeValidity
I_CryptInsertLruEntry
I_CryptFlushLruCache
I_CryptCreateLruCache
I_CryptCreateLruEntry
CertCreateContext
I_CryptFindLruEntryData
CertVerifySubjectCertificateContext
CertCompareIntegerBlob
CertVerifyValidityNesting
CryptDecodeObject
CertGetIssuerCertificateFromStore
CryptQueryObject
CertControlStore
CryptUnregisterOIDFunction
I_CryptGetAsn1Decoder
CryptInstallOIDFunctionAddress
CryptRegisterOIDFunction
I_CryptInstallAsn1Module
I_CryptUninstallAsn1Module
I_CryptGetAsn1Encoder
CertDuplicateCertificateContext
CertFreeCTLContext
CertFreeCertificateContext
CertComparePublicKeyInfo
CertAddStoreToCollection
CertFreeCertificateChainEngine
CertDuplicateStore
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertOpenStore
CertFindExtension
CryptDecodeObjectEx
CertCompareCertificateName
I_CryptReleaseLruEntry
I_CryptRemoveLruEntry
I_CryptFreeLruCache

ntdll

RtlCompareUnicodeString
RtlEqualUnicodeString
RtlAllocateHeap
RtlGetVersion
RtlInitUnicodeString
NtQuerySystemInformation
RtlNtStatusToDosError
RtlFreeHeap
LdrResFindResource

user32

MessageBoxA
GetDesktopWindow

advapi32

CopySid
RegEnumValueA
CryptSetProvParam
CryptAcquireContextW
EventWrite
CryptHashData
CryptDestroyHash
CryptCreateHash
GetSecurityDescriptorDacl
AddAce
InitializeAcl
SetFileSecurityW
LookupAccountSidW
GetAce
SetSecurityDescriptorDacl
GetFileSecurityW
CryptGetHashParam
GetLengthSid
IsValidSid
GetSidSubAuthorityCount
OpenThreadToken
GetSidSubAuthority
GetSidIdentifierAuthority
RegEnumValueW
ControlService
QueryServiceConfigA
FreeSid
AllocateAndInitializeSid
QueryServiceStatus
StartServiceW
ChangeServiceConfigA
StartServiceA
EqualSid
GetTokenInformation
OpenServiceW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExA
RegSetValueExA
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyExW
EventRegister
EventUnregister
AddAccessAllowedAceEx
GetAclInformation
InitializeSecurityDescriptor
ConvertStringSidToSidW

msasn1

ASN1_SetEncoderOption
ASN1_Decode
ASN1_FreeEncoded
ASN1_Encode
ASN1_FreeDecoded
ASN1BEREncU32
ASN1CEREncUTCTime
ASN1Free
ASN1BERDecCharString
ASN1charstring_free
ASN1_CloseModule
ASN1CEREncBeginBlk
ASN1BERDecEndOfContents
ASN1DecSetError
ASN1BERDecOctetString2
ASN1BERDecChar16String
ASN1BERDecObjectIdentifier2
ASN1BEREncOctetString
ASN1BEREncEndOfContents
ASN1BEREncS32
ASN1BEREncChar16String
ASN1BEREncObjectIdentifier2
ASN1CEREncNewBlkElement
ASN1EncSetError
ASN1BEREncBool
ASN1BEREncExplicitTag
ASN1BERDecBool
ASN1BEREncRemoveZeroBits
ASN1BERDecOpenType2
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecBitString
ASN1DecRealloc
ASN1BEREncNull
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1CEREncFlushBlkElement
ASN1BERDecS32Val
ASN1BERDecU32Val
ASN1BERDecUTCTime
ASN1bitstring_cmp
ASN1octetstring_free
ASN1BEREncOpenType
ASN1CEREncEndBlk
ASN1BERDecNull
ASN1objectidentifier_free
ASN1BERDecNotEndOfContents
ASN1BERDecExplicitTag
ASN1BEREncCharString
ASN1_CreateModule
ASN1char16string_free

