Sea_of_Thieves_Hack[.]zip

resource
unpack001/Launcher.dll
unpack001/data/AppInfo/Launcher.dll
unpack001/data/AppInfo/services/7z.dll
unpack001/data/AppInfo/services/7z.exe
unpack001/data/AppInfo/update.dll
unpack001/data/BLAKEX64.DLL
unpack001/data/TC7Z64.DLL
unpack001/data/TCLZMA64.DLL
unpack001/data/TCshareWin10x64.dll

Sea_of_Thieves_Hack.zip

.zip

Launcher.dll

.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

Launcher.exe

.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18/09/2019, 12:58

Not After

11/12/2022, 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e
Signer

Actual PE Digest

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress

GetModuleHandleW

lstrcmpiW

MultiByteToWideChar

LoadLibraryExW

ExitProcess

LocalAlloc

LocalFree

FormatMessageW

WaitForSingleObject

GetExitCodeProcess

CreateThread

SetLastError

EnterCriticalSection

LeaveCriticalSection

GetCurrentThreadId

FindResourceExW

GetACP

WideCharToMultiByte

FreeResource

SetFilePointer

ReadFile

CreateFileW

CreateFileMappingW

MapViewOfFile

IsBadReadPtr

UnmapViewOfFile

GetCurrentProcessId

EnumResourceNamesW

GetFileAttributesW

GetFileSize

OpenEventW

SetEvent

ExpandEnvironmentStringsW

Sleep

FlushFileBuffers

GetFileType

WriteFile

WriteConsoleW

GetStringTypeW

SetStdHandle

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCPInfo

GetOEMCP

CloseHandle

FindNextFileW

FindFirstFileExW

FindClose

GetFileSizeEx

GetConsoleCP

ReadConsoleW

GetConsoleMode

SetFilePointerEx

LCMapStringW

GetStdHandle

GetModuleHandleExW

GetCommandLineW

GetCommandLineA

TlsFree

TlsSetValue

TlsGetValue

TlsAlloc

GetModuleFileNameW

SizeofResource

LockResource

LoadResource

FindResourceW

GetProcessHeap

DeleteCriticalSection

HeapDestroy

DecodePointer

HeapAlloc

HeapFree

RtlUnwind

GetSystemTimeAsFileTime

QueryPerformanceCounter

GetStartupInfoW

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

CreateEventW

WaitForSingleObjectEx

ResetEvent

InitializeCriticalSectionAndSpinCount

LoadLibraryExA

VirtualFree

VirtualAlloc

IsProcessorFeaturePresent

FlushInstructionCache

GetCurrentProcess

InterlockedPushEntrySList

InterlockedPopEntrySList

InitializeSListHead

EncodePointer

OutputDebugStringW

IsDebuggerPresent

FreeLibrary

RaiseException

HeapReAlloc

GetLastError

HeapSize

InitializeCriticalSectionEx

IsValidCodePage

user32

UnregisterClassW

MessageBoxW

GetDlgItem

SetWindowPos

MapWindowPoints

GetClientRect

wsprintfA

GetWindowRect

GetMonitorInfoW

MonitorFromWindow

GetWindowLongW

GetWindow

SetTimer

SendMessageW

GetParent

SetWindowTextW

CharNextW

DispatchMessageW

TranslateMessage

PeekMessageW

MsgWaitForMultipleObjects

CreateWindowExW

DestroyWindow

LoadCursorW

GetClassInfoExW

RegisterClassExW

CallWindowProcW

SetWindowLongW

DefWindowProcW

DialogBoxParamW

EndDialog

GetActiveWindow

KillTimer

advapi32

RegDeleteValueW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegSetValueExW

RegQueryValueExW

CreateProcessWithLogonW

RegDeleteKeyW

RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID

CLSIDFromString

CoUninitialize

CoGetObject

CoGetInstanceFromFile

CoInitialize

CoCreateInstance

CoTaskMemAlloc

CoTaskMemRealloc

StringFromGUID2

CoTaskMemFree

oleaut32

VariantCopy

VariantClear

SafeArrayUnaccessData

VariantChangeType

SafeArrayAccessData

SysAllocString

SysFreeString

VariantInit

VarUI4FromStr

LoadTypeLi

LoadRegTypeLi

SysStringLen

LoadTypeLibEx

SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertCloseStore

CryptMsgClose

CryptQueryObject

version

GetFileVersionInfoW

VerQueryValueA

GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Launcher.exe.manifest

data/0jQuemuZovL3

data/0jniNUrCL6XW

data/2EhyeqtrEUhE

data/2HlQzbZOxkgt

data/2byGRLKokdo0

data/2dvi4vlNFwCa

data/2eu5tVkUBMxI

data/2kWKXjasNuDz

data/3aWatGhZHGUe

data/3buAJsmlPcIg

data/AppInfo/04OUHFdotzCp

data/AppInfo/06iYOrSscTmj

data/AppInfo/09pJiWl17UPX

data/AppInfo/0ArK0OPZmhBQ

data/AppInfo/0CsJe3s5RE8J

data/AppInfo/0Eb6wttzryzd

data/AppInfo/0FLr44cg9EE1

data/AppInfo/0FjpJqoDFgcH

data/AppInfo/0M45foplkpjt

data/AppInfo/0QPvg5JmEp22

data/AppInfo/0RQ8wZKMINKm

data/AppInfo/0T3j0jGINMN4

data/AppInfo/0THFmRYkRNBt

data/AppInfo/0VQtfHbpgr7e

data/AppInfo/0b5FgUYwl2CP

data/AppInfo/0etNGIUs19yY

data/AppInfo/0km6qOpcxreR

data/AppInfo/0n2YNwoTT49S

data/AppInfo/0vLRwYKIo2JR

data/AppInfo/0yKv4cYZEkLg

data/AppInfo/1Ja1Wwr9mg4W

data/AppInfo/1MQojzxJ5g0g

data/AppInfo/1Q6jSTtCCNMU

data/AppInfo/1QH0ihxqby5o

data/AppInfo/1U3vcQSHHcDt

data/AppInfo/1XWZ8niR4eOs

data/AppInfo/1YH2x6vTMgZ5

data/AppInfo/1jFjWijK1tlG

data/AppInfo/1qDOmp4EA7Ko

data/AppInfo/1tLqdCLvP52x

data/AppInfo/1tSW17bJcNPP

data/AppInfo/1vSczjGR8fxC

data/AppInfo/24urAyHLKWt4

data/AppInfo/2Bwb7zCCeFh2

data/AppInfo/2Ge7r5mJRhEc

data/AppInfo/2GuBWezP1DtE

data/AppInfo/2MFdQHZ18j9X

data/AppInfo/2MLWe4wtEkqn

data/AppInfo/2MoIummwOoWG

data/AppInfo/2QrlLoCuVPnb

data/AppInfo/2ROLBeVPhlIw

data/AppInfo/2V1WRYsK1LjV

data/AppInfo/2XzqYf9x2RWE

data/AppInfo/2Z8t1I5KCtNn

data/AppInfo/2eQBKrjtx5vw

data/AppInfo/35fOmjuer2lo

data/AppInfo/3BL5G4VGuwuC

data/AppInfo/3BbIOVbR5Osf

data/AppInfo/3D09Xvriz0n2

data/AppInfo/3J1EpaUCkcHJ

data/AppInfo/3JzsgBXeiNLf

data/AppInfo/3VJQn2vTxHH5

data/AppInfo/3Vgi31O5S8Ig

data/AppInfo/3XNeiqCPDypL

data/AppInfo/3Z4ee8gpykDO

data/AppInfo/3avtxoSy7rE3

data/AppInfo/3dGmeXUahVJJ

data/AppInfo/3eKs8wZEsuj4

data/AppInfo/3iGbrtgDKHeV

data/AppInfo/3mX6MTkt3I34

data/AppInfo/3mk50lBrAcNf

data/AppInfo/3srvyAcxulG6

data/AppInfo/3uz5Jp5H663Q

data/AppInfo/3vpNjj2xrrou

data/AppInfo/3xyVYuqebr32

data/AppInfo/46uOqz0CK5NU

data/AppInfo/495JGv7hONwf

data/AppInfo/4BzyJpqw5bDT

data/AppInfo/4CvOo8Fr0QZT

data/AppInfo/4Eb6klfLBijM

data/AppInfo/4GvstXsYOOy9

data/AppInfo/4O8KUTc9Qmno

data/AppInfo/4OKj0cYlLUah

data/AppInfo/4PTQI0B9B3Ew

data/AppInfo/4TywbptVrLXC

data/AppInfo/4cYq25Yfh1Tb

data/AppInfo/4oaZ0kr8DLhL

data/AppInfo/4r0BUc4mmUbm

data/AppInfo/4uBlQ6xo0p0N

data/AppInfo/4v5wiJh6WuP9

data/AppInfo/4vsGFd1j65Ls

data/AppInfo/4zLjRo0xugS4

data/AppInfo/59JEr4MPF9kL

data/AppInfo/5FdCr2TPY6H6

data/AppInfo/5Lu7653STGzy

data/AppInfo/5MxuIEephj4R

data/AppInfo/5NTfKzW3LuKK

data/AppInfo/5SOkFPodteKk

data/AppInfo/5TW4MS4CXXFG

data/AppInfo/5dvROcq6vFp1

data/AppInfo/5nHZeoPUfDpj

data/AppInfo/5qpqVMZ4Wv7G

data/AppInfo/5rtm1djdWcFK

data/AppInfo/5sw63kIHsecF

data/AppInfo/6221fxR2CmrN

data/AppInfo/6BUyKIJnmNYy

data/AppInfo/6DMPdOrjvYhe

data/AppInfo/6DqqhW6x6ZIC

data/AppInfo/6IWpMogIe2Nl

data/AppInfo/6J1zWYigiW5P

data/AppInfo/6JoJ5uBU1Hrd

data/AppInfo/6L2V0uYpthFp

data/AppInfo/6T4heSLSYQlf

data/AppInfo/6Wit15eN27Rb

data/AppInfo/6WzsgbALic6t

data/AppInfo/6dxESCElGJGB

data/AppInfo/6gpBen10P4Sk

data/AppInfo/6h7HQZUWBP3a

data/AppInfo/6kpbO6oRpt8V

data/AppInfo/6lduq6kkreC6

data/AppInfo/6m6cGx3egXRK

data/AppInfo/6qM5EeE6f9FY

data/AppInfo/6rrueonLti60

data/AppInfo/6wDCQJ6ndMHi

data/AppInfo/6wE5N6ukwgzt

data/AppInfo/6y3OQLACcp3T

data/AppInfo/6yelkH6m8Yc6

data/AppInfo/6zAkU8us4GoV

data/AppInfo/73HSIzxuVsHN

data/AppInfo/74hl3hUjB6FX

data/AppInfo/7Ca1Ry67entD

data/AppInfo/7JhZ1Jgf30md

data/AppInfo/7Us25vWHgzzG

data/AppInfo/7XBt58aBYFCn

data/AppInfo/7YH1MQR4tYwm

data/AppInfo/7ZMzuw6mlNAS

data/AppInfo/7c150PXYNDTW

data/AppInfo/7elqLwIDqwt9

data/AppInfo/7ijBiV4yXF0N

data/AppInfo/7jUXC2eEF6Fq

data/AppInfo/7kcrp3lVWaFO

data/AppInfo/7oljVrYghIp0

data/AppInfo/7rYOw69a4Rse

data/AppInfo/7zvAVAAysoX1

data/AppInfo/8588hlXqEYpL

data/AppInfo/873JPJVjo4QX

data/AppInfo/8PhYi8PWnYQH

data/AppInfo/8W7SRETYex8y

data/AppInfo/8WwmsQCLTyL7

data/AppInfo/8ciUV54SgRIM

data/AppInfo/8iilaDz1YtLC

data/AppInfo/8mbWXnYpmJqp

data/AppInfo/8rNaflmpEGz5

data/AppInfo/8zow6ZKGLy9p

data/AppInfo/94leGzvsW82V

data/AppInfo/97RhDEcPlVqZ

data/AppInfo/9EkyJZaOyzF7

data/AppInfo/9GEpkaWkAgkV

data/AppInfo/9I3Mflkc8NAD

data/AppInfo/9QZ8uTI5Yqql

data/AppInfo/9bgVkLprvgTY

data/AppInfo/9ds5y5tBvO7s

data/AppInfo/9nkFjZAiUc8I

data/AppInfo/9taATVQeLS3F

data/AppInfo/A2kMXhSE7P5Y

data/AppInfo/A7X14Ees1NRz

data/AppInfo/A7btFbgUdLge

data/AppInfo/A84KXOmZEADk

data/AppInfo/AFHviLBqSlUD

data/AppInfo/AKe7DgoyUiaL

data/AppInfo/AKeme6R3xLKL

data/AppInfo/AKkNVsUE6MvF

data/AppInfo/AQpwwnqO40Oo

data/AppInfo/ATDFXKMQOkoP

data/AppInfo/ATg8sq1h9f0B

data/AppInfo/AVJPB6ojo7go

data/AppInfo/AVqNHLXun91R

data/AppInfo/AWyx538fNGMr

data/AppInfo/AqikUdN9jvPs

data/AppInfo/At257lLe2dhS

data/AppInfo/B6X6wbZEA14r

data/AppInfo/B72sVgIIEJOL

data/AppInfo/B8ebNZcgteyv

data/AppInfo/BGJuFkVdHrE3

data/AppInfo/BGWxTQdd26RC

data/AppInfo/BIXVStgoOnl7

data/AppInfo/BIhQap4XIZ7g

data/AppInfo/BKFDAUIv9w9V

data/AppInfo/BSLLBmGFinEf

data/AppInfo/BUjwsf6CQRsV

data/AppInfo/BXF6E3Sm8HOs

data/AppInfo/BZEQ7TjJQcTA

data/AppInfo/BgOdO5T2Ka22

data/AppInfo/BgZn48kTKcFN

data/AppInfo/BiAxYXd39zPK

data/AppInfo/BjAko4ZwTi06

data/AppInfo/BoF3n5DI7JOq

data/AppInfo/C4Fkw0Cjwhwe

data/AppInfo/C9Da9C7vDZoV

data/AppInfo/CFUnq7pkK5eQ

data/AppInfo/CHQ1oObm066q

data/AppInfo/CHV1CrJRGfp6

data/AppInfo/CKLKvij5Syn0

data/AppInfo/CLsqat4NptRH

data/AppInfo/CS9DSKtvjQzj

data/AppInfo/CcKnsbvdIJRo

data/AppInfo/CmoRVPVI9y8t

data/AppInfo/D6dFoxCpvBQn

data/AppInfo/D6qvakRgsS94

data/AppInfo/DDQD3xt2452n

data/AppInfo/DKZUPX9HDxYY

data/AppInfo/DQYNTH9VVQwO

data/AppInfo/DRf0A7CcmABI

data/AppInfo/DTi7bC8sf4Hr

data/AppInfo/DUh36fAbYcg5

data/AppInfo/DZRsa7XuvsY9

data/AppInfo/DeGURBMyERg3

data/AppInfo/DfJ5YSuoM2AE

data/AppInfo/DhOfaXvdJ30a

data/AppInfo/DkknjH2T3uzy

data/AppInfo/DoRsANtoaVaG

data/AppInfo/E2RIVaG8fAQ1

data/AppInfo/E2WkZivI6K5I

data/AppInfo/ECL8GgTAeTHO

data/AppInfo/ECm2o2kgEJb1

data/AppInfo/EDMNFfiPyrlh

data/AppInfo/EDvKl930czmQ

data/AppInfo/EF5hA0nA9Gfo

data/AppInfo/EGQdgbxuhNld

data/AppInfo/EIGZgEINCEkc

data/AppInfo/ELXePIml5wXK

data/AppInfo/EMqqleJo1cC9

data/AppInfo/ENXw8Ao5TngI

data/AppInfo/ES72lu1wJ3bQ

data/AppInfo/ESQ9gFSc6w2Z

data/AppInfo/EVXZ0gwBwlWK

data/AppInfo/EVzSRkAO8yzR

data/AppInfo/EWnfHaWj7cCs

data/AppInfo/EXFdqqFSCSTo

data/AppInfo/EcshjbQiDWoC

data/AppInfo/EmB696GA0IT2

data/AppInfo/Euf74k3HafM8

data/AppInfo/EwOaxuWKwcvB

data/AppInfo/F3IcNPbozHaS

data/AppInfo/F9qxTcYDxNlb

data/AppInfo/FEYuWXKGDb0p

data/AppInfo/FJJuzRopnzsi

data/AppInfo/FPsapaKap92d

data/AppInfo/Fa1hCL9gLjE4

data/AppInfo/Fa75rFoVZVDo

data/AppInfo/FlUkPeGPrGl5

data/AppInfo/Fpmn3pDMceAc

data/AppInfo/FvkBtxVCeXVF

data/AppInfo/Fz5H5waVm2vP

data/AppInfo/G11j5rz4sJbF

data/AppInfo/G3sYuCM0SgM1

data/AppInfo/GAk7kBAqcDPs

data/AppInfo/GCj0LAHaaITs

data/AppInfo/GFUrf41h5I6k

data/AppInfo/GMjGgsBqTXtv

data/AppInfo/GMp0MfKnPjMR

data/AppInfo/GRy2ED48OB2R

data/AppInfo/GUD0n12TQ64W

data/AppInfo/GZcNASayraXO

data/AppInfo/GhIiv8fE2A8h

data/AppInfo/GiJGTas1xcRG

data/AppInfo/GicAC0Z3vffv

data/AppInfo/Glo4ilOmngJa

data/AppInfo/Gn5tFFaRzgk2

data/AppInfo/Gq5J6g21XlD5

data/AppInfo/H1WgM4InynW2

data/AppInfo/H551xH2cMsbU

data/AppInfo/H5P2AoTEYhWj

data/AppInfo/H8JB1G2hseRi

data/AppInfo/H96TQCeHF2kU

data/AppInfo/HOonAGPQiEKL

data/AppInfo/HRp8cFpQwNQw

data/AppInfo/HUGlaYLTgqvj

data/AppInfo/HXwzlThzzgAH

data/AppInfo/HdrmV69AQICE

data/AppInfo/HfIhoQaLzVtY

data/AppInfo/Hg5jogXROo2Z

data/AppInfo/HiNDNzIlemIB

data/AppInfo/HkSGNXcOxV5J

data/AppInfo/HmA0yGSXFG1w

data/AppInfo/HpjSpAQ7hhv5

data/AppInfo/HtuOYiiv65VE

data/AppInfo/HuouXS5dndrD

data/AppInfo/I0USqz1w3spW

data/AppInfo/I4COpMFDOcj8

data/AppInfo/I5H6iAGYI8XV

data/AppInfo/IEvWXqGUxKx7

data/AppInfo/IKnuGLHhEG7n

data/AppInfo/IL75cvK56EGw

data/AppInfo/IMQbgnJGnZJS

data/AppInfo/IS2voqFklybl

data/AppInfo/IWufjWw1nom2

data/AppInfo/IX5YquaAWozS

data/AppInfo/IYKQzoPnWz3k

data/AppInfo/IgvPU75I9cUo

data/AppInfo/IjsS576rsbpD

data/AppInfo/J0Omikp11aJs

data/AppInfo/J6aPxVlR03Ok

data/AppInfo/JLWy23Ux0fId

data/AppInfo/JMDNyaAiUsj2

data/AppInfo/JRVaLTn0h4KC

data/AppInfo/JZiwvrwxuV7h

data/AppInfo/JgFBAOHcKKhy

data/AppInfo/JhyNvXpk1Vpy

data/AppInfo/JiMoZhzv2vG6

data/AppInfo/JjeOhSLlxLnE

data/AppInfo/Jo7EuLfWM5hK

data/AppInfo/JtPNTtHvTSJU

data/AppInfo/JtS7HAUZbZi5

data/AppInfo/JuHpeJNmqpFo

data/AppInfo/JuvDipH9xPlL

data/AppInfo/JyWCeyEA1k39

data/AppInfo/K0iHYh1Y5OLy

data/AppInfo/K5vsOLK2Ggzi

data/AppInfo/K5xHKhuc3G6H

data/AppInfo/K6GBK99iQ7bj

data/AppInfo/K6wBBLhLD4S4

data/AppInfo/K7fD3DSfxbzV

data/AppInfo/KArMYjE12ZgI

data/AppInfo/KBCL3LW5oxMc

data/AppInfo/KC8qzxkq3RXi

data/AppInfo/KFDOXvzqDKNH

data/AppInfo/KJ65Zb0VpLvd

data/AppInfo/KLI410nsfarI

data/AppInfo/KQpUcA4zh72Y

data/AppInfo/KRRolbSyQnfp

data/AppInfo/KTizgsLHbpKh

data/AppInfo/KW798nmvNK32

data/AppInfo/KXdySA9okuhh

data/AppInfo/Ke1riSVN0KwQ

data/AppInfo/KisNw78lf6C8

data/AppInfo/KnIikjd5N5rI

data/AppInfo/Ko2sXLuIzgir

data/AppInfo/KqZFqlrywXej

data/AppInfo/KsQy5MECr4HN

data/AppInfo/KtBLfWM2UIoY

data/AppInfo/Kw3W5hcuOuut

data/AppInfo/KzrKTVI6qBI8

data/AppInfo/L7A6ddvHFMvP

data/AppInfo/L82kNBm3WkYW

data/AppInfo/LA87rddZ6rDY

data/AppInfo/LAozNhIkMrKE

data/AppInfo/LDJn5VVAFwV7

data/AppInfo/LEp5XNBdcrXm

data/AppInfo/LFdQULKTuGBm

data/AppInfo/LGK2GmoGNH49

data/AppInfo/LI4od2v7Vnk9

data/AppInfo/LIZY6OLJE1U5

data/AppInfo/LIpK4ZNucatg

data/AppInfo/LJx6CWyYifhx

data/AppInfo/LK1QCbojyRO0

data/AppInfo/LKGVoIcJ0gTz

data/AppInfo/LKQ7hEkyOpNO

data/AppInfo/LMaYtIQuTKS3

data/AppInfo/LOv4c1AOSB27

data/AppInfo/LQ6AKGK8x9ik

data/AppInfo/LQlIWH3LmBop

data/AppInfo/LQxy2DkKjqrN

data/AppInfo/LSCkHJe1aH8G

data/AppInfo/LVgCVXjzDsbA

data/AppInfo/LWQd2SAZE3KX

data/AppInfo/LWSHErCAHoN9

data/AppInfo/LWSKqAlVJvdO

data/AppInfo/LWxFpdzH4CLC

data/AppInfo/LX17zU9C4NIq

data/AppInfo/LZLcbjf3h3oU

data/AppInfo/LZbjT0zowxwD

data/AppInfo/Launcher.dll

.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

data/AppInfo/Launcher.exe

.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18/09/2019, 12:58

Not After

11/12/2022, 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e
Signer

Actual PE Digest

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress

GetModuleHandleW

lstrcmpiW

MultiByteToWideChar

LoadLibraryExW

ExitProcess

LocalAlloc

LocalFree

FormatMessageW

WaitForSingleObject

GetExitCodeProcess

CreateThread

SetLastError

EnterCriticalSection

LeaveCriticalSection

GetCurrentThreadId

FindResourceExW

GetACP

WideCharToMultiByte

FreeResource

SetFilePointer

ReadFile

CreateFileW

CreateFileMappingW

MapViewOfFile

IsBadReadPtr

UnmapViewOfFile

GetCurrentProcessId

EnumResourceNamesW

GetFileAttributesW

GetFileSize

OpenEventW

SetEvent

ExpandEnvironmentStringsW

Sleep

FlushFileBuffers

GetFileType

WriteFile

WriteConsoleW

GetStringTypeW

SetStdHandle

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCPInfo

GetOEMCP

CloseHandle

FindNextFileW

FindFirstFileExW

FindClose

GetFileSizeEx

GetConsoleCP

ReadConsoleW

GetConsoleMode

SetFilePointerEx

LCMapStringW

GetStdHandle

GetModuleHandleExW

GetCommandLineW

GetCommandLineA

TlsFree

TlsSetValue

TlsGetValue

TlsAlloc

GetModuleFileNameW

SizeofResource

LockResource

LoadResource

FindResourceW

GetProcessHeap

DeleteCriticalSection

HeapDestroy

DecodePointer

HeapAlloc

HeapFree

RtlUnwind

GetSystemTimeAsFileTime

QueryPerformanceCounter

GetStartupInfoW

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

CreateEventW

WaitForSingleObjectEx

ResetEvent

InitializeCriticalSectionAndSpinCount

LoadLibraryExA

VirtualFree

VirtualAlloc

IsProcessorFeaturePresent

FlushInstructionCache

GetCurrentProcess

InterlockedPushEntrySList

InterlockedPopEntrySList

InitializeSListHead

EncodePointer

OutputDebugStringW

IsDebuggerPresent

FreeLibrary

RaiseException

HeapReAlloc

GetLastError

HeapSize

InitializeCriticalSectionEx

IsValidCodePage

user32

UnregisterClassW

MessageBoxW

GetDlgItem

SetWindowPos

MapWindowPoints

GetClientRect

wsprintfA

GetWindowRect

GetMonitorInfoW

MonitorFromWindow

GetWindowLongW

GetWindow

SetTimer

SendMessageW

GetParent

SetWindowTextW

CharNextW

DispatchMessageW

TranslateMessage

PeekMessageW

MsgWaitForMultipleObjects

CreateWindowExW

DestroyWindow

LoadCursorW

GetClassInfoExW

RegisterClassExW

CallWindowProcW

SetWindowLongW

DefWindowProcW

DialogBoxParamW

EndDialog

GetActiveWindow

KillTimer

advapi32

RegDeleteValueW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegSetValueExW

RegQueryValueExW

CreateProcessWithLogonW

RegDeleteKeyW

RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID

CLSIDFromString

CoUninitialize

CoGetObject

CoGetInstanceFromFile

CoInitialize

CoCreateInstance

CoTaskMemAlloc

CoTaskMemRealloc

StringFromGUID2

CoTaskMemFree

oleaut32

VariantCopy

VariantClear

SafeArrayUnaccessData

VariantChangeType

SafeArrayAccessData

SysAllocString

SysFreeString

VariantInit

VarUI4FromStr

LoadTypeLi

LoadRegTypeLi

SysStringLen

LoadTypeLibEx

SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertCloseStore

CryptMsgClose

CryptQueryObject

version

GetFileVersionInfoW

VerQueryValueA

GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/AppInfo/Launcher.exe.manifest