kernel32

lstrlenW
CreateDirectoryW
SetFileAttributesW
FlushViewOfFile
GetModuleHandleA
GetFileInformationByHandle
VirtualUnlock
GetTickCount64
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileAttributesW
GetSystemDirectoryW
FindFirstFileW
GetFileSizeEx
GetSystemInfo
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
SetFilePointerEx
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
GetCurrentThread
CreateFileW
LocalReAlloc
FileTimeToSystemTime
SystemTimeToFileTime
ExpandEnvironmentStringsW
OutputDebugStringA
GetLocalTime
DeviceIoControl
WriteFile
GetDateFormatA
GetTimeFormatA
SetEndOfFile
GetFileSize
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalAlloc
Sleep
GetCurrentProcess
GetModuleFileNameW
GetPrivateProfileStringW
GetModuleHandleW
HeapAlloc
ExpandEnvironmentStringsA
lstrlenA
CloseHandle
GetFileAttributesExW
EnterCriticalSection
ReadFile
CompareFileTime
InitializeCriticalSection
SetLastError
DeleteCriticalSection
LocalFree
GetLastError
FreeLibrary
GetModuleHandleExW
SetEvent
GetEnvironmentVariableA
GetProcAddress
DisableThreadLibraryCalls
WideCharToMultiByte
LoadLibraryW
WaitForSingleObject
ResetEvent
FreeResource
GetModuleHandleExA
LoadResource
FindResourceExA
SizeofResource
LockResource
LoadLibraryA
MultiByteToWideChar
SetFilePointer
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
LeaveCriticalSection
CreateFileMappingW

bcrypt

BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptVerifySignature
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptDestroyKey

rpcrt4

RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcEpResolveBinding
NdrClientCall2
UuidEqual

Exports

Exports

AddPersonalTrustDBPages
CatalogCompactHashDatabase
ConfigCiFinalPolicy
CryptCATAdminAcquireContext
CryptCATAdminAcquireContext2
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminCalcHashFromFileHandle2
CryptCATAdminEnumCatalogFromHash
CryptCATAdminPauseServiceForBackup
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminRemoveCatalog
CryptCATAdminResolveCatalogPath
CryptCATAllocSortedMemberInfo
CryptCATCDFClose
CryptCATCDFEnumAttributes
CryptCATCDFEnumAttributesWithCDFTag
CryptCATCDFEnumCatAttributes
CryptCATCDFEnumMembers
CryptCATCDFEnumMembersByCDFTag
CryptCATCDFEnumMembersByCDFTagEx
CryptCATCDFOpen
CryptCATCatalogInfoFromContext
CryptCATClose
CryptCATEnumerateAttr
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATFreeSortedMemberInfo
CryptCATGetAttrInfo
CryptCATGetCatAttrInfo
CryptCATGetMemberInfo
CryptCATHandleFromStore
CryptCATOpen
CryptCATPersistStore
CryptCATPutAttrInfo
CryptCATPutCatAttrInfo
CryptCATPutMemberInfo
CryptCATStoreFromHandle
CryptCATVerifyMember
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetInfo
CryptSIPGetRegWorkingFlags
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPPutSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPVerifyIndirectData
DllRegisterServer
DllUnregisterServer
DriverCleanupPolicy
DriverFinalPolicy
DriverInitializePolicy
FindCertsByIssuer
GenericChainCertificateTrust
GenericChainFinalProv
HTTPSCertificateTrust
HTTPSFinalProv
IsCatalogFile
MsCatConstructHashTag
MsCatFreeHashTag
OfficeCleanupPolicy
OfficeInitializePolicy
OpenPersonalTrustDBDialog
OpenPersonalTrustDBDialogEx
SoftpubAuthenticode
SoftpubCheckCert
SoftpubCleanup
SoftpubDefCertInit
SoftpubDllRegisterServer
SoftpubDllUnregisterServer
SoftpubDumpStructure
SoftpubFreeDefUsageCallData
SoftpubInitialize
SoftpubLoadDefUsageCallData
SoftpubLoadMessage
SoftpubLoadSignature
TrustDecode
TrustFindIssuerCertificate
TrustFreeDecode
TrustIsCertificateSelfSigned
TrustOpenStores
WTHelperCertCheckValidSignature
WTHelperCertFindIssuerCertificate
WTHelperCertIsSelfSigned
WTHelperCheckCertUsage
WTHelperGetAgencyInfo
WTHelperGetFileHandle
WTHelperGetFileHash
WTHelperGetFileName
WTHelperGetKnownUsages
WTHelperGetProvCertFromChain
WTHelperGetProvPrivateDataFromChain
WTHelperGetProvSignerFromChain
WTHelperIsChainedToMicrosoft
WTHelperIsChainedToMicrosoftFromStateData
WTHelperIsInRootStore
WTHelperOpenKnownStores
WTHelperProvDataFromStateData
WVTAsn1CatMemberInfo2Decode
WVTAsn1CatMemberInfo2Encode
WVTAsn1CatMemberInfoDecode
WVTAsn1CatMemberInfoEncode
WVTAsn1CatNameValueDecode
WVTAsn1CatNameValueEncode
WVTAsn1IntentToSealAttributeDecode
WVTAsn1IntentToSealAttributeEncode
WVTAsn1SealingSignatureAttributeDecode
WVTAsn1SealingSignatureAttributeEncode
WVTAsn1SealingTimestampAttributeDecode
WVTAsn1SealingTimestampAttributeEncode
WVTAsn1SpcFinancialCriteriaInfoDecode
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcIndirectDataContentDecode
WVTAsn1SpcIndirectDataContentEncode
WVTAsn1SpcLinkDecode
WVTAsn1SpcLinkEncode
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
WVTAsn1SpcPeImageDataDecode
WVTAsn1SpcPeImageDataEncode
WVTAsn1SpcSigInfoDecode
WVTAsn1SpcSigInfoEncode
WVTAsn1SpcSpAgencyInfoDecode
WVTAsn1SpcSpAgencyInfoEncode
WVTAsn1SpcSpOpusInfoDecode
WVTAsn1SpcSpOpusInfoEncode
WVTAsn1SpcStatementTypeDecode
WVTAsn1SpcStatementTypeEncode
WinVerifyTrust
WinVerifyTrustEx
WintrustAddActionID
WintrustAddDefaultForUsage
WintrustCertificateTrust
WintrustCryptSIPGetCaps
WintrustCryptSIPGetSealedDigest
WintrustCryptSIPLoad
WintrustCryptSIPRetrieveSubjectGuid
WintrustGetDefaultForUsage
WintrustGetRegPolicyFlags
WintrustLoadFunctionPointers
WintrustRemoveActionID
WintrustSetDefaultIncludePEPageHashes
WintrustSetRegPolicyFlags
mscat32DllRegisterServer
mscat32DllUnregisterServer
mssip32DllRegisterServer
mssip32DllUnregisterServer

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppBak/wintrust.dll.ini
WSAppBak/WSAppBak/wsutilhelper.dll
.dll windows x86

deb640de118ac50160c96c5a07f4246c

Code Sign

33:00:00:00:90:3e:83:56:9d:f3:ba:ae:e8:00:00:00:00:00:90
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:5e:b8:45:84:c9:2f:00:e9:a8:85:48:fb:d8:1a:36:ff:ff:6f:c3:92:ef:0e:39:cf:80:f4:8e:0f:6c:c4:85
Signer

Actual PE Digest

fb:5e:b8:45:84:c9:2f:00:e9:a8:85:48:fb:d8:1a:36:ff:ff:6f:c3:92:ef:0e:39:cf:80:f4:8e:0f:6c:c4:85