data/AppInfo/LbZq3UYZdILw

data/AppInfo/Lchq65k6zEDr

data/AppInfo/LdSo3s9K8mw2

data/AppInfo/LhSiXLHCwPsR

data/AppInfo/LhzHl06BpFZW

data/AppInfo/LjLLLc5gxiK8

data/AppInfo/LjLdILexdSa0

data/AppInfo/LmXnEcLMFyH8

data/AppInfo/LngBtQJ388Oi

data/AppInfo/LpK8LnSkRvGm

data/AppInfo/LpP0kEmEAeFn

data/AppInfo/LqKjRZ5uThOJ

data/AppInfo/Lu2aj8lOlaLW

data/AppInfo/Luki64pxv1fX

data/AppInfo/LzI1CUIaCojt

data/AppInfo/M33Z11DGdl4E

data/AppInfo/M3dMohFWWUQY

data/AppInfo/M8VAKbYNTaoZ

data/AppInfo/MB5yEvBnzgZz

data/AppInfo/MBUinzYXzpkB

data/AppInfo/MBw1CcyVWzkV

data/AppInfo/MCDwo5THUYmv

data/AppInfo/MFQ08gjct677

data/AppInfo/MOIekg0uiN63

data/AppInfo/MPPmpB8phvsm

data/AppInfo/MSgSkdxz7MHG

data/AppInfo/MSmWNfD8YJ2Y

data/AppInfo/MTcSXyMKXQYe

data/AppInfo/MV1TNeMRj3zy

data/AppInfo/MWH3E5lT9qzI

data/AppInfo/MXT2MtQeVWlW

data/AppInfo/MYRMbUVqVFJW

data/AppInfo/MbXH572TlXy5

data/AppInfo/MdyTfcHL1pAF

data/AppInfo/Mi1Lqh2O84T1

data/AppInfo/MjE5f30ZpkLx

data/AppInfo/MjGpeauVEwiQ

data/AppInfo/MjLywdSbULvA

data/AppInfo/MlQNvsC9UYGt

data/AppInfo/MmSBapYFRJhu

data/AppInfo/MmgSywtEMoaa

data/AppInfo/MoFGeY7I3fCS

data/AppInfo/MqYYunP65cHg

data/AppInfo/MvWB6Sz8bfhc

data/AppInfo/MwupQmtxncrV

data/AppInfo/N1foWuPrKfaf

data/AppInfo/N35ygjndLF5b

data/AppInfo/N3wTsKprtCcp

data/AppInfo/NAYRwZFw6eaM

data/AppInfo/NBxR9iQLa44Q

data/AppInfo/NEYrqpskjLZB

data/AppInfo/NExVzrafq9C6

data/AppInfo/NG0mZJy47MtK

data/AppInfo/NG9auhMHp7Xx

data/AppInfo/NHtnEnetGdzB

data/AppInfo/NIPxP9HOuSVN

data/AppInfo/NNIyY5BBnVxO

data/AppInfo/NVCtJUaAzTe0

data/AppInfo/NaTEeLXj0PzN

data/AppInfo/NcChgo838JVw

data/AppInfo/Nf1Cilaw0HYB

data/AppInfo/Ni3PNXP0srZj

data/AppInfo/NiBCsRf2lZd0

data/AppInfo/Nl9QAjl6oPP2

data/AppInfo/NlfcmlkkFQc1

data/AppInfo/NqhVnRVpIDgu

data/AppInfo/NvSOZEkc3a23

data/AppInfo/Nwd83r4bRA09

data/AppInfo/NzpCpJUwZ4cR

data/AppInfo/O3I7HRLLL0Yr

data/AppInfo/O86lB7yydUED

data/AppInfo/O8smeDRKqUNR

data/AppInfo/ODBhZRvB7bdu

data/AppInfo/ODmSB95kgYDT

data/AppInfo/OEAIqJdA0mlC

data/AppInfo/OG0f75rC1YQd

data/AppInfo/OGfHChHi6CAp

data/AppInfo/OHNjierWvkRL

data/AppInfo/OMV6CJ8RgnYq

data/AppInfo/ONNpFyqMYjtg

data/AppInfo/OOYcSmdIc6iH

data/AppInfo/OOlFWH8q1rHl

data/AppInfo/OPAmFMjLO0XP

data/AppInfo/OPZE2fD7wbu3

data/AppInfo/OXTNFPYvHLWT

data/AppInfo/OYZqwjT6JjLT

data/AppInfo/OZ6qZ1LF5O6U

data/AppInfo/Oi4a3nkpJTYu

data/AppInfo/OjOgOWX5Skmu

data/AppInfo/OmAZiD2RUiQq

data/AppInfo/OmCvOwxkz42m

data/AppInfo/OoGEacPamWEP

data/AppInfo/OtE2gsmBGEyg

data/AppInfo/OtOPOFv8UwT6

data/AppInfo/OxH6jfJWyhvt

data/AppInfo/OxzlgY5cJKJ5

data/AppInfo/P1QdtSzSx9RS

data/AppInfo/P2lHLjz1nJoH

data/AppInfo/P56cZn38i3Oq

data/AppInfo/P5ZSZx1D5Aw6

data/AppInfo/P6zC6Ujb9R7c

data/AppInfo/P7doRP26K5Nu

data/AppInfo/P97a2bxZ4LrT

data/AppInfo/P9FWKNT5muhG

data/AppInfo/PB8G54pkYX8B

data/AppInfo/PBQpVmjoC3Ue

data/AppInfo/PC6WQWntyxwW

data/AppInfo/PCyAwJjadWxA

data/AppInfo/PHDRWK9mdX2z

data/AppInfo/PHofOLUZNvHJ

data/AppInfo/PJvO0U8Qr74m

data/AppInfo/PTsiHdukRhWS

data/AppInfo/PW5m7LM7tH2V

data/AppInfo/PWDZYjwUUjBL

data/AppInfo/PaaZ7INWjg9V

data/AppInfo/PbgFlYbtvx0T

data/AppInfo/PcPCPqSzHaXu

data/AppInfo/PceEnEhsPhcB

data/AppInfo/Pd0dFscqCxOQ

data/AppInfo/PjmQHVGajdkk

data/AppInfo/PjsY1S3FKsat

data/AppInfo/PnuPAaUUIBU1

data/AppInfo/Ps1x5pjwzJMe

data/AppInfo/PtAKBAgc7Wi2

data/AppInfo/PtWbmrkPXY29

data/AppInfo/PwkTWVYguGvO

data/AppInfo/Pzf0c7BQwQJr

data/AppInfo/Q0S2ZgDwIRaK

data/AppInfo/Q0tLACghA9V3

data/AppInfo/Q24Or2El4VDr

data/AppInfo/Q2Abh2RVq1ow

data/AppInfo/Q3uw5XukC41n

data/AppInfo/Q49teUkRaAl3

data/AppInfo/Q4zFPDAoEGcX

data/AppInfo/Q5FJeBfyvHZ6

data/AppInfo/Q5pXkebd3JoZ

data/AppInfo/Q70Rt5ZAuMop

data/AppInfo/Q8G7e8Ywc9GZ

data/AppInfo/Q8MszQ04NuCZ

data/AppInfo/Q8z6vjV6jmvR

data/AppInfo/QAbJokWsVRTk

data/AppInfo/QH90hMCQdcQe

data/AppInfo/QHtH0fjQcbqX

data/AppInfo/QI9woF8Glj9E

data/AppInfo/QLS0wTTqyWMl

data/AppInfo/QRN2ghP5SgoV

data/AppInfo/QUn4Dl470lEy

data/AppInfo/QVjZsL2GJbGl

data/AppInfo/QaNSjb8nssDj

data/AppInfo/Qab0zcu9v1tW

data/AppInfo/QbI5seVZsnkY

data/AppInfo/QberK6jiwBit

data/AppInfo/QcHB5AqZqJ23

data/AppInfo/QcrMHGPAlHXF

data/AppInfo/QdRFJm5Ftus1

data/AppInfo/Qe8T5icKAD1B

data/AppInfo/QevVPw4u4xIa

data/AppInfo/QevXdUm50hB7

data/AppInfo/QkDYf9j2LSHU

data/AppInfo/QmUfQH1KlX5b

data/AppInfo/QuNWr83A66k7

data/AppInfo/Qw3zkvlnYlw7

data/AppInfo/QyrujX3gckZh

data/AppInfo/Qz16QCFYgDND

data/AppInfo/R0DYpRGLIu7l

data/AppInfo/R6Bi42I9qJJ8

data/AppInfo/RIBTwoUATqEp

.ps1

data/AppInfo/RIGv3LO1cJBv

data/AppInfo/RbNyjy7bsetF

data/AppInfo/RcNZ3iOxzlwP

data/AppInfo/RfxTSgTtW9FY

data/AppInfo/RiddTdB8ebHZ

data/AppInfo/Rik3zqadTbVo

data/AppInfo/RiubUSPLmVjT

data/AppInfo/RkkCz8no6ETa

data/AppInfo/Rkt3XDqbBwZO

data/AppInfo/RpjbHPCU4Er5

data/AppInfo/RrNHgnZcLs3n

data/AppInfo/RucfgofYQaow

data/AppInfo/S8PEQpXVH307

data/AppInfo/S9mCxdgGFHsT

data/AppInfo/SDtUL2uWGb6M

data/AppInfo/SEFGw6ovEoVQ

data/AppInfo/SYAyOr0g6flQ

data/AppInfo/ScVqkLzVbnwn

data/AppInfo/SgzEzAAVIu4a

data/AppInfo/Sil9YWM2hb8l

data/AppInfo/SmssCsBnnZzT

data/AppInfo/Sr8La9JmasHA

data/AppInfo/StHt8EE3o1Tg

data/AppInfo/SwrY8zEcQRcB

data/AppInfo/SxeBTArt97SE

data/AppInfo/SycQmG5c0IVX

data/AppInfo/SzROF6ebc1c0

data/AppInfo/T2g5XChGDcjo

data/AppInfo/T3WRNLPiIc9h

data/AppInfo/T3zBBh15yq3v

data/AppInfo/T441ltH7nfWS

data/AppInfo/T9GmfWOTsnog

data/AppInfo/T9J3jTucXWos

data/AppInfo/TBmZGEirjsEq

data/AppInfo/TErXFsRke5rn

data/AppInfo/TF8j3OuDFNeF

data/AppInfo/TFtyTBfuOOsY

data/AppInfo/TGRK0nK8lWNR

data/AppInfo/TH155oyDRyva

data/AppInfo/TKHREgB1WH6D

data/AppInfo/TMgLJRlPQ7ku

data/AppInfo/TN0PAtLVzTp3

data/AppInfo/TNJMT0hpmxdm

data/AppInfo/TOj53qfivwda

data/AppInfo/TOoynciTh7GQ

data/AppInfo/TQRv0tYroqm2

data/AppInfo/TXQpkxLCxeMK

data/AppInfo/TZVfTVEEkJ4G

data/AppInfo/TZmSKumVUHS4

data/AppInfo/TaVwjZv8hrsc

data/AppInfo/TgeJQGm1yg9c

data/AppInfo/TigcV2O2sjqW

data/AppInfo/TkMu1bH6Estb

data/AppInfo/TluN28JI3GD4

data/AppInfo/ToUl9oP40dxO

data/AppInfo/TpdYnHXZ7aUk

data/AppInfo/TzlWUOLYPCXA

data/AppInfo/U1WuMrFaiZCJ

data/AppInfo/U4S9pqWA14F5

data/AppInfo/U6gqKoNf13He

data/AppInfo/U8njoTcGifSg

data/AppInfo/UCVMRVCgdhTy

data/AppInfo/UCgI5r3t1X5o

data/AppInfo/UEV4SXeAfARy

data/AppInfo/UFgvTjCW2avN

data/AppInfo/UGMNywZf3No1

data/AppInfo/UK9VsxYGTaYp

data/AppInfo/UMI94ip5qAcy

data/AppInfo/UNdtJKBxbUzN

data/AppInfo/UPagZspsA2VB

data/AppInfo/UQsHXoGzzDNq

data/AppInfo/US7RqmcrT69f

data/AppInfo/UVXUqFnEgJP3

data/AppInfo/UX7UVuI4W9Nf

data/AppInfo/UXPduRIR21JK

data/AppInfo/UZMEGJ9ojABs

data/AppInfo/UZvjLnFOSyGj

data/AppInfo/UckwUXxLEpJw

data/AppInfo/UcszNhFHKN2O

data/AppInfo/Uf5yf1HTgSMi

data/AppInfo/UhbpvpqUMBI9

data/AppInfo/Ul2Az3W63szo

data/AppInfo/UrINyMsPoxgE

data/AppInfo/UrdZRl5PV12R

data/AppInfo/Ut6gSxNnRY6v

data/AppInfo/UtDOza5wcm7n

data/AppInfo/UuNz2oQ9EvBW

data/AppInfo/V2BQtMqPSTfm

data/AppInfo/V55P8uEclt6k

data/AppInfo/V5bXrccNjrvn

data/AppInfo/VAbtuWhwatEf

data/AppInfo/VDiMCWuYD3XK

data/AppInfo/VG45PuxBEbXa

data/AppInfo/VJDzfrmj9rlr

data/AppInfo/VJHyCxy5Nxj7

data/AppInfo/VLcn7Uioja3Z

data/AppInfo/VMPSv6PtynRr

data/AppInfo/VO1DaL46eflm

.ps1

data/AppInfo/VPjxfW5ZBrBl

data/AppInfo/VQm5TXaJVAuL

data/AppInfo/VWCffGa272lo

data/AppInfo/VXItmoMKQYkP

data/AppInfo/VYNmB3BluYv5

data/AppInfo/VZ9ne7cmgZ5b

data/AppInfo/VbECjvcynHOz

data/AppInfo/VdQdL8Q1KC9d

data/AppInfo/VfGhARTAXW41

data/AppInfo/Vn8JQpGGP3s6

data/AppInfo/W1qLHPo9B125

data/AppInfo/W21s5UO8LXrH

data/AppInfo/W2LPp8bESQWA

data/AppInfo/W3tm9kzFmdzb

data/AppInfo/W59D3ycDSz5y

data/AppInfo/W5KZbAFHYQyO

data/AppInfo/W5oS0xQYjqu8

data/AppInfo/WGtq1C4HUOGE

data/AppInfo/WGuAXdBA1PMA

data/AppInfo/WHdd1wrwcESD

data/AppInfo/WIHDHiSkJr3i

data/AppInfo/WKrYfiJd6IEb

data/AppInfo/WM5HqkgBdiHi

data/AppInfo/WOuwHACAmKe3

data/AppInfo/WQLR63zgqqNC

data/AppInfo/WRJuNYhPMfZn

data/AppInfo/WRcjcZ1SmFTt

data/AppInfo/WSDpIUU1AT9z

data/AppInfo/WSK60MH4s7Fl

data/AppInfo/WXd7hN75hD7b

data/AppInfo/WYSJ8HZmr6x4

data/AppInfo/WaVLZliGvM9p

data/AppInfo/Wd9vPJDbvmHr

data/AppInfo/WfJvhCk9w8SI

data/AppInfo/WisCoVsZfGxp

data/AppInfo/WknxYcM7KCEC

data/AppInfo/WmWwdTAnQeyB

data/AppInfo/Wq7CTqhWXreC

data/AppInfo/WqMTD5Gh6raI

data/AppInfo/WtFlkRqeJ61k

.ps1

data/AppInfo/WyMpYnrh32pC

data/AppInfo/WybuU6jAxM9s

data/AppInfo/X0aktj3ScfRb

data/AppInfo/X5yFdnA3vDym

data/AppInfo/X62hMqghMMKE

data/AppInfo/X7lL16c5n8z1

data/AppInfo/XBNQ1PjuDHjQ

data/AppInfo/XBVzIKhOzpzq

data/AppInfo/XD2T5L8Qfl7Y

data/AppInfo/XErL4GtYzQ2c

data/AppInfo/XJ9lkHXDrDK1

data/AppInfo/XPYk0rtW0Twt

data/AppInfo/XTZC59mkTBKK

data/AppInfo/XVorbw4QikZy

data/AppInfo/XWaVqZuZ3sp0

data/AppInfo/XYFSILqh4VI2

data/AppInfo/XZ59dinJv2Ol

data/AppInfo/XdA6RRoXn8Ig

data/AppInfo/Xfh5GWnGPMjT

.ps1

data/AppInfo/XmTztsXogEla

data/AppInfo/XnbvXFt5qmny

data/AppInfo/Xqn4ol0z8uAs

data/AppInfo/XwFgFKbwryfB

data/AppInfo/XxJzarSBKPpU

data/AppInfo/Xy3LwQB3SNkU

data/AppInfo/Y01meFw8Vwej

data/AppInfo/Y5yT5t2wTyov

data/AppInfo/Y6lG3BElGRqb

data/AppInfo/Y7DoJqA6U54a

data/AppInfo/Y7Npbd2ybqnk

data/AppInfo/YBXP71HMd8Ea

data/AppInfo/YCtum0jPFRZv

data/AppInfo/YDBvJFLZSmno

data/AppInfo/YEnONc99mC7J

data/AppInfo/YHBTWwbYlH01

data/AppInfo/YHnob9SB8Txc

data/AppInfo/YO9fA9dWMezs

data/AppInfo/YQAJperZqmOJ

data/AppInfo/YQlt3mwMKq0K

data/AppInfo/YRG5aY3N7r4x

data/AppInfo/YRIg6dZulcue

data/AppInfo/YVcAJ7O7wfrg

data/AppInfo/YZIQz0T25i7F

data/AppInfo/YafxnIVR0qeF

data/AppInfo/YcxOp2pBPneg

data/AppInfo/YfRNiwI6hkLq

data/AppInfo/Yh9C3eYWnUQr

data/AppInfo/Yj1r0rIpt1je

data/AppInfo/YkzXRDqbTLUz

data/AppInfo/YnCB2BBKstra

data/AppInfo/YvIEhV2g98rT

data/AppInfo/YvWUnjjda0jN

data/AppInfo/YvuQdaNqBhYV

data/AppInfo/YwTGpGD7UtG1

.ps1

data/AppInfo/YxfpuIqEigjQ

data/AppInfo/YzCM9PC7ISXL

data/AppInfo/Z06bLLi0lCUE

data/AppInfo/Z0yxv2Gb9Hyj

data/AppInfo/Z42k9cN1rowv

data/AppInfo/Z4CQNfjHlF6N

data/AppInfo/Z5IzPVBSTUYB

data/AppInfo/Z5zcivjZMzVA

data/AppInfo/Z80MrvfwbDHS

data/AppInfo/Z9DSZtxs63a2

data/AppInfo/Z9EzQjFp7n55

data/AppInfo/Z9l8fXRayq5M

data/AppInfo/ZEPmQbYBsHUt

data/AppInfo/ZEos9mBaM65m

data/AppInfo/ZGRepZ9H5IED

data/AppInfo/ZGlZonRaHB4k

data/AppInfo/ZIJQK6fu6YFj

data/AppInfo/ZKaORZiiGHq6

data/AppInfo/ZN0giDUL4oDR

data/AppInfo/ZNUGjVuQW7zW

data/AppInfo/ZNjeMx43f0nb

data/AppInfo/ZOghv2kWNijj

data/AppInfo/ZOucvhLU0WFK

data/AppInfo/ZRZJyxfSPqiB

data/AppInfo/ZaJH4xBtK8zt

data/AppInfo/ZbbgixNgVlQe

data/AppInfo/Zcu2bBWj0qYm

data/AppInfo/ZdtqV9QTzxzn

data/AppInfo/ZfXVWzz0hC1x

data/AppInfo/ZfXo7ZwxU6Kk

data/AppInfo/ZgtFPUImIfyj

data/AppInfo/ZjlKRzpl7NuB

data/AppInfo/ZjuJX4GQOiV8

data/AppInfo/Zkul9rlzX0ok

data/AppInfo/ZlCORdBVdLEm

data/AppInfo/ZlXDxo9UgNhR

data/AppInfo/ZllL2PKgauUz

data/AppInfo/ZmOtNmJIOFsE

data/AppInfo/ZpRYVN79icMd

data/AppInfo/ZrHqtI8ESwHd

data/AppInfo/Zrde7zlYfhqk

data/AppInfo/ZrrwSjVHMFFY

data/AppInfo/ZswtkJxzZd1R

data/AppInfo/ZuUBofckuZWX

data/AppInfo/ZuxTgdzXra9D

data/AppInfo/ZvH7mb95Rl4a

data/AppInfo/ZwFx1eSlAPe8

data/AppInfo/a01GAprZ4onk

data/AppInfo/a1RJ06XoWdor

data/AppInfo/a2bbmleZFMxp

data/AppInfo/a654eQdWnMGS

data/AppInfo/a6pbupZCmbVz

data/AppInfo/a8RoQrpE3O8R

data/AppInfo/aFefChnygjBS

data/AppInfo/aHp1x9CdtLPQ

data/AppInfo/aI5PKp8Vngcy

data/AppInfo/aLpF4oi8uDo9

data/AppInfo/aPK1cQJ9pLo8

data/AppInfo/aX491LIAbZ5a

data/AppInfo/aXSQNmzioES1

data/AppInfo/aa24wOsiRLks

data/AppInfo/abScDmFJT9Qf

data/AppInfo/acroHjSc6eFG

data/AppInfo/adLqpeVnZlel

data/AppInfo/ae3ZR5XX4XCy

data/AppInfo/ajDLekidZCZo

data/AppInfo/ajs8QcaP1aS8

data/AppInfo/amsoQZVwNsNM

data/AppInfo/aulJowMscPZt

data/AppInfo/axHyv5bXvcSp

data/AppInfo/b1ia7ir9gsmT

data/AppInfo/b3tn3fVgDM7E

data/AppInfo/bARHLs7AyxUJ

data/AppInfo/bBQtEk3ysX49

data/AppInfo/bFx2RfxBvbeG

data/AppInfo/bHRq9xGd1U5O

data/AppInfo/bTG7HAbV6qEL

data/AppInfo/bU91tALdlIV8

data/AppInfo/bfFUabm2JwNb

data/AppInfo/bgL1aNJcnyis

data/AppInfo/bidMT2uIRHgo

data/AppInfo/bj1omlxYc6Dh

data/AppInfo/blUJ6IdPDihh

data/AppInfo/bo7D1h02YbA2

data/AppInfo/bvYUJk8xc5pj

data/AppInfo/c07LCFx83sYC

data/AppInfo/c1H3I1E3SF4A

data/AppInfo/c5BRQWdiaAWK

data/AppInfo/cCKKwPAGwVLM

data/AppInfo/cGDiKJXlFdgO

data/AppInfo/cHlAoUMPMeRE

data/AppInfo/cKV7le9D1AD6

data/AppInfo/cLd4JrV47Zxb

data/AppInfo/cM7EaWOJqgxl

data/AppInfo/cP0Tx0Qk9PVt

data/AppInfo/cSnxl7qD3psH

data/AppInfo/cVlsHzuW0r52

data/AppInfo/cfQZh2TUbpiq

data/AppInfo/ch3b7WJscvVo

data/AppInfo/ch8Wrfn6CWBU

data/AppInfo/cuvFwzsLa0Mg

data/AppInfo/cxa6YqaBncwr

data/AppInfo/czZlto3HsGks

data/AppInfo/d1rPN9dro6jk

data/AppInfo/d3LpDKnoxrPv

data/AppInfo/d7le0rvzylZ8

data/AppInfo/d9ECZcUIfHGD

data/AppInfo/d9X9zkAjIKFP

data/AppInfo/dCMtFkpDKSsi

data/AppInfo/dDrhiXxC4Xmv

data/AppInfo/dJRPpzvNvSRM

data/AppInfo/dRO8NM0KUb7y

data/AppInfo/dU4F09LAsab5

data/AppInfo/dUtuv2vd0JFD

data/AppInfo/dWHnYjA4SQPo

data/AppInfo/dZL6sPhHrEUk

data/AppInfo/dZRIbXLGYUHe

data/AppInfo/dbTTBKjJpwLS

data/AppInfo/ddgEtlOLkOvb

data/AppInfo/ddsX70WNfN8w

data/AppInfo/drZGAaY8ghq1

data/AppInfo/dtb4p86aNCxE

data/AppInfo/e17V96Gv9ZeO

data/AppInfo/e3qP8EVudrd9

data/AppInfo/e7judlnxoufm

data/AppInfo/eE9lhqFrQePi

data/AppInfo/eMhMVXhoAMMf

data/AppInfo/eOEMxxlzaSEG

data/AppInfo/ePXsZXY6ccpM

data/AppInfo/eRAnhYT3VLvG

data/AppInfo/eRX8oAWT0zoT

data/AppInfo/eTcFVWe6cHai

data/AppInfo/eWTV0dZx31Wm

data/AppInfo/eeJCJHguFbTn

data/AppInfo/eepPDUpoRQ7L

data/AppInfo/ejXfid7V0iON

data/AppInfo/erY8V9lwdrv2

data/AppInfo/f6RJXhU3DzYp

data/AppInfo/f7cDcgJQJCpb

data/AppInfo/f9B1zxYcOYnY

data/AppInfo/fCCPBt2NcwH1

data/AppInfo/fNUbra07Z6jw

data/AppInfo/fQ5riZZd7OHV

data/AppInfo/fUn0IGBEgVAV

data/AppInfo/fXHRyR0vzpwX

data/AppInfo/fYAwPmBu269z

data/AppInfo/fYeRsiL2gwWI

data/AppInfo/fZPpaSp2hC14

data/AppInfo/fctniASfXgoJ

data/AppInfo/fdafyMzh6eXc

data/AppInfo/femAE9hahq7V

data/AppInfo/fkJaKKpy9Zff

data/AppInfo/fsPOXAPCd9cY

data/AppInfo/ftD2V4ATrIvq

data/AppInfo/fxYjVai1sCNo

data/AppInfo/g354cTOf6GaU

data/AppInfo/g8CHNcMRmUD0

data/AppInfo/g8MJZZcMYjWA

data/AppInfo/gBJ5W84TDWTx

data/AppInfo/gEZCmCXtNZGo

data/AppInfo/gIbhJ4lCnlQw

data/AppInfo/gJorUIm7zoWS

data/AppInfo/gJvYPmXLGrwG

data/AppInfo/gNLca31NkfSD

data/AppInfo/gvuZWgqfVLyC

data/AppInfo/gxpSY6N6uYn0

data/AppInfo/h2hu0YfBAiNG

data/AppInfo/hCNa7wewoTqw

data/AppInfo/hH5VbYUKKQJq

data/AppInfo/hH6G0z1BXVOZ

data/AppInfo/hNUKhjmc4d3U

data/AppInfo/hSLeUVNiUKax

data/AppInfo/hTA7roUUAQ6J

data/AppInfo/hTgqrxYuXKyL

data/AppInfo/hURztk204DTg

data/AppInfo/hUTEHNXRDQ9b

data/AppInfo/hWVgjhnJP9pk

data/AppInfo/hcJk6RAtkn34

data/AppInfo/hgKALpzFwo87

data/AppInfo/hkmWjH31dvXe

data/AppInfo/hlJgZw0Ksf7G

data/AppInfo/huu4D6MOrhs1

data/AppInfo/hw9DZv3yvDdQ

data/AppInfo/i02cYellNARB

data/AppInfo/i25u5Jn6JOpF

data/AppInfo/i51sWRUWvA46

data/AppInfo/iBeCdTPpZLib

data/AppInfo/iFiq3NGncNnd

data/AppInfo/iIhb4d95SdB0

data/AppInfo/iLgLTRGoTM2S

data/AppInfo/iNWNsT8xXK3j

data/AppInfo/iNcB6iNHIMHU

data/AppInfo/iRmlCRvI307D

data/AppInfo/iTGpLwi31r8B

data/AppInfo/iclTli824Rgc

data/AppInfo/iftQCeyDtdUM

data/AppInfo/ifzK1kYQjSPF

data/AppInfo/iitdkg8dLAjT

data/AppInfo/ilrXuw180bH8

data/AppInfo/inSmpI1om6L3

data/AppInfo/ipbUnXIBfKRO

data/AppInfo/isZhWboEHky8

data/AppInfo/ixFPfi1uyBJO

data/AppInfo/j0E5lW7qpv6N

data/AppInfo/j2xSsSw2HjzE

data/AppInfo/j41J8H6EBn0V

data/AppInfo/j4vM1kDEPzZN

data/AppInfo/j8x5nW5VtIlr

data/AppInfo/jBG0hpwjDdHW

data/AppInfo/jCGesPAaRx1M

data/AppInfo/jLpqwm4u0bYM

data/AppInfo/jToBvxiusBYz

data/AppInfo/jYo8g4EJ2OeU

data/AppInfo/jfXxoCRWHezf

data/AppInfo/jj445DHxTutS

data/AppInfo/jnpgDm3ArimJ

data/AppInfo/joZmXMFZEMwj

data/AppInfo/jpDS9IxPBkEc

data/AppInfo/jyTpJTOHVQTp

data/AppInfo/k1PFxB3drGfj

data/AppInfo/k3tFmW4YZzf1

data/AppInfo/kFBjyLfO1UII

data/AppInfo/kGCFZO6TPVYy

.ps1

data/AppInfo/kIEgL4PNXbQs

data/AppInfo/kJONp4Kp72mI

data/AppInfo/kMCkaVj7FTEn

data/AppInfo/kMKCiWBWssn5

data/AppInfo/kMMa8qyuB0HE

data/AppInfo/kOsoQxgbKL4u

data/AppInfo/kPp8BKqTJx9m

data/AppInfo/kU5MaWkPJZ0f

data/AppInfo/kVX8IDW84c1L

data/AppInfo/kXl4IQkjiGYV

data/AppInfo/kYzn5A7HmroX

data/AppInfo/kZv17rd7W0Y4

data/AppInfo/kcjYA6llRcIv

data/AppInfo/kewXMdwdfb3d

data/AppInfo/kfaTamNGYjPf

data/AppInfo/kfdRTdvsQyeC

data/AppInfo/kg6j7ns2v4Bi

data/AppInfo/kg7wxJpilmBi

data/AppInfo/khG2uExa7zuf

data/AppInfo/khsWH21QcsPh

data/AppInfo/kkLRLHXqxr22

data/AppInfo/kmg5si50JjfN

data/AppInfo/krnZSIJZss4g

data/AppInfo/ksE3Qshcez4l

data/AppInfo/kvazrYETkP6A

data/AppInfo/kwtHsMihvL8r

data/AppInfo/l2AyQdWt9nkI

data/AppInfo/l5RYyXc6YgdW

data/AppInfo/l7FToiGc2mDw

data/AppInfo/lBFUCYHwqcgW

data/AppInfo/lCCu7kzlGU50

data/AppInfo/lDmsPyx7QeTK

data/AppInfo/lFrnODEwvKfB

data/AppInfo/lGXRWQtn22UH

data/AppInfo/lIHbihvwYZpK

data/AppInfo/lJ3LAgu8LxJV

data/AppInfo/lR4rc7aw4Vzy

data/AppInfo/lSytDf4EVsmU

data/AppInfo/lUCrTD3fi4Yq

data/AppInfo/lUIdHZV0P383

data/AppInfo/lUwdzItROS6p

data/AppInfo/laHw4Cf3dbvp

data/AppInfo/ladyyDz7JPPk

data/AppInfo/lamPOrqqbF9M

data/AppInfo/lcBP5Q9YAQyB

data/AppInfo/ld7Es8uK5NUx

data/AppInfo/lee5uc2zM26j

data/AppInfo/lgYDf9GZ1WBy

data/AppInfo/lhV3GHPuJB4F

data/AppInfo/ljAjw1DWntxV

data/AppInfo/lk8e763hfUq1

data/AppInfo/lmeZ0lQ6IzHn

data/AppInfo/lmo6YMXFLynt

data/AppInfo/ludK5obpUjdE

data/AppInfo/luhOU0gUFS7T

data/AppInfo/lvUZiz7sfpnF

data/AppInfo/lxuf8asDeVfd

data/AppInfo/ly50RaaWhNWv

data/AppInfo/lzK32hF67Y4o

data/AppInfo/m1Qp2BbDRSpm

data/AppInfo/m2mVXXwpE1Od

data/AppInfo/m7HPGKpsHI1y

data/AppInfo/m8Ws4pWDVq7K

data/AppInfo/mEfrKll2I8FX

data/AppInfo/mH1so8NPPsXU

data/AppInfo/mIVUH0TFHG8I

data/AppInfo/mMLnvqxlKwFu

data/AppInfo/mOMZtnWIaplE

data/AppInfo/mRte9HQAFRAF

data/AppInfo/mSDRVqPeclAI

data/AppInfo/mSnuq049xSxs

data/AppInfo/mTGkGqn25zCt

data/AppInfo/mTeiVtn1MOAs

data/AppInfo/mUszYyQwKF8K

data/AppInfo/mUuh3oUdRZLu

data/AppInfo/mVf6mMqs1lmP

data/AppInfo/mZTax2WfdraB

data/AppInfo/maGUGKoFvvH6

data/AppInfo/mce4j4hr7oMb

data/AppInfo/mcxI7T4TBaeX

data/AppInfo/mgRYNLDcnE3A

data/AppInfo/mhNYS87OdOtm

data/AppInfo/mhywZ6vzTPs3

data/AppInfo/mjagBe2rAuAu

data/AppInfo/mkDFMzdmeJ1h

data/AppInfo/mn7JnUlM8Anu

data/AppInfo/mnoV2kmIrdMa

data/AppInfo/ms7DnqZCFoSN

data/AppInfo/muo2dzQIdGUx

data/AppInfo/mvv8JfreGlhi

data/AppInfo/mw4BAJO600il

data/AppInfo/mwaHySufOaSx

data/AppInfo/mx6WELcBoyfz

data/AppInfo/mxAwu3SPbSjC

data/AppInfo/my6zwRREoN2z

data/AppInfo/myEtjhTK0KiY

data/AppInfo/mzTUO48ptWsy

data/AppInfo/n0GhgAOV9GX5

data/AppInfo/n344MwtYFm6l

data/AppInfo/n4PJE52tklFw

data/AppInfo/n5DYFo6pIHhq

data/AppInfo/n5nQtktafpEp

data/AppInfo/n7C7E0w1efd7

data/AppInfo/n7pItrPLAWWe

data/AppInfo/nCieMv86JckY

data/AppInfo/nD7c0vWlLnYR

data/AppInfo/nEDRl6xPRZrY

data/AppInfo/nKR7hbq8CSbO

data/AppInfo/nNw5UHUzQ9Wq

data/AppInfo/nOwAHknBf29R

data/AppInfo/nP6eK5QTrL0q

data/AppInfo/nRamgbHX7cr7

data/AppInfo/nUSomhgy6oC0

data/AppInfo/nVvGfwAiFdFR

data/AppInfo/nZUbvWE0Zhd3

data/AppInfo/nbDzXECXH3BA

data/AppInfo/nbe9T2aWC03m

data/AppInfo/newplugin/01plugins74.rar

.rar

data/AppInfo/newplugin/WinRAR.exe

.exe windows:5 windows x86 arch:x86

93d6ffbeb6eb5774e72f7a9d4e82b889

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/06/2017, 00:00

Not After

01/06/2020, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/06/2017, 00:00

Not After

01/06/2020, 23:59

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

Actual PE Digest

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7

Digest Algorithm

sha256

PE Digest Matches

true

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

Actual PE Digest

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeviceIoControl

BackupRead

BackupSeek

GetShortPathNameW

GetLongPathNameW

GetFileType

GetStdHandle

FlushFileBuffers

GetFileTime

GetDiskFreeSpaceExW

GetVersionExW

GetCurrentDirectoryW

GetFullPathNameW

FoldStringW

LoadResource

SizeofResource

FindResourceW

LoadLibraryExW

CompareStringA

GetCurrentThread

SetThreadPriority

SetThreadExecutionState

CreateEventW

GetSystemDirectoryW

SetCurrentDirectoryW

GetFullPathNameA

SetPriorityClass

GetProcessAffinityMask

CreateThread

InitializeCriticalSection

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

SetEvent

ResetEvent

ReleaseSemaphore

CreateSemaphoreW

GetSystemTime

TzSpecificLocalTimeToSystemTime

GetCPInfo

IsDBCSLeadByte

WideCharToMultiByte

CompareStringW

GetModuleHandleExW

GetCompressedFileSizeW

EnumResourceNamesW

EnumResourceLanguagesW

BeginUpdateResourceW

UpdateResourceW

EndUpdateResourceW

GetLocaleInfoW

GetNumberFormatW

GetLogicalDrives

LockResource

SuspendThread

ResumeThread

GetStartupInfoW

GetCurrentThreadId

FormatMessageW

CopyFileW

GetThreadPriority

SetErrorMode

GetPriorityClass

WaitForMultipleObjects

MulDiv

CompareFileTime

FindNextChangeNotification

HeapSize

GetProcessHeap

SetEnvironmentVariableA

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineA

IsValidCodePage

FindNextFileA

FindFirstFileExA

GetStringTypeW

WriteConsoleW

SetStdHandle

LCMapStringW

HeapReAlloc

GetModuleFileNameA

ExitProcess

GetConsoleCP

ReadConsoleW

GetConsoleMode

SetFilePointerEx

FreeLibraryAndExitThread

ExitThread

QueryPerformanceFrequency

EncodePointer

TlsFree

TlsSetValue

TlsGetValue

TlsAlloc

InitializeCriticalSectionAndSpinCount

RaiseException

RtlUnwind

InitializeSListHead

QueryPerformanceCounter

IsDebuggerPresent

WaitForSingleObjectEx

IsProcessorFeaturePresent

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetFileInformationByHandle

GetLocalTime

FindCloseChangeNotification

FindFirstChangeNotificationW

ExpandEnvironmentStringsW

SystemTimeToFileTime

SystemTimeToTzSpecificLocalTime

FindNextFileW

GetDiskFreeSpaceW

CreateHardLinkW

SetLastError

DosDateTimeToFileTime

LocalFileTimeToFileTime

HeapFree

HeapAlloc

HeapDestroy

HeapCreate

DeleteFileW

SetFileAttributesW

CreateFileW

RemoveDirectoryW

CreateDirectoryW

LoadLibraryW

GetSystemTimeAsFileTime

SetFileTime

SetFilePointer

SetEndOfFile

ReadFile

WriteFile

GetFileSize

FreeLibrary

MoveFileW

GetTickCount

GetCPInfoExW

GetOEMCP

GetACP

GetVolumeInformationW

GetDriveTypeW

Sleep

GetCurrentProcessId

GetCurrentProcess

CreateMutexW

ReleaseMutex

GetLastError

GlobalFree

GlobalUnlock

GlobalLock

GlobalSize

GlobalAlloc

DecodePointer

MultiByteToWideChar

GetVersionExA

GetModuleHandleW

GetProcAddress

GetTempPathW

OpenFileMappingW

CreateFileMappingW

UnmapViewOfFile

MapViewOfFile

CloseHandle

WaitForSingleObject

GetCommandLineW

GetModuleFileNameW

GetDateFormatW

GetTimeFormatW

FindFirstFileW

FileTimeToSystemTime

FileTimeToLocalFileTime

FindClose

Beep

GetFileAttributesW

user32

CopyImage

FindWindowExW

FillRect

MessageBoxW

CreateIcon

EnumWindows

SetForegroundWindow

IsCharAlphaW

FlashWindow

CopyRect

RegisterClassExW

GetSysColor

ValidateRect

DrawIconEx

LoadImageW

SystemParametersInfoW

GetSystemMenu

KillTimer

SetTimer

MessageBoxIndirectW

CharLowerW

ExitWindowsEx

CharLowerA

LoadStringW

GetWindow

SetProcessDefaultLayout

CharToOemBuffW

OemToCharBuffA

OemToCharA

GetComboBoxInfo

RedrawWindow

MessageBeep

CharToOemA

EmptyClipboard

SetClipboardData

CloseClipboard

OpenClipboard

PeekMessageW

GetScrollInfo

EnableMenuItem

CheckMenuItem

GetFocus

MoveWindow

GetClientRect

GetWindowTextLengthW

EndPaint

BeginPaint

UpdateWindow

AppendMenuW

DrawMenuBar

wsprintfW

ScreenToClient

ClientToScreen

CallWindowProcW

PtInRect

SetMenuItemInfoW

GetMenuItemInfoW

InsertMenuItemW

TrackPopupMenu

DeleteMenu

InsertMenuW

GetSubMenu

SetMenu

LoadMenuW

LoadAcceleratorsW

IsChild

RegisterClassW

PostQuitMessage

SetScrollRange

SetScrollPos

ScrollWindowEx

GetClipboardData

LoadIconW

RegisterWindowMessageW

CreateDialogParamW

PostThreadMessageW

IsDialogMessageW

GetIconInfo

CreateIconIndirect

FindWindowW

RemovePropW

GetPropW

SendMessageW

DefWindowProcW

CreateWindowExW

DestroyWindow

SetFocus

GetWindowTextW

GetWindowLongW

SetWindowLongW

SetWindowPos

GetWindowPlacement

SetWindowPlacement

IsWindowVisible

DialogBoxParamW

SetPropW

GetForegroundWindow

TranslateAcceleratorW

CreateDialogIndirectParamW

BringWindowToTop

GetMenuState

GetMenuItemID

GetLastActivePopup

DispatchMessageW

TranslateMessage

DestroyMenu

CreatePopupMenu

GetMenu

IsWindow

WaitForInputIdle

LoadCursorW

EndDialog

GetDlgItem

SetDlgItemTextW

GetDlgItemTextW

SendDlgItemMessageW

GetWindowRect

MapWindowPoints

GetParent

DestroyIcon

CheckDlgButton

PostMessageW

InvalidateRect

EnumChildWindows

GetClassNameW

ShowWindow

CharToOemBuffA

SetDlgItemInt

GetDlgItemInt

GetMessageW

GetMenuItemCount

GetWindowThreadProcessId

WindowFromPoint

SetCursor

GetKeyState

RegisterClipboardFormatW

SystemParametersInfoA

GetDesktopWindow

IntersectRect

GetCursorPos

SetWindowTextW

ReleaseDC

GetDC

GetSystemMetrics

EnableWindow

IsIconic

IsWindowEnabled

IsDlgButtonChecked

CharUpperW

gdi32

TextOutA

SetPixel

Rectangle

GetTextExtentPoint32W

CreateSolidBrush

CreateDIBSection

GetPixel

DPtoLP

StretchBlt

SetMapMode

GetMapMode

GetDeviceCaps

CreateCompatibleBitmap

CreateBitmap

ExtTextOutW

SetBkColor

DeleteDC

CreateCompatibleDC

BitBlt

GetObjectW

TextOutW

MoveToEx

SetTextColor

LineTo

CreatePen

GetTextFaceW

GetTextMetricsW

SelectObject

DeleteObject

CreateFontW

comdlg32

GetOpenFileNameW

GetSaveFileNameW

CommDlgExtendedError

ChooseFontW

advapi32

AllocateAndInitializeSid

AccessCheck

OpenProcessToken

MapGenericMask

GetFileSecurityW

RegCloseKey

IsTextUnicode

RegSetValueExW

RegEnumValueW

RegEnumKeyExW

RegDeleteValueW

RegDeleteKeyW

RegCreateKeyExW

CheckTokenMembership

FreeSid

DuplicateToken

SetFileSecurityW

GetSecurityDescriptorLength

CryptGenRandom

CryptReleaseContext

CryptAcquireContextW

LookupPrivilegeValueW

AdjustTokenPrivileges

RegQueryValueExW

RegOpenKeyExW

shell32

FindExecutableW

DragFinish

DragQueryFileW

Shell_NotifyIconW

DragAcceptFiles

ShellExecuteW

SHGetSpecialFolderLocation

SHAddToRecentDocs

SHFileOperationW

SHGetFolderPathW

ShellExecuteExW

SHBrowseForFolderW

SHGetMalloc

SHChangeNotify

SHGetDesktopFolder

SHGetFolderLocation

SHGetPathFromIDListW

SHGetFileInfoW

ord100

ole32

RevokeDragDrop

RegisterDragDrop

OleUninitialize

OleInitialize

CLSIDFromString

CreateStreamOnHGlobal

CoTaskMemAlloc

CoInitializeEx

CoTaskMemFree

CoCreateInstance

OleSetClipboard

DoDragDrop

oleaut32

VariantClear

SysAllocString

shlwapi

StrCmpLogicalW

SHAutoComplete

powrprof

SetSuspendState

comctl32

CreateStatusWindowW

ImageList_Create

ImageList_ReplaceIcon

InitCommonControlsEx

PropertySheetW

uxtheme

IsThemeActive

IsAppThemed

gdiplus

GdiplusShutdown

GdiplusStartup

GdipCreateHBITMAPFromBitmap

GdipCreateBitmapFromStreamICM

GdipCreateBitmapFromFile

GdipCreateBitmapFromStream

GdipDisposeImage

GdipCloneImage

GdipFree

GdipAlloc

GdipCreateBitmapFromHBITMAP

GdipBitmapGetPixel

GdipBitmapSetPixel

msimg32

GradientFill

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 888KB - Virtual size: 888KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/AppInfo/nfgsnIQrEwH2

data/AppInfo/nhj49yfkLLRe

data/AppInfo/niaNB4jdDq9O

data/AppInfo/nkKR1IVJ3K4N

data/AppInfo/nmz34ipd8diZ

data/AppInfo/npK3iZi7rKCf

data/AppInfo/nswcvJwShq5Q

data/AppInfo/ntWlg6gUdcg1

data/AppInfo/nudPuTOTNr1Z

data/AppInfo/nwULAWhgTkY1

data/AppInfo/o0AfHHDjybiY

data/AppInfo/o0Qp8cBRhjjd

data/AppInfo/o13wPy1eohmJ

data/AppInfo/o2teEQF5ssF8

data/AppInfo/o45Uea6yc8gJ

data/AppInfo/o4dSpwqPX7lY

data/AppInfo/o6c7uuUuImES

data/AppInfo/o8QFfy752XZS

data/AppInfo/o9dBXSfhUlCD

data/AppInfo/oDwKj9tr0gNY

data/AppInfo/oEspw9V5EW3K

data/AppInfo/oJYoKmpVKWbr

data/AppInfo/oKFUL6CXZzYq

data/AppInfo/oPmIV1auYqMy

data/AppInfo/oQQQegGrUziq

data/AppInfo/oRrZBldy9Drt

data/AppInfo/oSXMK4oAZw5j

data/AppInfo/oUi885N5DzOT

data/AppInfo/oVSgTDgdZPWg

data/AppInfo/oWWcA1X8MleV

data/AppInfo/oYYSdVlTu7S4

data/AppInfo/oZ9rTKp1FFC3

data/AppInfo/oZjqor66fn0T

data/AppInfo/oaKkArPdl5rh

data/AppInfo/oaYEfymLyQUg

data/AppInfo/ocWvH85cnvcl

data/AppInfo/odClHivB7eSY

data/AppInfo/oetngJSP6gvM

data/AppInfo/of5IRw3r8RcD

data/AppInfo/ogrKh8jBCaGN

data/AppInfo/okGYCZdq5luk

data/AppInfo/opBD42C7aH5j

data/AppInfo/oqQFMDWTO609

data/AppInfo/oqdJFtHUnvh4

data/AppInfo/os09OM36JSvY

data/AppInfo/otdQxwa2adRN

data/AppInfo/ou4BV5eUNlQ8

data/AppInfo/oyxIqcqS3x5K

data/AppInfo/p0bgXDGYM4t0

data/AppInfo/p1dmJIgWKmrS

data/AppInfo/p2oHbRFWEBvR

data/AppInfo/p4Dbg847q5qu

data/AppInfo/p4SYcHfKMKm9

data/AppInfo/p5sOK4cy2gR9

data/AppInfo/p6EXDNrm4sXG

data/AppInfo/p8ceicNElTNj

data/AppInfo/pDBvvksQm07T

data/AppInfo/pDF9oI3XNqSu

data/AppInfo/pG7iDrLyUBmn

data/AppInfo/pHm5nbgVLeI6

data/AppInfo/pJwHG4aiLTKv

data/AppInfo/pK52Sp52wVM4

data/AppInfo/pKariuVqjUgk

data/AppInfo/pLAkiPhNREsH

data/AppInfo/pLs9CIypeaw6

data/AppInfo/pORZ8dwZuXHo

data/AppInfo/pOfifu3mtx1v

data/AppInfo/pRPBHyGC7DOz

data/AppInfo/pRqdm1Mko96V

data/AppInfo/pUYJeBIEhEWV

data/AppInfo/pWMYHzpFco9U

data/AppInfo/pXilWcFv0Vpi

data/AppInfo/pa6Mpj4br6pn

data/AppInfo/paLnSt0UGgoQ

data/AppInfo/pcCAnr5deu5i

data/AppInfo/pcafRcrxDJnM

data/AppInfo/pdUpOl8A3Yjo

data/AppInfo/pdvmx7bzkqUF

data/AppInfo/pjto7rlqYppd

data/AppInfo/ppR6eFDx0OgZ

data/AppInfo/pqFyfOMEMXVd

data/AppInfo/pqiXrtD0ZGxa

data/AppInfo/psvEcw6x5Fx9

data/AppInfo/ptdX9cQDFsDv

data/AppInfo/pvLGJWBW3LFK

data/AppInfo/pxUiZqDMKH6W

data/AppInfo/pxdVDr3AyZRI

data/AppInfo/pxk2Yi1KnjNy

data/AppInfo/pyEzj2PHvcOQ

data/AppInfo/pyfQvisuFOFT

data/AppInfo/q0KEjeq4S5S8

data/AppInfo/q4PuLyo3WJzp

data/AppInfo/q8UEdmT1Bk5T

data/AppInfo/q9qQp43ZOXQQ

data/AppInfo/qDV2LOUCMYeY

data/AppInfo/qDgpaQFoTdAG

data/AppInfo/qDnu4f4G26Al

data/AppInfo/qDruYYHmUkel

data/AppInfo/qHiyGfzAwhTe

data/AppInfo/qJ1u3PpkOw5K

data/AppInfo/qMyevU5cdJdL

data/AppInfo/qO3erPbEWAQx

data/AppInfo/qR62zPtDf5E9

data/AppInfo/qRarULa6ZWDk

data/AppInfo/qVUGm1tPaFGT

data/AppInfo/qYgo3K4hyyRX

data/AppInfo/qZg4F9NJi9IT

data/AppInfo/qc9pXMjdPaGE

data/AppInfo/qmZCRwjxUZnH

data/AppInfo/qo72HNDnlutq

data/AppInfo/qqWHoimZbUiU

data/AppInfo/r4OkopaldWdp

data/AppInfo/r4PjJIPDxbKR

data/AppInfo/r91AXd8rTAq0

data/AppInfo/rB5a7FG0SiPF

data/AppInfo/rDPCT11wGJVW

data/AppInfo/rEV4olVwas9E

data/AppInfo/rKwGtvl6JhIp

data/AppInfo/rPWR53VHil93

data/AppInfo/rVBSxFoVMqsy

data/AppInfo/rWV6QjIsfFzF

data/AppInfo/rYcv0M2bwXA0

data/AppInfo/ra1H3Arjdib6

data/AppInfo/rb7u2l3NCg1y

data/AppInfo/rbdtQtnWAd8J

data/AppInfo/rd41M5YQXDbZ

data/AppInfo/rizMtZAu4pE1

data/AppInfo/rnpQ0UPPKpCG

data/AppInfo/rsBXmFlRFtJf

data/AppInfo/rtbDQfDT9F5X

data/AppInfo/ru7yz12cnQ3s

data/AppInfo/rwDqmTYSQMdc

data/AppInfo/rzGxTVPa3t2s

data/AppInfo/sDQvWcnjbiyw

data/AppInfo/sIW457qCDYaH

data/AppInfo/sNpnQdAmqTYl

data/AppInfo/sOZo6yCsSetW

data/AppInfo/sOdqkBNkx1iY

data/AppInfo/sbvWpfdHNxFN

data/AppInfo/services/01plugins75.rar

.rar

data/AppInfo/services/7z.dll

.dll windows:4 windows x64 arch:x64

765f6db1819cc227dc53482a9ddde428

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

oleaut32

SysStringLen

VariantClear

VariantCopy

SysAllocString

SysAllocStringByteLen

SysFreeString

SysAllocStringLen

user32

CharUpperW

CharPrevExA

advapi32

SystemFunction036

msvcrt

strcpy

memset

realloc

free

malloc

__CxxFrameHandler

strlen

strcat

strstr

_CxxThrowException

wcscmp

strcmp

memmove

memcpy

memcmp

_purecall

strchr

__C_specific_handler

_beginthreadex

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

__dllonexit

_onexit

_initterm

kernel32

IsProcessorFeaturePresent

InitializeCriticalSection

ReleaseSemaphore

CreateSemaphoreW

Sleep

SetEvent

CreateEventW

SetThreadAffinityMask

ResumeThread

ResetEvent

GetModuleHandleW

WaitForSingleObject

VirtualFree

VirtualAlloc

QueryPerformanceCounter

FileTimeToLocalFileTime

DeleteCriticalSection

LocalFileTimeToFileTime

WaitForMultipleObjects

LeaveCriticalSection

EnterCriticalSection

GetSystemTimeAsFileTime

FileTimeToDosDateTime

DosDateTimeToFileTime

GlobalMemoryStatusEx

GetSystemInfo

GetCurrentProcess

GetProcessAffinityMask

CompareFileTime

GetLastError

MultiByteToWideChar

WideCharToMultiByte

CloseHandle

GetProcAddress

GetCurrentProcessId

GetTickCount

GetCurrentThreadId

GetModuleHandleA

Exports

CreateDecoder

CreateEncoder

CreateObject

GetHandlerProperty

GetHandlerProperty2

GetHashers

GetIsArc

GetMethodProperty

GetNumberOfFormats

GetNumberOfMethods

SetCaseSensitive

SetCodecs

SetLargePageMode

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/AppInfo/services/7z.exe

.exe windows:4 windows x64 arch:x64

8681cffb9505e054b39c818a4e45878f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysStringLen

VariantClear

VariantCopy

SysAllocString

SysStringByteLen

SysFreeString

SysAllocStringLen

user32

CharUpperW

advapi32

OpenProcessToken

GetFileSecurityW

SetFileSecurityW

RegOpenKeyExW

RegQueryValueExW

AdjustTokenPrivileges

LookupPrivilegeValueW

RegCloseKey

msvcrt

_exit

_c_exit

_XcptFilter

_onexit

__dllonexit

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

__C_specific_handler

_beginthreadex

_isatty

memcmp

_purecall

strlen

memset

wcsstr

_cexit

wcscmp

strcmp

memmove

fflush

fputc

fputs

_iob

fgetc

fclose

free

_CxxThrowException

malloc

__CxxFrameHandler

memcpy

__initenv

exit

__getmainargs

_initterm

__setusermatherr

_commode

_fmode

__set_app_type

kernel32

SetThreadAffinityMask

CreateEventW

SetEvent

InitializeCriticalSection

GetVersionExW

CloseHandle

ResumeThread

WaitForSingleObject

VirtualFree

VirtualAlloc

GetConsoleMode

SetConsoleMode

SetFileApisToOEM

GetCommandLineW

GetConsoleScreenBufferInfo

SetConsoleCtrlHandler

IsProcessorFeaturePresent

GetProcessTimes

QueryPerformanceFrequency

QueryPerformanceCounter

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

SetProcessAffinityMask

OpenEventW

UnmapViewOfFile

MapViewOfFile

OpenFileMappingW

GetStdHandle

GetSystemTimeAsFileTime

FileTimeToDosDateTime

GlobalMemoryStatusEx

GetSystemInfo

GetProcessAffinityMask

FileTimeToLocalFileTime

FileTimeToSystemTime

CompareFileTime

GetCurrentProcess

GetDiskFreeSpaceW

GetFileInformationByHandle

SetEndOfFile

WriteFile

ReadFile

SetFilePointer

GetFileSize

GetLastError

MultiByteToWideChar

WideCharToMultiByte

FreeLibrary

LoadLibraryExW

LoadLibraryW

GetModuleFileNameW

LocalFree

FormatMessageW

SetFileTime

CreateFileW

SetFileAttributesW

RemoveDirectoryW

MoveFileW

GetProcAddress

GetModuleHandleW

CreateDirectoryW

DeleteFileW

SetCurrentDirectoryW

GetCurrentDirectoryW

GetTempPathW

SetLastError

GetCurrentProcessId

GetTickCount

GetCurrentThreadId

FindClose

FindFirstFileW

FindNextFileW

GetModuleHandleA

GetFileAttributesW

GetLogicalDriveStringsW

DeviceIoControl

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/AppInfo/srwEgA1AX8MI

data/AppInfo/stZ5LZYAmrpi

data/AppInfo/swNegsjxYNg4

data/AppInfo/tCzD5IjYhTDH

data/AppInfo/tERY6gSlkChT

data/AppInfo/tG4XvPH6a6MG

data/AppInfo/tM4pJ5UDiYmt

data/AppInfo/tNHwg7SMyLhH

data/AppInfo/tNgGkIMOJWT0

data/AppInfo/tNoa5cEWoyC0

data/AppInfo/tOJx9cQqXt28

data/AppInfo/tPQNe2wge5Lb

data/AppInfo/tUDKBBkAwSuU

data/AppInfo/tUYaGO3SEIEA

data/AppInfo/tVJeMiPzXM97

data/AppInfo/tZsEPzDErKmx

data/AppInfo/tbx4waewkM46

data/AppInfo/tchKwWFibkij

data/AppInfo/teeLcVvrJvKk

data/AppInfo/tfkBjZMU0fof

data/AppInfo/tiSrVSHpwAv4

data/AppInfo/tidThlE2l56m

data/AppInfo/tl0OilbEaQoG

data/AppInfo/tmMTNU5xVHP0

data/AppInfo/tmjBU7zcHhYT

data/AppInfo/trtDobJzOeDg

data/AppInfo/tu3Ub25xpTjO

data/AppInfo/tuqrcUt47plq

data/AppInfo/twcWgYcK1xMb

data/AppInfo/txSLtxl2ngIZ

data/AppInfo/tyLfj2Tjc7XL

data/AppInfo/tyTHJszQ9q8H

data/AppInfo/tyVqUSh2J84Z

data/AppInfo/u0l1PdOaFp6U

data/AppInfo/u1jRYsE4tKyT

data/AppInfo/u249jgrNPHdt

data/AppInfo/u3g8pawvDaAx

data/AppInfo/u7Rb0n9KRmXG

data/AppInfo/u7SwcuqStnAz

data/AppInfo/u95rNiXIlxEX

data/AppInfo/uD3yjKKPCDQg

data/AppInfo/uHUyecR4kJgh

data/AppInfo/uI1z6yUaybzE

data/AppInfo/uIk9dTEm9XFE

data/AppInfo/uKQFDQzD1ZXl

data/AppInfo/uKsXHMgusds9

data/AppInfo/uOdz3Eq9atHb

data/AppInfo/uPmtKxDDcomp

data/AppInfo/uPuH4EiZeCj3

data/AppInfo/uYqjeTAbV2Wu

data/AppInfo/ucTeeun97akE

data/AppInfo/ucf9oEu2vLjR

data/AppInfo/ueiMen4cCgRa

data/AppInfo/uhFES9oFsGoM

data/AppInfo/umCQEEHWpRDu

data/AppInfo/unf8eG4lSdRB

data/AppInfo/unjbseidsQjO

data/AppInfo/uoj5ehYFshYs

data/AppInfo/update.dll

.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

data/AppInfo/update.exe

.exe windows:6 windows x86 arch:x86

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

18/09/2019, 12:58

Not After

11/12/2022, 11:53

Subject

CN=Adersoft,O=Adersoft,L=Paris,C=FR,1.2.840.113549.1.9.1=#0c14737570706f72744061646572736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

c0:70:56:49:f9:d6:17:2f:2e:77:36:9d:05:59:8c:ea:94:ba:6b:f4:06:1c:d6:12:39:28:aa:24:63:4a:16:10
Signer

Actual PE Digest

c0:70:56:49:f9:d6:17:2f:2e:77:36:9d:05:59:8c:ea:94:ba:6b:f4:06:1c:d6:12:39:28:aa:24:63:4a:16:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress

GetModuleHandleW

lstrcmpiW

MultiByteToWideChar

LoadLibraryExW

ExitProcess

LocalAlloc

LocalFree

FormatMessageW

WaitForSingleObject

GetExitCodeProcess

CreateThread

SetLastError

EnterCriticalSection

LeaveCriticalSection

GetCurrentThreadId

FindResourceExW

GetACP

WideCharToMultiByte

FreeResource

SetFilePointer

ReadFile

CreateFileW

CreateFileMappingW

MapViewOfFile

IsBadReadPtr

UnmapViewOfFile

GetCurrentProcessId

EnumResourceNamesW

GetFileAttributesW

GetFileSize

OpenEventW

SetEvent

ExpandEnvironmentStringsW

Sleep

FlushFileBuffers

GetFileType

WriteFile

WriteConsoleW

GetStringTypeW

SetStdHandle

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCPInfo

GetOEMCP

CloseHandle

FindNextFileW

FindFirstFileExW

FindClose

GetFileSizeEx

GetConsoleCP

ReadConsoleW

GetConsoleMode

SetFilePointerEx

LCMapStringW

GetStdHandle

GetModuleHandleExW

GetCommandLineW

GetCommandLineA

TlsFree

TlsSetValue

TlsGetValue

TlsAlloc

GetModuleFileNameW

SizeofResource

LockResource

LoadResource

FindResourceW

GetProcessHeap

DeleteCriticalSection

HeapDestroy

DecodePointer

HeapAlloc

HeapFree

RtlUnwind

GetSystemTimeAsFileTime

QueryPerformanceCounter

GetStartupInfoW

TerminateProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

CreateEventW

WaitForSingleObjectEx

ResetEvent

InitializeCriticalSectionAndSpinCount

LoadLibraryExA

VirtualFree

VirtualAlloc

IsProcessorFeaturePresent

FlushInstructionCache

GetCurrentProcess

InterlockedPushEntrySList

InterlockedPopEntrySList

InitializeSListHead

EncodePointer

OutputDebugStringW

IsDebuggerPresent

FreeLibrary

RaiseException

HeapReAlloc

GetLastError

HeapSize

InitializeCriticalSectionEx

IsValidCodePage

user32

UnregisterClassW

MessageBoxW

GetDlgItem

SetWindowPos

MapWindowPoints

GetClientRect

wsprintfA

GetWindowRect

GetMonitorInfoW

MonitorFromWindow

GetWindowLongW

GetWindow

SetTimer

SendMessageW

GetParent

SetWindowTextW

CharNextW

DispatchMessageW

TranslateMessage

PeekMessageW

MsgWaitForMultipleObjects

CreateWindowExW

DestroyWindow

LoadCursorW

GetClassInfoExW

RegisterClassExW

CallWindowProcW

SetWindowLongW

DefWindowProcW

DialogBoxParamW

EndDialog

GetActiveWindow

KillTimer

advapi32

RegDeleteValueW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegSetValueExW

RegQueryValueExW

CreateProcessWithLogonW

RegDeleteKeyW

RegCreateKeyExW

shell32

ShellExecuteW

ole32

CLSIDFromProgID

CLSIDFromString

CoUninitialize

CoGetObject

CoGetInstanceFromFile

CoInitialize

CoCreateInstance

CoTaskMemAlloc

CoTaskMemRealloc

StringFromGUID2

CoTaskMemFree

oleaut32

VariantCopy

VariantClear

SafeArrayUnaccessData

VariantChangeType

SafeArrayAccessData

SysAllocString

SysFreeString

VariantInit

VarUI4FromStr

LoadTypeLi

LoadRegTypeLi

SysStringLen

LoadTypeLibEx

SysAllocStringLen

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext

CertFindCertificateInStore

CryptMsgGetParam

CertCloseStore

CryptMsgClose

CryptQueryObject

version

GetFileVersionInfoW

VerQueryValueA

GetFileVersionInfoSizeW

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/AppInfo/update.exe.manifest

data/AppInfo/uwAjtKWjhvLU

data/AppInfo/uxDkiqLUK2a2

data/AppInfo/v0EjFA4NBqPm

data/AppInfo/v18VhJPrBLBr

data/AppInfo/v269WMQl3KbF

data/AppInfo/v2If58rBTxO4

data/AppInfo/v4xa71OFKTis

data/AppInfo/v5OHntr7w0Hz

data/AppInfo/vAqHxlMWqDgK

data/AppInfo/vB2mJqrpAvBx

data/AppInfo/vEpwUnnOZZwg

data/AppInfo/vFgDu3peFYNG

data/AppInfo/vNW5QZkNGFWH

data/AppInfo/vPFOGsfm23yC

data/AppInfo/vQ8tuEiKQXk9

data/AppInfo/vRAK61QVff10

data/AppInfo/vSWKCK7xUAHE

data/AppInfo/vU5QAfWlq4Aw

data/AppInfo/vUwfZBGIslCt

data/AppInfo/vVI5uZgqKpj1

data/AppInfo/vVnGWOTdCFJp

data/AppInfo/vWoItDhqa7FU

data/AppInfo/vX1C45aMBMTI

data/AppInfo/vZB8poltnoFh

data/AppInfo/vb8K35hOqrF0

data/AppInfo/vhA0ezEa4dLl

data/AppInfo/vhXDYuQByxPS

.ps1

data/AppInfo/vj6QCoWemzh6

data/AppInfo/vmlnjUAZIDeG

data/AppInfo/voEdZgxCZKfG

data/AppInfo/vpQLDlNS4miW

data/AppInfo/vutp3zyrtrku

data/AppInfo/vvpi6mw2CTZT

data/AppInfo/vxB6xiSs8JsL

data/AppInfo/vyy0GqURt7Pi

data/AppInfo/w310VMbY0Mxr

data/AppInfo/w9B1gT00ar7X

data/AppInfo/w9VlrYGGQwJI

data/AppInfo/wB80cgf9900w

data/AppInfo/wCSRWjBbyp9o

data/AppInfo/wIPvgkowWWQB

data/AppInfo/wJ2xMVWIxlB6

data/AppInfo/wLAyeqmwaFc8

data/AppInfo/wMKVop85XFy5

data/AppInfo/wSoejOdIewRy

data/AppInfo/wU0Qt1NZU4Ui

data/AppInfo/wVhSR53sXelK

data/AppInfo/wYzplTl2S2X3

data/AppInfo/wg6XMe0jkXAc

data/AppInfo/wjRpXtuN0ETD

data/AppInfo/wjvXRNyu4MOk

data/AppInfo/wm35fQVjePiB

data/AppInfo/woFDUHhpr0qf

data/AppInfo/wqoZIwMtHL70

data/AppInfo/wxyIulrg3ouu

data/AppInfo/x04ryGH0YZwN

data/AppInfo/x0xeSup1Db4O

data/AppInfo/x29URunB0mqW

data/AppInfo/x5GRQtZvvO3v

data/AppInfo/x5xk1tK37WD5

data/AppInfo/x69tzPflPORG

data/AppInfo/x8gOrt0btlVn

data/AppInfo/xAyZvqTgPF22

data/AppInfo/xBBCnu7RmAbU

data/AppInfo/xBLrz2s6iGom

data/AppInfo/xBsytt2RYLvz

data/AppInfo/xCsvlA75NJq0

data/AppInfo/xEsbm1g5dxop

data/AppInfo/xFARs6dZrhwF

data/AppInfo/xFSEAyyGvP9z

data/AppInfo/xFSqHRl8Z9F6

data/AppInfo/xJGT6uMWSb70

data/AppInfo/xKvuPtuE9LeV

data/AppInfo/xOXkdYUVSUrc

data/AppInfo/xRBnpgoFGxds

data/AppInfo/xZEgVbml8ccC

data/AppInfo/xZOdM1HsKCue

data/AppInfo/xanyj4RLqP8f

data/AppInfo/xc0ClmcMJ6ti

data/AppInfo/xiL2xGkSffZs

data/AppInfo/xkA0qNpMtAvX

data/AppInfo/xkd1x1KL4f1H

data/AppInfo/xlkREquNkRMY

data/AppInfo/xmcgqmWUJWEy

data/AppInfo/xmoPhK5h4Ymv

data/AppInfo/xnjxGU5U2e2R

data/AppInfo/xp7oYCg4Uta4

data/AppInfo/xv6fB6TtkER0

data/AppInfo/xvxbIXeJPx4C

data/AppInfo/xwSqkckpbvS3

data/AppInfo/y0uJE1fGu9R0

data/AppInfo/y3zlXe5sQOpD

data/AppInfo/y9flEnd4geJ2

data/AppInfo/y9gNdwUNKkmt

data/AppInfo/yArpha0fsOFE

data/AppInfo/yBw5w2vYJ0kp

data/AppInfo/yC0edwx35pkl

data/AppInfo/yCxndxbDuthm

data/AppInfo/yHGIBlkcpxdP

data/AppInfo/yJasPba1XRC4

data/AppInfo/yJu8mBzlT3lF

data/AppInfo/yLBc7Ec5GA1K

data/AppInfo/yOGqVfJWMYOx

data/AppInfo/yTXnG2viAxgV

data/AppInfo/yU1QHxdkvPmT

data/AppInfo/yVdMz1yseBk6

data/AppInfo/yVxwSbuoD4Zr

data/AppInfo/yYYSQJVWy3xh

data/AppInfo/yZoRUcU331ln

data/AppInfo/ya90qbblUEK7

data/AppInfo/ycpW7Ux7iSZu

data/AppInfo/ydmSNJb5CPQ7

data/AppInfo/yegUA2L4kdZn

data/AppInfo/yh1mXf58W8Bq

data/AppInfo/yjiGBvXgMX18

data/AppInfo/yu6hiVhOlmJc

data/AppInfo/yumx2bHmATtz

data/AppInfo/yxpNM4FhY1tV

data/AppInfo/z0P92D5nStL8

data/AppInfo/z3Dfi46Vz61P

data/AppInfo/z3FHFC9yiZQz

data/AppInfo/z4nEEsViQf8T

data/AppInfo/z5Q7crqbJvgJ

data/AppInfo/z5XyHvAP27jb

data/AppInfo/z7AFwrD8R4LE

data/AppInfo/z7L0M0R76vRB

data/AppInfo/z8hK5LJPaTtq

data/AppInfo/z9AyE56kkI5o

data/AppInfo/zCQE584MG6n1

data/AppInfo/zDLMO0bb70Sr

data/AppInfo/zKr1UcXGAEFI

data/AppInfo/zREkEvy9qGMn

data/AppInfo/zTeUBK8ntV1U

data/AppInfo/zUt0hpvbhtfc

data/AppInfo/zWKn1arFPg0Y

data/AppInfo/zX6ppCG8W8n3

data/AppInfo/zXYBNmjR7KEV

data/AppInfo/zajO6mpKLH7A

data/AppInfo/zajZMDb3fPGn

data/AppInfo/zaohhSKsiEFs

data/AppInfo/zbAw0REhf7Am

data/AppInfo/zbYPwt7APCxK

data/AppInfo/zcGKmqoi0u7E

data/AppInfo/zcd65xlABO4w

data/AppInfo/ze8mDCIMLKJq

data/AppInfo/zehlQj1rTb6x

data/AppInfo/zgmulPaBI8Ut

data/AppInfo/zgv8KzKarYAL

data/AppInfo/ziG29u6EyBpz

data/AppInfo/zjXeZuF3vVLc

data/AppInfo/znL2hTEUivLZ

data/AppInfo/zpKZlXcKPVsI

data/AppInfo/zqEV1sWTJLMl

data/AppInfo/zsNVP5OpV0zh

data/AppInfo/ztAm7uzwDSXj

data/AppInfo/zuFEEFrz9hK9

data/BLAKEX64.DLL

.dll windows:6 windows x64 arch:x64

b3f852f717f5b6ea49ab39865ea5f006

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

IsProcessorFeaturePresent

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

IsDebuggerPresent

GetStartupInfoW

GetModuleHandleW

RtlUnwindEx

InterlockedFlushSList

GetLastError

SetLastError

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

FreeLibrary

GetProcAddress

LoadLibraryExW

RaiseException

ExitProcess

GetModuleHandleExW

GetModuleFileNameW

HeapFree

HeapAlloc

FindClose

FindFirstFileExW

FindNextFileW

IsValidCodePage

GetACP

GetOEMCP

GetCPInfo

GetCommandLineA

GetCommandLineW

MultiByteToWideChar

WideCharToMultiByte

GetEnvironmentStringsW

FreeEnvironmentStringsW

LCMapStringW

GetProcessHeap

GetStdHandle

GetFileType

GetStringTypeW

HeapSize

HeapReAlloc

SetStdHandle

FlushFileBuffers

WriteFile

GetConsoleCP

GetConsoleMode

SetFilePointerEx

CreateFileW

CloseHandle

WriteConsoleW

Exports

Blake3Finalize

Blake3Init

Blake3Update

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/Data/FzmWEKfFfIpL

data/Data/G0IYPdrSMop7

data/Data/G0oVtrDTgUcn

data/Data/G2xU8pEuspiv

data/Data/G8lVxFVo9YzI

data/Data/GBJDFT4nbxFD

data/Data/GFo80GDS9RbF

data/Data/GGaiaWhoefyr

data/Data/GH32xzKf7yuy

data/Data/GXZmAryNm9Bm

data/Data/Gft7YytT55vI

data/Data/GiEsGphmKECF

data/Data/Gx8Fi2LCrvxh

data/Data/H0eqLRBg1705

data/Data/H1LE9owcYYF4

data/Data/H1d0y3t2D2lN

data/Data/H2aqSSkhtlea

data/Data/H7cJaKjthCSW

data/Data/H9R1jkbnMr3W

data/Data/HARhnPlf5nTz

data/Data/HATaSlp1Yum4

data/Data/HDqqXNfPgCOq

data/Data/HJLm6SYyDo6l

data/Data/HSYcynLPhUqv

data/Data/HU5duXLEVG11

data/Data/HWg8bgw36wks

data/Data/HhsdSnMO32h8

data/Data/HizrwvkaenKM

data/Data/Hj5lf3WLzdC5

data/Data/HtpZOwakV5Uo

data/Data/I1BOPKxNqZhJ

data/Data/I3QE4lUWmH3A

data/Data/I3vdm1hAyfNU

data/Data/I4DQLli9xqes

data/Data/I5YY5Rh2kb4N

data/Data/ID4V8j4CrfRr

data/Data/IFpKeWJgpbQr

data/Data/IHAsgbtu0WOd

data/Data/ISPeKib3ulwa

data/Data/IZPoFwr4evek

data/Data/IZzlh6e0HSpg

data/Data/IgfppIvYduXT

data/Data/IhtwDYvKyxPQ

data/Data/Iji4Bnp5hec6

data/Data/IuWu9Hi2nWgE

data/Data/J9w4Vgou28QC

data/Data/JHA8ARphJp1Z

data/Data/JHaI0z57srCy

data/Data/JJ8wiUZmMDaO

data/Data/JNS84xDI8jDB

data/Data/JR1arqACck8t

data/Data/JWQXS6lQuJI2

data/Data/JYHZ5z9b66of

data/Data/JwHRQIRjwulE

data/Data/JxBDm4fk0YJe

data/Data/JzLXY63xdaGA

data/Data/K3KOCWD9gDT1

data/Data/K5Xn7LYnVlWz

data/Data/K8V1bmMdJTBO

data/Data/K9FSGCvVWmNG

data/Data/KOiKQlPIVfOt

data/Data/KP9cAAMdaaLK

data/Data/KSsuJw92c8ci

data/Data/KVG9UfzolxXH

data/Data/KY3ioFtrYIoH

data/Data/KYZHNDYUuvBH

data/Data/KbyzJkYtBKk6

data/Data/Ki457I2d9Ute

data/Data/Kl2IMbenGSRC

data/Data/KmUmwCxa64Nb

data/Data/KnYcGfBlKPSz

data/Data/Ko1YHFVc5yTq

data/Data/Kquqri3ix8LJ

data/Data/L0heUOqwORpN

data/Data/L1ZPF6n3dVpT

data/Data/L3cZ0o95Z0is

data/Data/L5lURCVsnyO6

data/Data/L81uhDSq2SJn

data/Data/LBHG7I9cmChr

data/Data/LDxRp9OV8kub

data/Data/LFnbBhlohFRs

data/Data/LJ9VblYe35yB

data/Data/LMOblALMYCih

data/Data/LalIMVNkxTbq

data/Data/LdIwBUjAy235

data/Data/LeTEsuDactY0

data/Data/Lhqh74iAfrjT

data/Data/LiG5ee8OIkpG

data/Data/Llrd0ivOx2vr

data/Data/LqT5cXbCUjap

data/Data/LsAGFnEqAn2M

data/Data/Ly2zZRZrXMRs

data/Data/LzwXb4bkuiDZ

data/Data/M3KdpMyja8rD

data/Data/M4XDK7WqmvZA

data/Data/M7hk91yLMwld

data/Data/M7ig7P1MdCvR

data/Data/MGTgeK2f6TdE

data/Data/MGfbIk3J8cRy

data/Data/MHLIydvaUuFH

data/Data/MIelpjrYueLO

data/Data/MNqyCNSgza4o

data/Data/MUB4JcX2rlbi

data/Data/MUlZYXDMeErI

data/Data/MX2OOWP8kMa6

data/Data/MfTvPt6xoKk3

data/Data/MiK2BOoV32Si

data/Data/MiOliBZpbK9z

data/Data/MjUlqwZCQZT8

data/Data/MknBJQkZpFk5

data/Data/MnADbxOebreS

data/Data/MrEwOWZ2DFJ9

data/Data/MvGPXxmYY69P

data/Data/N4yVNTs7Kn6r

data/Data/NAcaJZGIvNX8

data/Data/NDX50NqUPaae

data/Data/NI0dgfLd4RpX

data/Data/NK0DDAIJGo91

data/Data/NSMiJv7rooGr

data/Data/NUe0sxQIyMQC

data/Data/NWl7QBGdBeFC

data/Data/NWndjfvbw81h

data/Data/NZDBOubUamZI

data/Data/NbSvrXQxg12v

data/Data/NdQJ4JrVBIfD

data/Data/NkehLWgL7hj8

data/Data/NkkeFsLXNoUV

data/Data/NpB5rYZ8A3Sj

data/Data/NsHYIkgMikDr

data/Data/NxiDrGJY5kS7

data/Data/NyX6PSmWWDpn

data/Data/O554tUTbXmV9

data/Data/O8lHbiw73JUN

data/Data/OBtONXXo9D2O

data/Data/OCmyC1qoRhLu

data/Data/OGSrFUcpAtIj

data/Data/OH9rskewTi1r

data/Data/OJjztEuIfXtN

data/Data/OLypStgoKdzm

data/Data/OMmPkVWEIcso

data/Data/OSrRqBxJNuLz

data/Data/OSwbCq5YHfdd

data/Data/OUOvGG3yb87v

data/Data/OZGbZDu6NBhg

data/Data/ObRgofPAOf6b

data/Data/OfE3tiJqmE5u

data/Data/Oli36cREqMsN

data/Data/OlioXYGiIAlg

data/Data/OnvvSOachH2U

data/Data/OyG4BF6tr5Yi

data/Data/P0ZoV2TmvO65

data/Data/P9KsxeEyqbEY

data/Data/PATdPnUfL9KD

data/Data/PDJPGpwFJSeh

data/Data/PEqEEmYRDeFs

data/Data/PaTVNVIcDx1w

data/Data/PcSeKnH7Krm2

data/Data/PdvaRO8nbIDf

data/Data/Pe8wVt7h9c3q

data/Data/Pgb3c5eh5fPU

data/Data/Pj40w1gSo1be

data/Data/PjWouvGuWDvi

data/Data/PljIt50oBbQD

data/Data/PmFSYp2qfwAl

data/Data/QLZ4cL0xOkc3

data/Data/QMoE5IV1vhZ2

data/Data/QNXDo0oLDZDr

data/Data/QPC8BzbuLljV

data/Data/QWSZ26BJNZyl

data/Data/QWlRChcGmqxP

data/Data/QYYOKT1YFcPr

data/Data/QYgJOfSgSpwF

data/Data/Qiz6ZyHp0CKn

data/Data/QrRjLomUujCG

data/Data/QruIvCjZXZb2

data/Data/QsVakRcJSHTg

.ps1

data/Data/Qw8aEP7Xrc32

data/Data/QxB2fdA4sf5J

data/Data/QxOBX8h6gTSR

data/Data/QxcOMYgcfbyT

data/Data/Qxx8FtFBw9r3

data/Data/Qzkk9pimXDUw

data/Data/R2NA65lthmMK

data/Data/R4ZjcWmJ20ek

data/Data/R4h3fsxuOfrs

data/Data/R7AH9UczT4xy

data/Data/R9qiCQBkRm3g

data/Data/RC1iyo1CbXI8

data/Data/RCX3wLNcfets

data/Data/RD83I22Q6fN6

data/Data/RELCeloYxRrl

data/Data/REZqGmVvi2Qm

data/Data/RF8DLVqrUBnY

data/Data/RIrJ5MquLweD

data/Data/RKPmvggO2yDF

data/Data/RLEV6jqkslSv

data/Data/RN9uCxG2Q7vF

data/Data/RQa1iaeUn2hO

data/Data/RS1JzVO8eMna

data/Data/RWtyERWgh51j

data/Data/RaQ6UO7Mtub2

data/Data/RcBwwFI3b7Cs

data/Data/RcJqXclvxZVK

data/Data/RcpkfjeiyS9Y

data/Data/Rctf9WAX2udY

data/Data/Rdu8dGJt1Uom

data/Data/RfoHlVnQ4mAd

data/Data/RlpeVWe6DJVj

data/Data/RtnDgo4J3YOM

data/Data/Rva8pEz0sF37

data/Data/RxHqCx5XXxA9

data/Data/S0CReA03uPTV

data/Data/S0GSuLwa7G2L

data/Data/S18z7F9p7Z9R

data/Data/S2QsPBXD2493

data/Data/S6J8uzdHjK0N

data/Data/S6Tk58cn8F0L

data/Data/S7WhuQURBrZg

data/Data/S7xkPTnetvZq

data/Data/S9TsKqiEYnlD

data/Data/SCojsr5NlShN

data/Data/SD7CebZFGr3P

data/Data/SDgXZYt4tFIR

data/Data/SErrAWHLboAi

data/Data/SH1apSiOyfcf

data/Data/SHLeWlZb6afJ

data/Data/SHjqGEdPczYM

data/Data/SJNT0pxG4pBQ

data/Data/SJqkTjPJeM4o

data/Data/SPrsEOT5Zcwt

data/Data/SR4hTMw2aCGZ

data/Data/SSClvO0q66ak

data/Data/SSZ5tTZyeZO3

data/Data/ShjcpKdzHMQH

data/Data/SiUNEMvnw6Gy

data/Data/SjjvCqCHGw3O

data/Data/SmpcwZj2AfeR

data/Data/SoK4l5JcLaX8

data/Data/SoZzMzkWNga3

data/Data/Sr9R1vYPf8k2

data/Data/SuEgevHUyjRe

data/Data/SuZsRHf7y8HS

data/Data/Sxyd3bBmTAlO

data/Data/Szj96OL6RYDY

data/Data/T0xyS4G9XAi7

data/Data/T13GGvUn3npq

data/Data/T6XcbwgLl3h1

data/Data/T8l2Kxm4zcov

data/Data/TFwzCUtuhUoT

data/Data/TI4vMh2tg5z8

data/Data/TMhqGjkQtI7c

data/Data/TO83SYA5qOhf

data/Data/TOLypXHZ9mBL

data/Data/TPAo1mEvIzRf

data/Data/TSGmaj6BSsaq

data/Data/TVWZW8xnvxK6

data/Data/TYjS7pzT2jub

data/Data/To07aoCvSIek

data/Data/TqPKdifNgbW8

data/Data/Tr3VffUBKe3h

data/Data/TrLsBt8MFrTT

data/Data/Tt2Q99hxc8hE

data/Data/TvuwxYbRCWFe

data/Data/TzgaZS697sUb

data/Data/U0Uy11ZL4tp4

data/Data/U14DQ2bVJtfz

data/Data/U1EiIFDTn9tE

data/Data/U2ayVF5syZYr

data/Data/U6XE8FRTFmfB

data/Data/UCjXHYbbUsqg

data/Data/UHClEcHW9Ho3

data/Data/UO52kFprfa4u

data/Data/UWmoQ1MIMZTT

data/Data/UnykUlHQWNCG

data/Data/UqD9VI0FAFga

data/Data/UqcgHJQOqnsz

data/Data/UvMnNyZv1sCn

data/Data/Uz5LJ2C9MaWv

data/Data/UzJFEa4b0X2n

data/Data/V2qYYZrSBvFK

data/Data/V9fQck9vktBI

data/Data/VCuG6UCxrpiL

data/Data/VDw413IoNMxK

data/Data/VFN5J9E2DnXV

data/Data/VHHNNMvbEPpo

data/Data/VHoaUIvMFFx9

data/Data/VKTONzDVWLrx

data/Data/VL8jOzQeh4CP

data/Data/VLAEJCilb3Dr

data/Data/VS8ZL2AQBK15

data/Data/VX8B2td7M6K7

data/Data/Vdfm90fjWuko

data/Data/VnYOt4CzmVKv

data/Data/VsaHkWZ7FWyR

data/Data/Vv5Se2EQBKyx

data/Data/VvbGXlfBQ5CJ

data/Data/W1TkDAsxmhfq

data/Data/WBv3H267o00k

data/Data/WDGCmta9tllT

data/Data/WEKpZBZ40wEv

data/Data/WEfd8AJSPXhW

data/Data/WIERGZhyfS4P

data/Data/WLTWgtYk5kCK

data/Data/WOc0XBoO9XgV

data/Data/WSqJ1ZsU7bdJ

data/Data/WX8zfSjVuTKa

data/Data/WXk7FhVN2LtF

data/Data/WZeiuexSPoV3

data/Data/WbtOuMdkIvbr

data/Data/Wd90jqAvBM9X

data/Data/WgVnojkngVtT

data/Data/Wi4pwPcB2Tr7

data/Data/WphsX7mFEhhT

data/Data/Wprm0fudN3sQ

data/Data/WsY4tiL8kJID

data/Data/Wuh83c4BwMkC

data/Data/WvdihMjRlRzT

data/Data/WwRuMVI7vzl4

data/Data/WxjZ7TYucl46

data/Data/WzUbver8k2L8

data/Data/X1lzPGjkNGTQ

data/Data/X2Oiw9n4yoUr

data/Data/X6KI3Fy56Ues

data/Data/XJiD8Lkiw4Vy

data/Data/XL3xAX2YYVgk

data/Data/XOrSqRvcdLqh

data/Data/XQrK0vOwL1B0

data/Data/XTGJgV5wbMpG

data/Data/XV2Oxuls8itx

data/Data/XW3hwiekdTVh

data/Data/XXm91uuURg9z

data/Data/XcQVZjQDoAuJ

data/Data/Xd00aQ8xYn4y

data/Data/XeBigNE2XHSY

data/Data/XhubDUbdhQxz

data/Data/Xi9U41OJKcJQ

data/Data/XiYkW9iCokqM

data/Data/Xk9VrVzWoXd3

data/Data/XpXPWXaBxX4E

data/Data/Xpp3oUlLVTwz

data/Data/XsLPrV8FnJhG

data/Data/Y12zf53kgclF

data/Data/Y8EGNVjf6AXn

data/Data/YBIVSvdeuRE2

data/Data/YHwTVvogMhRs

data/Data/YJlYmbakvoXd

data/Data/YOzayYeb7VTn

data/Data/YRZzvMN6MdpM

data/Data/YTD9sEkVOeVV

data/Data/YXNOU01Xhpmc

.ps1

data/Data/YXgo1oIaVDRh

data/Data/Yd596tH5EyCb

data/Data/YgsVGGARAAb3

data/Data/YmmqnbAHKgGb

data/Data/Ypy1gF6IQ1vl

data/Data/Ys5EXhLXK72j

data/Data/Ywhnci0YDPgp

data/Data/Yy1t9YhFBtJL

data/Data/Z0tmJzTDZNJ4

data/Data/Z1Zq7IOlBnSJ

data/Data/Z5vy5cJ61hnb

data/Data/Z8fQ6zt29RYv

data/Data/ZCOlBopbWusF

data/Data/ZCRqzzawHfcQ

data/Data/ZFsUHLBZmx1Z

data/Data/ZHhKOFKh3ftp

data/Data/ZImzAN4PAoN2

data/Data/ZKrUUPVo9ncn

data/Data/ZPMgEr3fUbER

data/Data/ZRAdvWFmiK3W

data/Data/ZSc3W69GOwJs

data/Data/ZToJRZlUupbu

data/Data/ZUadwrfZy8BC

data/Data/ZVJa4axZNdwo

data/Data/ZYQoA6tnpQwL

data/Data/ZZ773TEFiqKx

data/Data/ZrH2T0LNGkOI

data/Data/ZwCHeRbCEa4X

data/Data/Zwx9yLvr1wth

data/Data/Zy3xlkvpumMc

data/Data/ZyibWKbX6AJm

data/Data/ZzlFbWoblOd0

data/Data/g1d3iCGPB2aV

data/Data/g5auBbQFabRy

data/Data/g5gjnmkOmGoE

data/Data/g7lu3tuL8Rug

data/Data/gC0MtBRB9aQI

data/Data/gGGv1rlFn9sV

data/Data/gLL0irmwIxoF

data/Data/gOWu4MQvkdCm

data/Data/gPwDyNIF6QGE

data/Data/gQ6KhOZheT72

data/Data/gSs5X2YYZaR3

data/Data/gTBYmxhg0h9c

data/Data/gUHBFUCtZB56

data/Data/gZPlP7hmA9H9

data/Data/gbJxv6VoyD3m

data/Data/gg43Xdl4zJw1

data/Data/gjLrFxWjEUUS

data/Data/gkRwdpWvIvlb

data/Data/gl8HPrTjFrdQ

data/Data/gm99Nr7X2e84

data/Data/gnoLxjCKJDyP

data/Data/gzMtr0DKUbvy

data/Data/h28Ihehpn8NB

data/Data/h5N7mMWb0TAG

data/Data/hAZJUg46XG9n

data/Data/hDbuUjIN3iIf

data/Data/hENaLAnMCqva

data/Data/hER1URPh7EOP

data/Data/hFt3Xcbrd1p0

data/Data/hN1KTBkQasEn

data/Data/hPvGB4OCnaAW

data/Data/hVPwwvTNptFf

data/Data/ha8EmxGKxgfF

data/Data/hga1edGrgKmu

data/Data/hio6OnaZWtdR

data/Data/hoNj2B60Yh0m

data/Data/hyoqZNES7Ecj

data/Data/i99uVqblTmNi

data/Data/i9Psu9YUYhBE

data/Data/iALQOjBcgPGV

data/Data/iG3Kjb7XbEQx

data/Data/iJXk57hSK7yV

data/Data/iLzGPY35FrS6

data/Data/iOrDorhVFb6P

data/Data/iSfpvHHVVtha

data/Data/iXcUGvIFVwxX

data/Data/idpiBTK4CbiC

data/Data/ifXtNWBiA8yS

data/Data/igyNxeOEfMJ6

data/Data/ikk6MlCQ90MH

data/Data/ilkiW4KSxXKQ

data/Data/io7nXQdapYYu

data/Data/ipIxQ08VL0vm

data/Data/iwqgONeIehOd

data/Data/iy4gle0fMevz

data/Data/jCjpQbMxe7Np

data/Data/jDfS9KmkDPs3

data/Data/jGsFNm0rbXyV

data/Data/jGwEtTt6JGx0

data/Data/jHuUwjqnljsD

data/Data/jM0Lz7f5qL1s

data/Data/jN43YvQwZBCF

data/Data/jNIYOMdJyocz

data/Data/jNvl5D7jm9XD

data/Data/jOjmBAimqfoB

data/Data/jXleIe7AnC8Z

data/Data/jY986qcPVEXI

data/Data/jgVLsGw0USHT

data/Data/jqP27MaT7teI

.ps1

data/Data/jv7xhzowGLgZ

data/Data/jwnTa9v7Z910

data/Data/k2bs0drmKxG8

data/Data/k3sF7vAQoOrs

data/Data/k6ytREkeJ9vz

data/Data/kKbaDE1tMS6Z

data/Data/kTPTMQZ50XrS

data/Data/kVCIT9Z1E4PG

data/Data/kaKD5rwixO9j

data/Data/kb6VMoBfBM7g

data/Data/kcJqqwjkP6tR

data/Data/kdZYKwOb1KqC

data/Data/kdy9Gi8ML3uK

data/Data/keT9FBnqNo8s

data/Data/keUnGKCjY1gp

data/Data/kjqBpdlJOc7b

data/Data/klIrFjl4qmi1

data/Data/kn0vXDP4oPVH

data/Data/kuSYYmLOO7hF

data/Data/l20bIYgFaDPp

data/Data/l6jQhlfNKx3B

data/Data/l8ntJwOoyIV7

data/Data/lHAtj7NmM6YM

data/Data/lLbR70WjgMzn

data/Data/lLxzXBSFmYh8

data/Data/lNK0cCxkIm8B

data/Data/lO6aGori4hEK

data/Data/lPFNhLBSgUy0

data/Data/lSE8xNXrp00X

data/Data/lWGX8SQRjyi6

data/Data/ld6GU59ZXVEZ

data/Data/lhp1tFqDhss6

data/Data/lkyMzWpxVE5H

data/Data/lnWJP5t0pR39

data/Data/lpfnDRhoPJSk

data/Data/lwvrI1Og55Yi

data/Data/m07dreuzPf8D

data/Data/m0pmlA2zEym7

data/Data/m1MSVWB3W6aJ

data/Data/m2jz2WzRgvm5

data/Data/m4sLSvuk1np8

data/Data/m882AWAAhIUL

data/Data/m8KDTVNwDyyi

data/Data/mCupJkidvRec

data/Data/mLkZ2NxRbXhk

data/Data/mPyQbUCL8jhw

data/Data/mQOxk6ESKu0G

data/Data/mScAMIIAagbX

data/Data/mVGuiNyNdOJN

data/Data/mYuZ7kgd6q5a

data/Data/me7KC37AMYUn

data/Data/mfaaztmTclv6

data/Data/miCNjrlJalZk

data/Data/mkp8Q1ipTpja

data/Data/mllmmJewKQJp

data/Data/mn4hzGhmcUlY

data/Data/mpYYIZUKWIrj

data/Data/mtgtTlysOs1Z

.ps1

data/Data/mu2kEy3n1b52

data/Data/mu6MQqhCjdo2

data/Data/mui6rw2e4D0N

data/Data/mupx4wG4nqPn

data/Data/muqMtwxkPF6j

data/Data/myq7b6CQ4BQq

data/Data/n2unyGbYo8Qx

data/Data/n4VuhPK3oyzl

data/Data/n6jail8ppnco

data/Data/n8btjWujXAs0

data/Data/n9KVnpv2Ajds

data/Data/nC3TWB8OZiUU

data/Data/nD5KNRPnYjF7

data/Data/nSqHsJk0n8Sc

data/Data/nVbN8qxryqsg

data/Data/nY7mm8CR2yBc

data/Data/nbzL8q8K5dDv

data/Data/ndzNMCOqV2jp

data/Data/ngC2KdKjsCkk

data/Data/nnGTWGCGnWBB

data/Data/nq9j46TssfE4

data/Data/nrTBcloAK32M

data/Data/nwk58upBaARU

data/Data/nyBwhjOomClt

data/Data/o5GI62oVr6ed

data/Data/o64KsGZxSvHu

data/Data/oJpO1ZFR7jMn

data/Data/oNYt1uqAmsqe

data/Data/oQNGvIw0pKqV

data/Data/oUxC9W7K0gA4

data/Data/oVFDAXmmfLEO

data/Data/oW17ZWDeDnl7

data/Data/oWJqrFjni0Ey

data/Data/oXfEx4SIMKuU

data/Data/oZRxro2S8aKC

data/Data/obcnmwUvgPWg

data/Data/ogISBmjfVPUi

data/Data/ojuEbge8DZga

data/Data/oo5SbKcKrfxz

data/Data/opp2zVn9PfTJ

data/Data/orMtMMzHKDuo

data/Data/oxq2hntH0WLv

data/Data/p41xCEQeBUlu

data/Data/p5VDnqzvicPh

data/Data/p7dAYsxa7mp8

data/Data/p85EXS6NRvJA

data/Data/p9LDfoFNMwfU

data/Data/pFo1c5UfgAPf

data/Data/pJ1PuXAB9JJm

data/Data/pJmAxEn8IiCU

data/Data/pNpXSEUdR4xj

data/Data/pbmLAfI6s3ZK

data/Data/phPSmFrZEMQ5

data/Data/po5IH2mOjMCF

data/Data/qFm06mGWCebn

data/Data/qIzjC4tlKpFN

data/Data/qRDp7E9X5RfW

data/Data/qTTvciVrHa4w

data/Data/qUha2Wg4g3tC

data/Data/qUumQIDvET7P

data/Data/qVI1XoGrCfkX

data/Data/qWSjYqijQhzS

data/Data/qfaD8Xqq97H4

data/Data/qglfSIWWg1TG

data/Data/qhkzJdW2VwF4

data/Data/qmjLKlXPHD8h

data/Data/qmnDakMzbF0x

data/Data/qqM6tvizxWAt

data/Data/qqNh6opYGojb

data/Data/qryhOUz1yB63

data/Data/qt0OcIR0dL7Q

data/Data/quV18TBlT0jf

data/Data/qv6tlN7UmUl4

data/Data/qvMJbRkYazjg

data/Data/qvipA3RBczKd

data/Data/qvmeKnM52oJ0

data/Data/qxY7T7NzULDo

data/Data/r0nN3eyo3gKH

data/Data/r4aUhlDDwv8O

data/Data/r5ycLP1jlHcx

data/Data/r6UFkUqG8pMg

data/Data/r6k5GsjcB9wx

data/Data/r7jR8Qa2b4ky

data/Data/r9aIM70KqZ59

data/Data/rBRK0WgKsIZ5

data/Data/rDG1c000m2xa

data/Data/rDj6gctpN1hE

data/Data/rI7wYWE15Uwk

data/Data/rIiUI3xDcOTT

data/Data/rJRTaaVxMY7S

data/Data/rJu37qaEH5PH

data/Data/rN2PlPCpxGx7

data/Data/rOhf0xpGQcz9

data/Data/rQnsHyReArel

data/Data/rTLdTY6bIhK8

data/Data/rTYG0m2Yo2xy

data/Data/rTliesxJb43K

data/Data/rUYYVq8Htw1u

data/Data/rYKAFtBMYUHv

data/Data/rYm8UxcUDQVx

data/Data/ra5ifPhYDe0J

data/Data/rcfNZO4SXCRn

data/Data/rdk4STmdnT8B

data/Data/reJGAvtphFkU

data/Data/rgMECRAgLaR3

data/Data/rjxjQoEJzjmg

data/Data/rkiSNBUKAl3t

data/Data/rpgXqnHoAzGq

data/Data/rroe9E76TA4B

data/Data/ruillk7lpeZz

data/Data/rxj8fGRgrTAC

data/Data/s1DVIHWSauSM

data/Data/s2M4OMBbeOUe

data/Data/s3h4jn8Yr8Ps

data/Data/s46HWFKePOYI

data/Data/s6JHE7WcXDyz

data/Data/s7epl78M1pdh

data/Data/s86lPxdolUwQ

data/Data/s8wRZL8YnkGR

data/Data/sB8H2n253fL2

data/Data/sCqyZOwmVE8f

data/Data/sDqezq4ezZXO

data/Data/sFsOcEgLqigq

data/Data/sGeEeEOf4TG3

data/Data/sKlnfPrcpAUg

data/Data/sLIf65VkrAV3

data/Data/sM2YAkETA2tK

data/Data/sOo2EIArdY5S

data/Data/sQOZ6wtHeweB

data/Data/sUsIBWn3BD29

data/Data/sVWM7AFvpKxJ

data/Data/sW1Qt3wR2yYi

data/Data/sWpSt5G9fxpq

data/Data/sWte9daB5XK8

data/Data/sXQ8YYP0agSb

data/Data/sbsglJnD8TCR

data/Data/sc1cvP6bDBKq

data/Data/scWoVGbZkBzc

data/Data/scj546E8gnne

data/Data/se1ZEjhV7sFS

data/Data/smBzemChaaqR

data/Data/svFBwOOCJ6hl

data/Data/sxhz7oRdu3ve

data/Data/t6GVUEc3u0hR

data/Data/t9LEbzVb5W5k

data/Data/tBRyyHx60WF0

data/Data/tJEegJ5ReNEg

data/Data/tMrcGWqqLK4R

data/Data/tN6D4NCMkQ37

data/Data/tQgtxbKUlWAS

data/Data/tTQegCbs7WoR

data/Data/tW6qCwdxM1w7

data/Data/tX7HTOsTcLrl

data/Data/tXteKa3KNcVO

data/Data/tdI8epfgrKKu

data/Data/thkpYcIuf1xM

data/Data/tn4GnmAakKpM

data/Data/tnczuT6jl7zh

data/Data/ttBmFcapJQwR

data/Data/ttyqVxrFqtRO

data/Data/u6sWkhuFe23L

data/Data/u9rvDGkfIGKz

data/Data/uBpNKc4NyBvp

data/Data/uBrTFbY3lrqG

data/Data/uCmx479Ta03c

data/Data/uD193245yeul

data/Data/uELgAIxxMmbJ

data/Data/uKEhuVAA1brm

data/Data/uKyrEWnTRuaJ

data/Data/uMX2XCfTFHP5

data/Data/uNnu9HuRBJmf

data/Data/uP5m06ZncB58

data/Data/uQO1Gje3ko7t

data/Data/uQWGxnL7Gew1

data/Data/uVWp23DHdZpd

data/Data/ue5jILkcnMzC

data/Data/uennMmgryS1d

data/Data/ukYLPP9gzGcq

data/Data/uvCiRRbMos93

data/Data/v0dUVSeRFj6t

data/Data/v3md2YRtmuWh

data/Data/v5FRoheiIDKe

data/Data/v5S2I7EnnFQj

data/Data/vCFJkaG9H1Ak

data/Data/vDjyC8ViT6uz

data/Data/vDtMJnszHLRj

data/Data/vFbEl3utkooY

data/Data/vIeWN9LL4Q7x

data/Data/vZgsh4frgO8l

data/Data/vdTBUxhSa6YJ

data/Data/vk7KW9joXWXv

data/Data/vlAlj2484GRk

data/Data/vmf31SaZLYOi

data/Data/vqFWuCsW3oS1

data/Data/vtcBj3qisNa3

data/Data/w1QC77qv1tFf

data/Data/w2fB0Ha3e5yV

data/Data/w5SIanTswyIx

data/Data/w7Y1R7AuuPk0

data/Data/w8A2MAkqPYlf

data/Data/w9RfOFZW6C8E

data/Data/wCDTarchA9q6

data/Data/wIQc2CDruBKN

data/Data/wIVMn6hKxdRn

data/Data/wIgZVnE5Ihu2

data/Data/wJKG22tlnKke

data/Data/wKhqksZkCPXR

data/Data/wObFWGOMMQdH

data/Data/wVxx9MWu8bL6

data/Data/wk70M9gu9Wue

data/Data/wkSYXIyJBKhH

data/Data/wke5f3vxdBoz

data/Data/wkkMt34rI607

data/Data/wmBIX1EUOPfQ

data/Data/wq2aVU1lapjf

data/Data/wr2uxAUTApkA

data/Data/wrCfuLGTVb5P

data/Data/wxnGCKvmOTWn

data/Data/x5352MFwzOLO

data/Data/x7sg93TE6CXU

data/Data/xGcgQg3xcnZg

data/Data/xIxeW5yHMqKr

data/Data/xR3KfUdW6Ery

data/Data/xXcQsksOMDDU

data/Data/xYmoP08TnwXd

data/Data/xcuzmOrQ1ikZ

data/Data/xeZTc7NYo9gj

data/Data/xecNrk8lZaUF

data/Data/xfFt1NWjfkBV

data/Data/xhUUT8xhFpfr

data/Data/xiDPfqQtk22b

data/Data/xklpOHnOua97

data/Data/xmKuO4bnkQeN

data/Data/xpUjjwNngoui

data/Data/xsh3Bnpcig4f

data/Data/xt9PxRsUwiKF

data/Data/xvJ8NEeryYLR

data/Data/xwZZ0ovU28l5

data/Data/xyyvf7kjX8Ns

data/Data/y2BT735Uzi5Q

data/Data/y3l9q5htYZdI

data/Data/yIwzbXUyWxwE

data/Data/yKOwNm6IeZZn

data/Data/yLUaAxwNb9XH

data/Data/ySn74sFryEDB

data/Data/yVdm0zwP0eXq

data/Data/yWY6W56Nrpfg

data/Data/yYDF2HLDVkrY

data/Data/ybdgyvcl2ldE

data/Data/ycRD6jIvLuGq

data/Data/ydtQyhoQ9VZP

data/Data/ygx0oSgOJRJ0

data/Data/yk3SkLtwm1tZ

data/Data/ymCuZwaRTNN1

data/Data/yrwEFyVMtF53

data/Data/yzpBYYNriJPg

data/Data/z2iRct9EUrqX

data/Data/z90qk8Hq6mQ7

data/Data/zAhDCRP0aSOK

data/Data/zGqXz6C2pK25

data/Data/zLtOAka58NSa

data/Data/zQC5uPKax28E

data/Data/zZ1THn8osPhA

data/Data/zd0XOhNnJWsh

data/Data/zeQ9pYKIWux4

data/Data/zhOCZDkvNZoG

data/Data/zjKA1rDHN5Vj

data/Data/zpXd3VoP9lY0

data/Data/zrQI41Y52FoO

data/Data/zvY8lk317maM

data/TC7Z64.DLL

.dll windows:4 windows x64 arch:x64

51867d4dfbb4aaa72ef96dc2268a6d96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte

MultiByteToWideChar

GetLastError

GetCurrentProcess

GlobalMemoryStatusEx

GetSystemInfo

GetProcessAffinityMask

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

WriteFile

CloseHandle

VirtualFree

VirtualAlloc

IsProcessorFeaturePresent

GetProcAddress

GetModuleHandleA

GetVersionExA

WaitForSingleObject

SetEvent

InitializeCriticalSection

CreateEventA

CreateSemaphoreA

ReleaseSemaphore

ResetEvent

RaiseException

LCMapStringW

LCMapStringA

GetStringTypeW

GetStringTypeA

HeapFree

HeapAlloc

HeapReAlloc

ExitProcess

ExitThread

GetCurrentThreadId

CreateThread

FlsSetValue

GetCommandLineA

GetProcessHeap

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

GetStdHandle

GetModuleFileNameA

FlsGetValue

TlsFree

FlsFree

SetLastError

TlsSetValue

FlsAlloc

HeapSetInformation

HeapCreate

HeapDestroy

RtlUnwindEx

Sleep

HeapSize

LoadLibraryA

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

GetLocaleInfoA

RtlPcToFileHeader

oleaut32

SysFreeString

SysAllocStringByteLen

SysAllocStringLen

VariantClear

SysStringLen

Exports

CreateDecoder

CreateEncoder

CreateObject

GetHandlerProperty

GetHandlerProperty2

GetHashers

GetIsArc

GetMethodProperty

GetNumberOfFormats

GetNumberOfMethods

SetCaseSensitive

SetCodecs

SetLargePageMode

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/TCLZMA64.DLL

.dll windows:4 windows x64 arch:x64

75ae504cde4845191ef00a52eeebaf97

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

VirtualAlloc

VirtualFree

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

GetLastError

CloseHandle

WaitForSingleObject

ResumeThread

SetThreadAffinityMask

CreateEventA

SetEvent

ResetEvent

CreateSemaphoreA

ReleaseSemaphore

__C_specific_handler

InitializeCriticalSection

HeapAlloc

HeapFree

GetProcAddress

GetModuleHandleA

ExitProcess

ExitThread

GetCurrentThreadId

CreateThread

FlsSetValue

GetCommandLineA

GetVersionExA

GetProcessHeap

WriteFile

GetStdHandle

GetModuleFileNameA

HeapSetInformation

HeapCreate

HeapDestroy

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

FlsGetValue

TlsFree

FlsFree

SetLastError

TlsSetValue

FlsAlloc

LoadLibraryA

Sleep

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

WideCharToMultiByte

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

HeapSize

MultiByteToWideChar

GetLocaleInfoA

HeapReAlloc

GetStringTypeA

GetStringTypeW

LCMapStringA

LCMapStringW

Exports

BrotliDecoderCreateInstance

BrotliDecoderDecompressStream

BrotliDecoderDestroyInstance

LzmaCompress

LzmaDec_Allocate

LzmaDec_Constr

LzmaDec_DecodeToBuf

LzmaDec_Free

LzmaDec_Init

LzmaEncProps_Init

LzmaEnc_Create

LzmaEnc_Destroy

LzmaEnc_Encode

LzmaEnc_SetProps

LzmaEnc_WriteProperties

LzmaUncompress

XzUnpacker_Code

XzUnpacker_Create

XzUnpacker_Free

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/TCUNZL64.DLL

.dll windows:4 windows x64 arch:x64

4f3335a1cf5b3f599ae69e19dc4247e0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:6c:61:75:7a:92:3f:50:c8:2e:b6:aa:18:d2:1f:c6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/09/2016, 00:00

Not After

25/05/2017, 23:59

Subject

CN=Ghisler Software GmbH,OU=Development,O=Ghisler Software GmbH,L=Bolligen,ST=Bern,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

1a:f2:6d:2b:4d:e7:eb:bb:26:05:fd:83:cc:b1:f4:ad
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

25/05/2016, 00:00

Not After

25/05/2017, 23:59

Subject

CN=Ghisler Software GmbH,OU=Development,O=Ghisler Software GmbH,L=Bolligen,ST=Bern,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

11/04/2027, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5f:f0:1f:75:fe:08:59:f0:64:85:69:45:f6:71:f2:44:2e:a3:28:54:59:97:d2:59:0b:23:c6:71:58:7e:4b:fb
Signer

Actual PE Digest

5f:f0:1f:75:fe:08:59:f0:64:85:69:45:f6:71:f2:44:2e:a3:28:54:59:97:d2:59:0b:23:c6:71:58:7e:4b:fb

Digest Algorithm

sha256

PE Digest Matches

true

48:cc:c9:d7:0e:5f:72:26:77:4c:06:81:31:d5:40:d5:18:02:91:b7
Signer

Actual PE Digest

48:cc:c9:d7:0e:5f:72:26:77:4c:06:81:31:d5:40:d5:18:02:91:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

WriteFile

CreateFileA

CloseHandle

FindClose

FindFirstFileA

ReadFile

SetFilePointer

DeleteCriticalSection

InitializeCriticalSection

LeaveCriticalSection

EnterCriticalSection

HeapAlloc

GetLastError

HeapFree

GetCurrentThreadId

FlsSetValue

GetCommandLineA

GetVersionExA

GetProcessHeap

GetProcAddress

GetModuleHandleA

ExitProcess

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

RaiseException

RtlPcToFileHeader

RtlUnwindEx

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

GetModuleFileNameA

HeapSetInformation

HeapCreate

HeapDestroy

FlsGetValue

TlsFree

FlsFree

SetLastError

TlsSetValue

FlsAlloc

Sleep

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

WideCharToMultiByte

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LoadLibraryA

MultiByteToWideChar

HeapSize

GetConsoleCP

GetConsoleMode

HeapReAlloc

SetStdHandle

FlushFileBuffers

LCMapStringA

LCMapStringW

GetStringTypeA

GetStringTypeW

GetLocaleInfoA

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

Exports

DllMain

DoneInflate

InflateChunk

StartInflate

UnzipBzip2

UnzipPpmd

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/TCshareWin10x64.dll

.dll windows:6 windows x64 arch:x64

0ed3d174fabd1632072b731a950e6fa5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

WindowsCreateString

WindowsCompareStringOrdinal

WindowsDuplicateString

WindowsDeleteString

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

SetLastError

GetLastError

RaiseException

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc

CoCreateFreeThreadedMarshaler

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry

RtlUnwindEx

RtlPcToFileHeader

api-ms-win-core-processthreads-l1-1-0

TlsGetValue

TlsFree

GetCurrentProcess

TlsAlloc

GetCurrentThreadId

GetCurrentProcessId

TerminateProcess

TlsSetValue

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

InterlockedFlushSList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-synch-l1-1-0

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress

GetModuleFileNameW

FreeLibrary

api-ms-win-core-heap-l1-1-0

HeapFree

HeapAlloc

GetProcessHeap

HeapReAlloc

HeapSize

api-ms-win-core-file-l1-1-0

FindFirstFileExW

SetFilePointerEx

FindNextFileW

WriteFile

FlushFileBuffers

GetFileType

FindClose

api-ms-win-core-localization-l1-2-0

GetCPInfo

GetACP

IsValidCodePage

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW

GetStdHandle

GetCommandLineW

GetCommandLineA

FreeEnvironmentStringsW

SetStdHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

WideCharToMultiByte

GetStringTypeW

api-ms-win-core-console-l1-1-0

GetConsoleMode

WriteConsoleW

GetConsoleCP

api-ms-win-core-handle-l1-1-0

CloseHandle

kernel32

RtlVirtualUnwind

RtlCaptureContext

CreateFileW

UnhandledExceptionFilter

LCMapStringW

ExitProcess

LoadLibraryExW

GetStartupInfoW

GetOEMCP

GetModuleHandleW

GetModuleHandleExW

Exports

ShareThisList

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/Tools/030s85fmVMQ1

data/Tools/05izugTzJZ3k

data/Tools/06BD7KapZqHM

data/Tools/06KeAiL6hAEI

data/Tools/08sGUazkDr3C

data/Tools/11kIy2XDxOy7

data/Tools/12Sh4UkOQIbA

data/Tools/14HlEHboBWII

data/Tools/16SZRwHqhE1E

data/Tools/18Rk6YDt4BFE

data/Tools/20HNVTD9H1qC

data/Tools/22nxyUM2ur7s

data/Tools/22pLkYOB4Zrb

data/Tools/23BRArrpKVDu

data/Tools/25yHxsVPd52p

data/Tools/26mcIYbV0Dg8

data/Tools/2OU3iA6x8ACU

data/Tools/2SuXG0Zxhsv8

data/Tools/2U03dx5ozm8f

data/Tools/2WoAemLM4KHW

data/Tools/2Y6Hd5Cj5oID

data/Tools/2kxqAprWuHm9

data/Tools/2nVdSmwmHVZQ

data/Tools/2oFtlSQB186R

data/Tools/2oWPvGxY93og

data/Tools/2rpJX1EgKGO8

data/Tools/2smm6eN5hpWG

data/Tools/2u87pZwfQhNP

data/Tools/315mKnKwDigw

data/Tools/32lM6hf6Mwj7

data/Tools/34ARcyVKsM5W

data/Tools/37VwdpCHxZPS

data/Tools/39V6vvAgIf5W

data/Tools/3BuGbTlojy8d

data/Tools/3CDDUfwZh1ud

data/Tools/3Cfq3a7LrBAq

data/Tools/3DRR0GHuHKHb

data/Tools/3H0f3IjBHmDt

data/Tools/3KuNU2PpxVUr

data/Tools/3L62Aj1oi7l2

data/Tools/3O2dNH1eCnDS

data/Tools/3OZ4XuImweIS

data/Tools/3OrFN3NmRS0q

data/Tools/3QgxXf51z3S6

data/Tools/3TtmxoW91WjA

data/Tools/3VIJ6wBkqDEq

data/Tools/3Vw1ymYCqCFG

data/Tools/3d5vp2pudfOz

data/Tools/3dne19Uxz1PO

data/Tools/3h83Kap80lrr

data/Tools/3hGCxyS2CQFZ

data/Tools/3ko6uaiswF30

data/Tools/3mJWX2GYXGU4

data/Tools/3qB6gzj502sF

data/Tools/3rG4zq1c1H74

data/Tools/3rUGNCFkXQNA

data/Tools/3uRuNXRpoEEN

data/Tools/3ugCebQsKO6k

data/Tools/3vm5Ofv0QBGC

data/Tools/3zdnT0xjG3hc

data/Tools/41Jsje0Yxxlp

data/Tools/47XX0m1xTkig

data/Tools/4ArRE6fAuzcR

data/Tools/4FXc4CDp2mp4

data/Tools/4HTjp7QHOgo9

data/Tools/4HxKNWGtGJh5

data/Tools/4I0BmqMcppPc

data/Tools/4I5seeWQhmwx

data/Tools/4KTT0k5cFDEH

data/Tools/4L7Mxu55cCWr

data/Tools/4MXgwNmiH8Ff

data/Tools/4RW7VG3tFA2R

data/Tools/4U8Lud8RZHEW

data/Tools/4dvd91klldR0

data/Tools/4edRMiGPvytc

data/Tools/4isUTMXyzgg6

data/Tools/4jplBt6NqS3c

data/Tools/4m9NyIstumAr

data/Tools/4pTvMseQHCru

data/Tools/4qrC0isxLAzA

data/Tools/4r1LyzZIqnXW

data/Tools/4sPb5bxfjooc

data/Tools/4w51E5ORecQ5

data/Tools/4wxorCh1txIT

data/Tools/4ypwHaYStrza

data/Tools/4zsSdLw3zj2O

data/Tools/50bzISVupDuV

data/Tools/51I75Nn3BCkb

data/Tools/58JFflv6Ev7O

data/Tools/58pF6piyEQZp

data/Tools/5BKYN2YyZ17f

data/Tools/5E9NlxK3sHQi

data/Tools/5EfmKpkh9sWW

data/Tools/5GcZvIc35IJM

data/Tools/5M4rPT0wcyiO

data/Tools/5Ohk06jabSiI

data/Tools/5RsrNMKgY4qV

data/Tools/5ThlenkiraHQ

data/Tools/5UENlboJCE1n

data/Tools/5YjWXSICpYoW

data/Tools/5bBbe0MK7KkS

data/Tools/5dsgRoddRyOY

data/Tools/5dsp0qYBbDoU

data/Tools/5i5MqG4ubPAk

data/Tools/5kM2tlivP3Zp

data/Tools/5lF8quMEjUX0

data/Tools/5qZsjJQen5fI

data/Tools/5qqxR5lWrukA

data/Tools/5vwlSQsHGX0r

data/Tools/5y5TewFTvVw2

data/Tools/5yafNrtkxVia

data/Tools/61njqhhvmfeI

data/Tools/64ZCCZj2ddeH

data/Tools/66Yx0XDYg1ja

data/Tools/67V1iWusrOgZ

data/Tools/68Awe9HFSzfQ

data/Tools/6CvmV209ukmz

data/Tools/6ORc7Hm4NCrn

data/Tools/6QCVGsOs9FKF

data/Tools/6RJ1Q6lIuIjM

data/Tools/6Sc1kM8OU1yV

data/Tools/6UvQA4KpsEci

data/Tools/6XM6NuJgNh6Q

data/Tools/6Yu2tRP57ue9

data/Tools/6b73j8BDEn61

data/Tools/6cbvcpjtFZeC

data/Tools/6dpEzgFgb96v

data/Tools/6e7Ts2vySYvO

data/Tools/6f3piFBzyqth

data/Tools/6lZqEQF9vCMc

data/Tools/6pITMg9oakMm

data/Tools/6qcTaTFKicVe

data/Tools/6s9YQ2qGe3g9

data/Tools/6sodoVJ4MQbw

data/Tools/6uo5jqiJuvlI

data/Tools/6vDuJ2bbVsWK

data/Tools/6weGTMoBKM62

data/Tools/6woH5wKmS4s0

data/Tools/6yEWlQsFZ2mn

data/Tools/75LzIMXiTncg

data/Tools/7ADQnmhb0YEM

data/Tools/7AGlHe2EOd0D

data/Tools/7BH8YudEXyb7

data/Tools/7BpYSP8StutZ

data/Tools/7F1xEGcEIhXo

data/Tools/7FgqLeYXf70K

data/Tools/7Hqt1Q4RNRiI

data/Tools/7INEG1Q6qODo

data/Tools/7LoewlEj5DiI

data/Tools/7RSRZDtIH7F7

data/Tools/7StN1m4DGLEi

data/Tools/7T52VyqgqPGo

data/Tools/7UG8tT3g7jAm

data/Tools/7XkKDeYVjUEk

data/Tools/7Z32W6SYsJCD

data/Tools/7ZCysi5OcOAX

data/Tools/7et619jsn1ho

data/Tools/7kKa0l5V06yU

data/Tools/7lUfyzquRltN

data/Tools/7mT9a1QEedRu

data/Tools/7naDQu5tmNVL

data/Tools/7oxu1sQSX3gP

data/Tools/7pOx7BEYU7Rp

data/Tools/7w2jUeGracZC

data/Tools/7yMZq7Q1ZvBv

data/Tools/81w1iLVY3I07

data/Tools/85yPvpoKdmLo

data/Tools/86nZKYB54FhH

data/Tools/87cr62CGZsG7

data/Tools/8BlGZa65DiLm

data/Tools/8DhgkGrAWJKY

data/Tools/8E99nwk5eBHp

data/Tools/8HIykNBhSeyU

data/Tools/8NLydgtAqYlZ

data/Tools/8PQNgb3CSMHO

data/Tools/8ReFYjAaOTG4

data/Tools/8S2CmoY6ruLq

data/Tools/8TyROIavoFDk

data/Tools/8WJgTWyuamnn

data/Tools/8WZdVabVdnY0

data/Tools/8YbXzuaVCsrh

data/Tools/8ZAOkalPyKx6

data/Tools/8Za67EEswaoW

data/Tools/8aQNDraFVA8A

data/Tools/8aVCAHsJoArV

data/Tools/8c3DfzAujXfs

data/Tools/8d3k4HJ4vdn3

data/Tools/8kJqs5m8U1d4

data/Tools/8mufl1Xswwla

data/Tools/8nnYzQAhHK3R

data/Tools/8pQY9PgIweod

data/Tools/8q3IvpBtouLz

data/Tools/8rIJhGiPLn2E

data/Tools/8rvVuGZrDGkZ

data/Tools/8sXaqxjfuimD

data/Tools/8syBkoO1GxGP

data/Tools/8uyrXKYYorYj

data/Tools/8vOE1w0jYxFa

data/Tools/8xl2jIAgxITp

data/Tools/8yu5lvzoBpB2

data/Tools/8zgb1RJD1SCv

data/Tools/906WBbLmzvsz

data/Tools/95mNkuLaMwQN

data/Tools/95ptOTOD7qoY

data/Tools/982ufcugzeCj

data/Tools/9FmukJEUvPbV

data/Tools/9GmGI3OPSYzW

data/Tools/9HtFiegwc1T4

data/Tools/9JE3nitYxPW5

data/Tools/9JG56z6cO5gp

data/Tools/9JT9jh5wlG2n

data/Tools/9LP22UgOVuwB

data/Tools/9LQpiIk9PntY

data/Tools/9LcAWbFnoeRa

data/Tools/9MCchPm9OaUs

data/Tools/9N1JVkbu68CL

data/Tools/9OVacMslsv8M

data/Tools/9X0aKPycSi7o

data/Tools/9Y8zhoBHUSb6

data/Tools/9aSMetbQrOLB

data/Tools/9aqVxCnOhp3o

data/Tools/9bhe936nH5n0

data/Tools/9h7K0FLxGsRS

data/Tools/9k3bK0VYlVum

data/Tools/9n2ZF1c38VcK

data/Tools/9neCvnlSduzQ

data/Tools/9r857vxARvfE

data/Tools/9rLjMxwc8xpA

data/Tools/9sg9LCDjS2Du

data/Tools/9syz0JDU8L0Z

.ps1

data/Tools/9tHOzGcpF2o2

data/Tools/9uzvck3Ha8eX

data/Tools/9x7RJuJwvEQl

data/Tools/9zz0nJhrPn83

data/Tools/A0TNm661sIaS

data/Tools/A4hz0yi7sgY4

data/Tools/A9dHIwEgq7q5

data/Tools/A9dwqOoqyGwg

data/Tools/AAxkdyvlVZPz

data/Tools/AGCm0A96wMbq

data/Tools/AIKw2WUtTAML

data/Tools/ALU9kE3z69wQ

data/Tools/AMdnxkPRdGoR

data/Tools/AOMuqvwRdTQ1

data/Tools/APwVt44VnOMd

data/Tools/AW6gGksRTlG9

data/Tools/AWGHMoGQlaGE

data/Tools/AcrYZpPPZgvt

data/Tools/AhDuRyvaluCp

data/Tools/AiR7uBL4MpM8

data/Tools/Aj30EeT5gg9r

data/Tools/AkS73Hc7ml3L

data/Tools/AkptWoSJS4MX

data/Tools/AlgDnsKdyFto

data/Tools/AoxDTvr7KnpG

data/Tools/AqeY83wttnhv

data/Tools/ArJnxX7f26HJ

data/Tools/AsTWrVr5h86I

data/Tools/AvRwqBA1ImpA

data/Tools/AzWRHW5UoDDn

data/Tools/BE6g5FMHPV0o

data/Tools/BOWtVzaLYlrj

data/Tools/BOq9GDPmLo86

data/Tools/BQ3YmsqLir42

data/Tools/BXmz4ms7qgds

data/Tools/BeIdwGDRpOX8

data/Tools/BfYLqq8hrpck

data/Tools/BoYCdWjxFJXQ

data/Tools/BrtGRlfH8dfh

data/Tools/Bu3IZon6JHFw

data/Tools/C1WdxdBnGfLR

data/Tools/CLhSY5WKX4jM

data/Tools/CXZLKYL3uFHe

data/Tools/CdZDXunAX5T6

data/Tools/CecajUEbgl3F

data/Tools/CkkSXV2X6AhH

data/Tools/CpfBPvyeCf1x

data/Tools/CsoTPX44u2pY

data/Tools/D2lZt1h3Nzhv

data/Tools/D3tzPHU5O1Xy

data/Tools/D7szaxBkGu0I

data/Tools/D8JkwwHspSZ4

data/Tools/DBMp3kdRf8FG

data/Tools/DIZ3w4d8dYaM

data/Tools/DRfmVSIGX1LE

data/Tools/Dfeka8flOzPr

data/Tools/DstLHDrJC87y

data/Tools/DvyqGuwVmnvE

data/Tools/DyS1KfqZtf4M

data/Tools/E14ylr6uinnd

data/Tools/E2JLnZM6l1WE

data/Tools/EBGsT752WQBJ

data/Tools/EBmbjx7c0zWZ

data/Tools/EFHX1KlK0KV5

data/Tools/ES0FPxzHQw5d

data/Tools/EYQTyYRxPGfQ

data/Tools/EZQJiKuEg7Nh

data/Tools/EeO8dfOGEpgu

data/Tools/Ek8MImslqShp

data/Tools/EpVxhAUeVdJS

data/Tools/Epn9L6ODnO4p

data/Tools/FLQHVpmbDl28

data/Tools/FS7c9bsQbJdF

data/Tools/FaXqETnmNP1q

data/Tools/GFHRadydhAPA

data/Tools/GHf3T9JN62sb

data/Tools/GS2t5hP4uIld

data/Tools/GTeTCuVjKeKQ

data/Tools/GVCWMPVDyTNr

data/Tools/GWE90socVu26

data/Tools/GaXSe2qY3Mnc

data/Tools/Gm0AREewdSmq

data/Tools/GmtJULSymG9p

data/Tools/GsxWl0mhJxtI

data/Tools/Gt7irGIir9P6

data/Tools/Gw8N62mpzcug

data/Tools/GwV4vQSjfJA2

data/Tools/H0rAQ8mrHSgQ

data/Tools/H1n8VT4UjzzU

data/Tools/HPYBuzBCPrNb

data/Tools/HTVbIoWvFSlx

data/Tools/HgZ3EFg2uNOp

data/Tools/HmKBrPHNZ1i1

data/Tools/HvEuunSdeF6x

data/Tools/HwqhuoqU5VXO

data/Tools/I4I3gAr1O7ku

data/Tools/I9wfxXuGZux9

data/Tools/IBxmLbjkXDQN

data/Tools/IL6PtSlG8dfJ

data/Tools/INr6KNKyEeK9

data/Tools/ITOuyzVJwBJE

data/Tools/IwDdSTjl3wWA

data/Tools/J5gLbQ6JkDUH

data/Tools/J8W5A2l8cS3d

data/Tools/JCZbyjI3eEtA

data/Tools/JCbgP9ZOnKY6

data/Tools/JFoIhquFHQLU

data/Tools/JKV7XVqumc9y

data/Tools/Jd7yt1ZumOVw

data/Tools/JgmuLGgcBYFi

data/Tools/JvaSrgHtYKLh

data/Tools/K5DWac0YA6PH

data/Tools/KI3ePFCt4kZ5

data/Tools/KJbZOSoN3X2L

data/Tools/KXBdt7vPWRKO

data/Tools/KXWMY3CyZaox

data/Tools/KdjKGFhZXfAM

data/Tools/Kmt9rqh2GmWs

data/Tools/KqnNxpUe6wIz

data/Tools/Kr0gjdOPkejE

data/Tools/Kv5okzPMgjQR

data/Tools/KzfpbnLLMCuo

data/Tools/L0676HAi7vco

data/Tools/L4M6HiFrhD6X

data/Tools/L9ijErkPVFT6

data/Tools/L9w30EjQR61Q

data/Tools/LJ1gvluu8atn

data/Tools/LJrkPDJkAYjv

data/Tools/LK0gz0JlfXWE

data/Tools/LOzekMzdF3zp

data/Tools/LYEUsaTiuhxY

data/Tools/LeUiNGWAaxC5

data/Tools/LegjMKXVhvq1

data/Tools/LtHo0XmjwM1T

data/Tools/LuvwKmauiSrH

data/Tools/LvokzJs8gveo

data/Tools/MEKK0KpIhXQN

data/Tools/MGHrFCd8QAW1

data/Tools/MNFlxqHNndcr

data/Tools/MaYW0h3J797M

data/Tools/MdQsTzy4BVZm

data/Tools/Me9ZrdVo21HR

data/Tools/MhXxgEmQqBlh

data/Tools/MsEME8tELOCi

data/Tools/NCctt8B6goVm

data/Tools/NH5nz1dskJgo

data/Tools/NJBmhNXzHxCx

data/Tools/NLqvx1xGp39Z

data/Tools/NRWt3NO6kzwJ

data/Tools/NcHGDdjDw8Ov

.ps1

data/Tools/NhUhah3gQRcs

data/Tools/NjRfUIq0C5Oy

data/Tools/NoGWo5rbtgaz

data/Tools/NvtlPoYCuyvM

data/Tools/O74biEYYyJa1

data/Tools/OLB3LVAU7e9r

data/Tools/OZrIuEPorqJd

data/Tools/OdK6lywvDXPB

data/Tools/Ouu3zZshga3T

data/Tools/OvUVLcDY5QgB

data/Tools/P6IIRhGttblz

data/Tools/PDXHcoy7MtrJ

data/Tools/PF01LWfS6YJU

data/Tools/PNPXMToDO9YT

data/Tools/POZ1UzvF1jAe

data/Tools/PQ2kNhTOsNSs

data/Tools/PR5qGfDZvqEX

data/Tools/PRUzUr34RGB7

data/Tools/PRew9lpFQp42

data/Tools/PUOWpidAyVvf

data/Tools/PVvPF1Q6ACQ3

data/Tools/PXToaSpP1Eer

data/Tools/PYOMHVDeTr3g

data/Tools/PaCuagD05CU9

data/Tools/PnYoK7E784yp

data/Tools/PsBb20R7EwIm

data/Tools/PssodgJ9jsA6

data/Tools/Pxev3myPGKL8

data/Tools/PztZrN3E0Hp3

data/Tools/Q3LMdNvrjmEf

data/Tools/Q3UHpKeLxZY9

data/Tools/Q4NCOq09jYLM

data/Tools/Q5McUPs5SYVv

data/Tools/Q5tTpbcXgjWz

data/Tools/Q8xIg2VO5xKo

data/Tools/Q8yhqYao3GBQ

data/Tools/Q9Daach89YFq

data/Tools/Q9PEOqRJ2WiD

data/Tools/QBU2wMWWTI6w

data/Tools/QCubkmqNqril

data/Tools/QMeFmZwxZqPQ

data/Tools/QaQI3HelpdVX

data/Tools/QfLayu56samY

data/Tools/Qg6v66I4Dp3z

data/Tools/QjvnmqEjVcXK

data/Tools/a2we3wmVe8y2

data/Tools/a3sXgho4CauA

data/Tools/a50CuJlsUYov

data/Tools/aBy8dcHOudiY

data/Tools/aCe1ODKM9ywA

data/Tools/aG1RXTlouuEH

data/Tools/aJFW0C9AfR9x

data/Tools/aLd7Vg2xm7yP

data/Tools/aMozLZqYGroK

data/Tools/aRMpoEEivYkJ

data/Tools/adsbUdWUnsH9

data/Tools/aeSrzHsMmsBp

data/Tools/agJM4YbhjKX5

data/Tools/aimuLWqIeGec

data/Tools/akTeXvmwHd6B

data/Tools/amzo0m1NvdtC

data/Tools/apg1dyFNz06E

data/Tools/axdhPPueNfCu

data/Tools/b83HqS3YlMbR

data/Tools/bCC4Yd1JwQdK

data/Tools/bZ33J9Vjgb5X

data/Tools/bfiPSV0eL7RV

data/Tools/brd8kH7HxYCf

data/Tools/c1PFNhvQHtjo

data/Tools/cHOCLZIFTHYr

data/Tools/cIJD8WW7jSQ3

data/Tools/cK2mrZ1u6jWv

data/Tools/cKqESvzCRzD3

data/Tools/cQzN9Z66TVV4

data/Tools/cVQDhrMwU3uS

data/Tools/cWbgqAVkNHms

data/Tools/cX8JHT1EcRD3

data/Tools/cbpeUoLy1CNW

data/Tools/czMyJ0a3lOIB

data/Tools/d0VrAcqXP3J9

data/Tools/d2NikFWvZeuO

data/Tools/dAZRBYPlO34O

data/Tools/dHCix6zIrdbD

data/Tools/damD3G4iLiiW

data/Tools/ddtylpycesap

data/Tools/dkAdSRKzVAXO

.ps1

data/Tools/dp7jkR3WSsYc

data/Tools/dqehkVdvxbAq

data/Tools/dvZBULWtCrMe

data/Tools/dzd9PgqDz26d

data/Tools/e17MRnH8tljK

data/Tools/eGv5wxN0rLbj

data/Tools/eVlww01wP1KO

data/Tools/eZ4c0vAklJad

data/Tools/ebFRdyxGepak

data/Tools/eeGuNEFvz2xa

data/Tools/efvaT7LaGgZg

data/Tools/emJhQRR2OzkV

data/Tools/f8rdeaPQnYrW

data/Tools/fBM6HVdLRPCI

data/Tools/fGdmTGkIREWO

data/Tools/fSXjFVFuf8AV

data/Tools/fccrYYdoU4cu

data/Tools/fgGbFKCkxYzs

data/Tools/fjOkkFGh5e3V

data/Tools/fsUmmpPGd2wA

data/Tools/g9zNZCPEECJA

data/Tools/gCXrKg9W7r50

data/Tools/gCrOOZQJaNAM

data/Tools/gF2hEhqfYNPP

data/Tools/gFXNSD7FbnXr

data/Tools/gJdwIGlJ4sNl

data/Tools/gJsBxk1ZDDhp

data/Tools/gL4zgpouvC7x

data/Tools/gLi1eh9mqjCH

data/Tools/ggFL9thwGuoX

data/Tools/gkYFBe2wp9Ay

data/Tools/gmv7nK9hP16s

data/Tools/hFwgOkl3UJP5

data/Tools/hMG1uzkrU9rc

data/Tools/hVyD2Jqilmey

data/Tools/hW20U0HGF3jG

data/Tools/hXdqk31NYDY8

data/Tools/hfmFroXxVRpB

data/Tools/hjAZ7PQxsDMe

data/Tools/hkuTMUPnkR2U

data/Tools/hrmH1ogbzDj3

data/Tools/i4ez51TY1bQs

data/Tools/iA7sXeCUhCVP

data/Tools/iKUs3XLNQ9fo

data/Tools/iOuMKqQKZiKY

data/Tools/iPkvcOvZcmHD

data/Tools/iVvJxtOoOy38

data/Tools/ibHyis9NbVdU

data/Tools/ie9pxdrRLJEY

data/Tools/ikxE9WBCd1lJ

data/Tools/ir0mnXqTSqPj

data/Tools/ivjZXanjaYmA

data/Tools/izFRSmvhIAFF

data/Tools/izg3V6TjfX2A

data/Tools/j92pA8fiOmL7

data/Tools/jMQJ1QHL0l8i

data/Tools/jeupBJO7ZIp3

data/Tools/jf6Yfb1CygZW

data/Tools/kDU5KuWuUnA6

data/Tools/kF7EZvPaATqk

data/Tools/kFPZOF83EG4h

data/Tools/kHUVPNmyplg8

data/Tools/kKaCUy4F9HcE

data/Tools/kOeoMtDBKXWg

data/Tools/kPyZ1ERATMML

data/Tools/kYOstH8bcam1

data/Tools/kYZfMUf2WAhR

data/Tools/kaFxXzBobU09

data/Tools/kdSwpuJ4zku4

data/Tools/kyusLyhrrFtR

data/Tools/l7A1trfYIF0m

data/Tools/lEX2K63EcgwF

data/Tools/lGETIDoCghc7

data/Tools/m1F7aMlhTt5W

data/Tools/mK2QglNkhG10

data/Tools/ms6U9JKgeNA3

data/Tools/mtbTtE8KqEOa

data/Tools/muE5ptRZ10xK

data/Tools/n1QGM33IfG7o

data/Tools/nGNgfTGDH3Ak

data/Tools/nH0a8Z6jwpga

data/Tools/nHXYiXobeT2Z

data/Tools/nJzeI0WGz9b2

data/Tools/nLaww8Qya4tF

data/Tools/nRWVa50Eevt7

data/Tools/nSud7wMC6OhC

data/Tools/nVzXmXNAJ9wU

data/Tools/nbeT4YIhCgUV

data/Tools/nyNjuL3JfobF

data/Tools/o4qAmN2PsAZH

data/Tools/oCJ84ZF5nQZA

data/Tools/oDM84e8rwopD

data/Tools/oI9tC6xasbid

data/Tools/oIlbiP0zB6Lh

data/Tools/oRORJj0yUxRr

data/Tools/oYgJlonF3Xuv

data/Tools/oYukTG0bf3yu

data/Tools/ohCYYYOZXYSV

data/Tools/ojyP2CtJtXfr

data/Tools/opfKnbrixPS8

data/Tools/ov2KFunVOk1X

data/Tools/ozGtMXv88U24

data/Tools/p1MIUOpD45g7

data/Tools/p7Un5ihyZdOC

data/Tools/pCpp8fBdfdD4

data/Tools/pDfIOrAEfM24

data/Tools/pQYPz86pO3IH

data/Tools/pR7nv2hRSPnH

data/Tools/pUdHlKS6PY16

data/Tools/pUnRWNsvoaeI

data/Tools/pZLUaRWERW4s

data/Tools/pcKNO7qeYLLK

data/Tools/peBKvfQhR0N0

data/Tools/prpS74e2mrbl

data/Tools/pwt8ymCy8WPY

data/Tools/pxFm41gf4dgM

data/Tools/py4Y5sMJzmVP

data/Tools/pzqXCUz2wG3k

data/Tools/q0MABW6JQxuB

data/Tools/q0lDc9BVho3Z

data/Tools/q1d7cRAR2xvu

data/Tools/q4b7OraD4GHG

data/Tools/qEUWCUt0VEdX

data/Tools/qHB2dEp90xaP

data/Tools/qJJA0vY75FMI

data/Tools/qMrg7zWL9VJN

data/Tools/qQe9iyLptG04

data/Tools/qaO3bkGGMhOZ

data/Tools/qcZRvTmCaxfZ

data/Tools/qfHjJIE6CxVw

data/Tools/qjDtZqW6hJ9q

data/Tools/qn6goazayAmm

data/Tools/qnTspiZcHJMX

data/UNRAR64.DLL

.dll windows:5 windows x64 arch:x64

88b50645a872d5c8ec79ac8ab9e6d41f

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

25/08/2020, 13:42

Not After

26/08/2023, 13:42

Subject

CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

73:1d:40:ae:3f:3a:1f:b2:bc:3d:83:95
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

25/08/2020, 13:42

Not After

26/08/2023, 13:42

Subject

CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

7b:48:e0:d5:98:4f:10:d2:d3:8d:36:d1:e1:69:1b:25:51:af:8d:c9:b0:55:62:28:15:11:1d:a3:ad:52:21:a7
Signer

Actual PE Digest

7b:48:e0:d5:98:4f:10:d2:d3:8d:36:d1:e1:69:1b:25:51:af:8d:c9:b0:55:62:28:15:11:1d:a3:ad:52:21:a7

Digest Algorithm

sha256

PE Digest Matches

true

45:c8:8d:aa:3e:89:3a:a7:05:c3:2e:f4:49:76:9e:db:f2:74:81:6b
Signer

Actual PE Digest

45:c8:8d:aa:3e:89:3a:a7:05:c3:2e:f4:49:76:9e:db:f2:74:81:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

RemoveDirectoryW

CreateFileW

DeleteFileW

CreateHardLinkW

GetShortPathNameW

GetLongPathNameW

MoveFileW

WriteFile

ReadFile

FlushFileBuffers

SetEndOfFile

SetFilePointer

SetFileAttributesW

GetFileAttributesW

FindClose

FindFirstFileW

FindNextFileW

GetVersionExW

GetCurrentDirectoryW

GetFullPathNameW

FoldStringW

FreeLibrary

GetProcAddress

GetCurrentProcessId

SetThreadPriority

SetThreadExecutionState

CreateEventW

LoadLibraryW

CreateDirectoryW

GetSystemDirectoryW

GetProcessAffinityMask

CreateThread

InitializeCriticalSection

EnterCriticalSection

LeaveCriticalSection

DeleteCriticalSection

SetEvent

ResetEvent

ReleaseSemaphore

WaitForSingleObject

CreateSemaphoreW

GetSystemTime

SystemTimeToTzSpecificLocalTime

TzSpecificLocalTimeToSystemTime

SystemTimeToFileTime

FileTimeToLocalFileTime

LocalFileTimeToFileTime

FileTimeToSystemTime

GetCPInfo

IsDBCSLeadByte

MultiByteToWideChar

WideCharToMultiByte

CompareStringW

WriteConsoleW

SetFilePointerEx

HeapSize

GetConsoleCP

GetProcessHeap

CloseHandle

SetFileTime

DeviceIoControl

GetCurrentProcess

GetCommandLineW

Sleep

SetLastError

GetLastError

AreFileApisANSI

GetConsoleMode

GetStdHandle

GetFileType

GetModuleHandleW

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetCommandLineA

GetOEMCP

IsValidCodePage

FindNextFileA

FindFirstFileExA

SetStdHandle

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

IsProcessorFeaturePresent

InitializeCriticalSectionAndSpinCount

WaitForSingleObjectEx

IsDebuggerPresent

GetStartupInfoW

QueryPerformanceCounter

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

LocalFree

RtlUnwindEx

RtlPcToFileHeader

RaiseException

InterlockedFlushSList

EncodePointer

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

LoadLibraryExW

QueryPerformanceFrequency

ExitProcess

GetModuleHandleExW

GetModuleFileNameA

HeapFree

HeapAlloc

HeapReAlloc

GetACP

GetStringTypeW

LCMapStringW

user32

OemToCharBuffA

CharLowerW

CharUpperW

CharToOemA

CharToOemBuffW

OemToCharA

advapi32

SetFileSecurityW

CheckTokenMembership

FreeSid

AllocateAndInitializeSid

LookupPrivilegeValueW

AdjustTokenPrivileges

OpenProcessToken

ole32

CoCreateInstance

CoSetProxyBlanket

oleaut32

VariantClear

SysFreeString

SysAllocString

Exports

RARCloseArchive

RARGetDllVersion

RAROpenArchive

RAROpenArchiveEx

RARProcessFile

RARProcessFileW

RARReadHeader

RARReadHeaderEx

RARSetCallback

RARSetChangeVolProc

RARSetPassword

RARSetProcessDataProc

Sections

.text
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

data/WCMZIP64.DLL

.dll windows:4 windows x64 arch:x64

d370c5ea3db197b0731cf2e870e9a6f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

57:8f:67:72:21:33:89:47:42:43:f6:c4:99:70:2a:df
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/08/2017, 00:00

Not After

21/08/2018, 23:59

Subject

CN=Ghisler Software GmbH,OU=Development,O=Ghisler Software GmbH,L=Bolligen,ST=Bern,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

53:fc:b9:eb:3d:29:ef:1f:fb:ec:27:70:16:5b:f1:3d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21/08/2017, 00:00

Not After

21/08/2018, 23:59

Subject

CN=Ghisler Software GmbH,OU=Development,O=Ghisler Software GmbH,L=Bolligen,ST=Bern,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:03:87:03:4c:34:70:17:f3:0d:89:69:05:95:9d:8d:32:50:92:14:d7:2b:be:e3:2e:80:c9:40:49:09:ec:0b
Signer

Actual PE Digest

14:03:87:03:4c:34:70:17:f3:0d:89:69:05:95:9d:8d:32:50:92:14:d7:2b:be:e3:2e:80:c9:40:49:09:ec:0b

Digest Algorithm

sha256

PE Digest Matches

true

47:e8:c6:d3:e9:b2:86:dc:04:7b:e0:d8:43:a0:ee:1c:53:9c:52:aa
Signer

Actual PE Digest

47:e8:c6:d3:e9:b2:86:dc:04:7b:e0:d8:43:a0:ee:1c:53:9c:52:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

Imports

kernel32

__C_specific_handler

GetProcAddress

GetModuleHandleA

QueryPerformanceCounter

ReleaseMutex

WaitForSingleObject

CreateMutexA

GetStringTypeW

GetStringTypeA

GetLastError

HeapFree

HeapAlloc

GetCurrentThreadId

FlsSetValue

GetCommandLineA

GetVersionExA

GetProcessHeap

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

CloseHandle

EnterCriticalSection

LeaveCriticalSection

HeapSetInformation

HeapCreate

HeapDestroy

RtlUnwindEx

ExitProcess

WriteFile

GetStdHandle

GetModuleFileNameA

WideCharToMultiByte

GetConsoleCP

GetConsoleMode

FlushFileBuffers

DeleteCriticalSection

MultiByteToWideChar

ReadFile

SetFilePointer

SetHandleCount

GetFileType

GetStartupInfoA

FlsGetValue

TlsFree

FlsFree

SetLastError

TlsSetValue

FlsAlloc

Sleep

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

SetStdHandle

CreateFileA

InitializeCriticalSection

LoadLibraryA

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

HeapReAlloc

SetEndOfFile

LCMapStringA

LCMapStringW

HeapSize

GetLocaleInfoA

user32

SetScrollInfo

SetScrollPos

PeekMessageA

IsDialogMessageA

TranslateMessage

DispatchMessageA

SendMessageA

Exports

DecryptAESMemoryCBC

DecryptZipAES

DeflateChunk

DoneDeflate

EnableSetDpi

EncryptAESMemoryCBC

EncryptZipAES

EndZipAES

GetKeys

GetRandomData

InitZipAES

SetPassCryptAES

SetProtectedScrollInfo

SetProtectedScrollPos

StartDeflate

UpdateOnlyCrc

file_compress

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 894B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 3KB - Virtual size: 2KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

version

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 6KB - Virtual size: 12KB

.rsrc Size: 46KB - Virtual size: 46KB

.reloc Size: 11KB - Virtual size: 11KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 140B

.rsrc Size: 5KB - Virtual size: 4KB

93d099f09873f4f31b1b7ec7cb84e6f0

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8fCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 3KB - Virtual size: 2KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 140B

.rsrc
Size: 5KB - Virtual size: 4KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

3a:10:10:87:8e:d6:f7:dd:d4:ec:8e:8f
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

60:5a:f0:09:cf:08:e1:55:bd:a1:34:88:d9:ac:cf:86:c5:71:dc:9e:76:9e:05:b2:df:40:06:56:b0:95:ad:8e
Signer

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 6KB - Virtual size: 12KB

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 11KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

9b:89:b1:5c:05:2f:38:7e:09:3a:9b:ba:f5:18:32:e8:d1:da:b9:ba:5f:c1:9b:a2:77:d0:7f:99:b8:79:42:d7
Signer

98:17:ce:4e:f2:84:39:06:72:2c:9f:e2:57:6b:95:0b:7c:60:2e:bb
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 17KB - Virtual size: 646KB

.gfids
Size: 512B - Virtual size: 248B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 888KB - Virtual size: 888KB

.reloc
Size: 53KB - Virtual size: 53KB