Digest Algorithm

sha256

PE Digest Matches

true

b1:80:cc:00:22:3d:b6:77:99:e1:a6:12:4d:1a:96:37:6d:1b:e1:e8
Signer

Actual PE Digest

b1:80:cc:00:22:3d:b6:77:99:e1:a6:12:4d:1a:96:37:6d:1b:e1:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcmp
swprintf_s
qsort
memmove
_vscwprintf
_vsnwprintf
memcpy
memset

ole32

CoTaskMemFree
CoTaskMemAlloc

kernel32

HeapReAlloc
HeapFree
HeapCreate
HeapDestroy
GetSystemDefaultUILanguage
FreeLibrary
GetUserDefaultUILanguage
GetModuleHandleExW
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CompareStringW
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
DebugBreak
MultiByteToWideChar
GetLastError
LoadLibraryW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FormatMessageW
DisableThreadLibraryCalls
GetProcAddress

advapi32

TraceEvent
UnregisterTraceGuids

Exports

Exports

WsutilParseMetadata

Sections

.text
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WSAppBak/WSAppPkgIns.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 9KB - Virtual size: 9KB

.rsrc Size: 70KB - Virtual size: 69KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71Certificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

f6:76:e1:db:8b:99:1d:c0:a0:de:be:a0:7d:0a:0f:4f:34:a8:77:c3:6d:79:55:c2:1a:13:ba:4e:58:25:25:88Signer

d4:53:03:5e:5d:f2:21:eb:b0:46:22:aa:75:88:e4:16:c0:14:f9:acSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 136KB - Virtual size: 136KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

ca784e846e3b5a6a8c817fe6274fce20

Code Sign

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8fCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:efCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

5d:ca:c7:cd:e7:8b:11:3d:be:e9:86:82:8b:3f:c8:6d:42:6a:15:0a:e6:14:1a:49:4a:80:4f:6f:e3:9a:3e:88Signer

6a:3a:77:89:35:da:c3:74:0c:c1:9c:6b:0e:77:d1:a7:2a:7c:45:c5Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

ole32

oleaut32

opcservices

urlmon

xmllite

Exports

Exports

Sections

.text Size: 382KB - Virtual size: 382KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 124B

.rsrc Size: 417KB - Virtual size: 417KB

.reloc Size: 16KB - Virtual size: 15KB

d76858137b19e149cea001d45d4f920b

.text
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 70KB - Virtual size: 69KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

f6:76:e1:db:8b:99:1d:c0:a0:de:be:a0:7d:0a:0f:4f:34:a8:77:c3:6d:79:55:c2:1a:13:ba:4e:58:25:25:88
Signer

d4:53:03:5e:5d:f2:21:eb:b0:46:22:aa:75:88:e4:16:c0:14:f9:ac
Signer

.text
Size: 136KB - Virtual size: 136KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

5d:ca:c7:cd:e7:8b:11:3d:be:e9:86:82:8b:3f:c8:6d:42:6a:15:0a:e6:14:1a:49:4a:80:4f:6f:e3:9a:3e:88
Signer

6a:3a:77:89:35:da:c3:74:0c:c1:9c:6b:0e:77:d1:a7:2a:7c:45:c5
Signer

.text
Size: 382KB - Virtual size: 382KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 124B

.rsrc
Size: 417KB - Virtual size: 417KB

.reloc
Size: 16KB - Virtual size: 15KB

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

ed:4b:28:95:7a:b6:a6:55:8b:30:88:9a:85:4b:75:e1:c2:b3:7a:c8:dd:ce:d7:3b:93:cc:09:b8:28:c9:5d:a1
Signer

dc:77:83:4c:42:4f:4b:84:db:a9:4b:4b:5e:83:61:29:f5:b7:08:fa
Signer

.text
Size: 158KB - Virtual size: 157KB

.data
Size: 512B - Virtual size: 1000B

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

9e:62:da:89:e6:0f:81:7a:24:89:e2:c0:3c:58:bb:3c:2e:1c:92:d2:22:64:5c:70:17:83:73:79:3d:6e:57:61
Signer

f4:a2:61:a3:fa:7f:b4:13:d2:81:df:36:fd:2b:47:f9:c2:7a:1b:be
Signer

.text
Size: 212KB - Virtual size: 212KB

.data
Size: 4KB - Virtual size: 11KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB