C4rr11on[.] v1[.]0[.]5[.]617g[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

C4rr11on. v1.0.5.617g.rar
Size

451.9MB
MD5

d2946e764196513b382c81a2b420bf60
SHA1

206468176c4ccbf8f414a72f807e2b728ae1cbd7
SHA256

4bf9a4911ee2ceb5eb59431ab28e20a95a2cd17f0d3dbfbb64da8839dbd8d928
SHA512

94edf5e2fdad199bf8dbe7abb56ed8ec8011f43202bcad7c6a93bdd82582ccaf8cd50c5b657facc4a8c4f596704c332f7e7c2da345d481a7492f1ea14df5e819
SSDEEP

12582912:uxK/nA2tQpb936zn8qgWPal4TKFJ48qMWPa6:eCtQpb9IR9iuKF2Ri6

Score

3^/10

Malware Config

Signatures

Unsigned PE 31 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CARRION v1.0.5.617-PiviGames.blog/Carrion.exe
unpack001/CARRION v1.0.5.617-PiviGames.blog/Galaxy64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/GalaxyNative64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/SDL2.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/fmod64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/fmodstudio64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/fsbank64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/libfsbvorbis64.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/lua54.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/unins000.exe
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.exe
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/CarrionJson.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/FMODWrapper.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/Galaxy.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/GalaxyNative.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/KeraLua.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/LZ4.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/LZ4pn.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/MonoGame.Framework.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/PlatformAPI.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/SDL2.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/SharedMonogameTypes.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/SharedTypes.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/StbImageSharp.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/UGCToolkit.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/fmod.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/fmodstudio.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/fsbank.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/libfsbvorbis.dll
unpack001/CARRION v1.0.5.617-PiviGames.blog/x32/lua54.dll

Files

C4rr11on. v1.0.5.617g.rar
.rar
CARRION v1.0.5.617-PiviGames.blog/Bonus/Carrion_OST.zip
.zip
01 - Main Theme.mp3
02 - Fathomless.mp3
03 - The Hunger.mp3
04 - Malevolent Viscosity.mp3
05 - Mirage.mp3
06 - The Lab.mp3
07 - Metamorphosis I.mp3
08 - Appetite For Destruction.mp3
09 - Metamorphosis II.mp3
10 - Frontier.mp3
11 - Eternal Adversary.mp3
12 - Watery Grave.mp3
13 - Metamorphosis III.mp3
14 - The Mouths of Madness.mp3
15 - What's Yours Is Mine.mp3
16 - AMD - Armored Mech Drone.mp3
17 - Metamorphosis IV.mp3
18 - All Hope Is Lost.mp3
19 - A Maze of Vines.mp3
20 - A Cephalopod's Dream.mp3
21 - Attack of the Peacekeepers.mp3
22 - Containment Unit.mp3
23 - Electronic Division - 209.mp3
24 - Assimilation.mp3
25 - The End As We Know It.mp3
CARRION v1.0.5.617-PiviGames.blog/Carrion.deps.json
CARRION v1.0.5.617-PiviGames.blog/Carrion.dll.config
.xml
CARRION v1.0.5.617-PiviGames.blog/Carrion.exe
.exe windows:6 windows x64 arch:x64

5f4ff962dc52febac00d344b025c1959

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapFree
GetTickCount64
Sleep
GetCurrentProcessorNumber
WaitForSingleObject
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetProcAddress
IsDebuggerPresent
RaiseFailFastException
WaitForThreadpoolWaitCallbacks
LoadLibraryExW
FreeLibrary
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
WaitForMultipleObjectsEx
SetEvent
ResetEvent
CreateEventExW
FlushProcessWriteBuffers
WaitForSingleObjectEx
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
GetCurrentThread
RaiseException
GetFileAttributesExW
ReadFile
GetSystemInfo
VirtualQuery
RtlVirtualUnwind
GetStdHandle
CreateFileW
WriteFile
AddVectoredExceptionHandler
FlsAlloc
CloseThreadpoolIo
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
GetTickCount
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableW
GetSystemTimeAsFileTime
DebugBreak
InitializeCriticalSection
SleepEx
GlobalMemoryStatusEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
GetNumaHighestNodeNumber
GetProcessAffinityMask
WriteConsoleW
HeapReAlloc
HeapAlloc
GetProcessHeap
GetLastError
CloseHandle
FlsGetValue
SetLastError
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetFileType
MultiByteToWideChar
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW

advapi32

AdjustTokenPrivileges
OpenProcessToken
EventEnabled
EventWrite
EventRegister
LookupPrivilegeValueW

ole32

CoWaitForMultipleHandles
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetApartmentType

bcrypt

BCryptGenRandom

Sections

.text
Size: 616KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 13.7MB - Virtual size: 13.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1017KB - Virtual size: 1017KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Carrion.runtimeconfig.json
CARRION v1.0.5.617-PiviGames.blog/CarrionJson.pdb
CARRION v1.0.5.617-PiviGames.blog/Content/Animations/ParkaHuman.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Animations/RegularFemale.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Animations/RegularMale.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Animations/SWATHuman.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Audio/MasterBank.bank
CARRION v1.0.5.617-PiviGames.blog/Content/Audio/MasterBank.strings.bank
CARRION v1.0.5.617-PiviGames.blog/Content/Audio/Sounds.bank
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/BasicEffect.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/CRT_1.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/CRT_2.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Common/Common.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Common/Macros.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/DefaultText.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Enemies/MonsterTransformation.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Enemies/MultichannelVariant.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/LevelLayer.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/LevelLayerColorCorrection.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/LevelLayerLightMask.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Lighting/ChamberShadowEffect.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Lighting/LightPostprocessing.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Lighting/Shadow.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Models/DefaultModel.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/NearestNeighborSmoothing.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/EternalFog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/Fog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/Gibs.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/HivePlaceGlow.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/Parallax.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/PremultipliedAlpha.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/TwitchingMeat.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Objects/Water.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/Birth.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/BloomFog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/BloomFogPost.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/Cells.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/CellsPost.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/FadeOut.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/Hurt.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/Impersonation.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Postprocessing/LUT.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/Pseudo3D.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Effects/TextsShader.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/DefaultFont-CH.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/DefaultFont-JP.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/DefaultFont-Korean.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/DefaultFont.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/Licenses/GohuFont.txt
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/MenuLarge.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/MenuSmall.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Fonts/Small.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/General/Localization.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/General/LocalizationTokens.bin
CARRION v1.0.5.617-PiviGames.blog/Content/General/autoexec.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/General/music_interaction.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/bunker.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/bureau.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/demo.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/dev.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/ending.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/jungle.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/junkyard.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/lab.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/mines.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/nuclear.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/overworld.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/sequence0.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/sequence1.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/sequence2.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/water.json
CARRION v1.0.5.617-PiviGames.blog/Content/Levels/weapons.json
CARRION v1.0.5.617-PiviGames.blog/Content/ObjectTypes/object_types.json
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/bunker.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/bureau.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/demo.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/dev.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/jungle.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/junkyard.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/lab.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/mines.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/nuclear.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/overworld.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/water.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Scripts/weapons.cgs
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/general/default_light.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/general/parallax.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/seaweed.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/shrub1.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/shrub2.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/simple_plant.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/tentacle.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/plants/vine.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/cord.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/dot_matrix_display.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/fan.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/lamp.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/lamp_back_ground_tiny.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/lamp_background.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/decoration/tech/large_chain.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/cabinet.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/destructible.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/drawer.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/empty_jar.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/lab_burner.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/lab_glassware.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/lab_microscope.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/lab_tube_rack.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/locker.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/mainframe.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/office_desk.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/sink.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/toilet.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/tv_all.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/tv_code.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/tv_info_news.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/tv_noise.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/tv_stock.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/urinal.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/destructible/vending_machine.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/humans/assault_rifle_human.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/humans/corpse.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/humans/flamethrower_human.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/humans/pistol_human.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/humans/unarmed_human.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/drone_seating.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/mech_left.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/mech_right.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/missile_tank.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/scout_drone.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/turret.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/enemies/robots/turret_flame.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/cocoon.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/door.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/elevator.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/elevator_left_closed.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/elevator_right_closed.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/floodgate_horizontal.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/floodgate_vertical.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/jammer.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/jammer_receiver.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/laser_down.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/laser_left.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/laser_right.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/laser_up.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/lever_left.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/lever_right.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/nuclear_core_dispenser.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/nuclear_generator.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/obstacle.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/palm_reader.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/palm_scanner.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/plain_door.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/portal.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/power_node.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/rivet_bottom.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/rivet_left.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/rivet_right.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/rivet_top.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/sequence_entrance.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/switch.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/trigger.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/turbine.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/flow/window.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/fluids/water.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/fog/clouds.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/fog/eternal_fog.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/fog/fog.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/fog/rain.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/interactions/examine.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/interactions/no_animation.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/interactions/open.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/interactions/pick_up.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/interactions/pull.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/monster/monster_3_nodes.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/progress/goal.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/progress/hive_checkpoint.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/progress/upgrade_container.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/system/chamber.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/system/marker.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/traps/sticky_bomb.json
CARRION v1.0.5.617-PiviGames.blog/Content/Templates/utils/nuclear_core.json
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Buttons.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Buttons.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Effects/Morph.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Goo.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Gradients/Radial.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Humans/MultichannelVariants.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/LevelTextures.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Lighting/Light.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/DLCRibbon.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/Logo.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/MenuColor.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/MenuDepth.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/SplashScreen.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Menu/SplashScreenLogos.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuJaw.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuJaw.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuJawTwitchMap.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuXmas.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuXmas.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/MenuXmasWindMap.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Monsters.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Monsters.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/Clouds.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/Fog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/HiveVeins.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/Rain.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/Snow.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Objects/UniformFog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CavesA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CavesB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CityA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CityANight.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CityB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CityBNight.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CityC.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/CloudsA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Computers.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Computers_1.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Computers_2.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Computers_3.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/ConiferForestA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Default.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/DunesA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/DunesB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/FogLayerA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/FogLayerB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/JungleA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/JunkyardA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/JunkyardB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/MilkyWay.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/MinesA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/PipesA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/PipesB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/PipesC.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Sea.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/Sun.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/SunsetA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/SunsetB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/TowersA.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Parallaxes/TowersB.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Particles.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Particles.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Postprocessing/CellTexture.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Postprocessing/Dither.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Postprocessing/EternalFog.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Postprocessing/LUT.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Sequences.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Sequences.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/System/LayerClear.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/UI/Element.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/Textures/Water.xnb
CARRION v1.0.5.617-PiviGames.blog/Content/TileSets/tiles-editor.png
.png
CARRION v1.0.5.617-PiviGames.blog/Content/TileSets/tiles.json
CARRION v1.0.5.617-PiviGames.blog/Content/TileSets/tiles.xnb
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Levels/xmas_final.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Levels/xmas_special.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Scripts/xmas_special.cgs
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/general/default_light.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/general/parallax.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/seaweed.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/shrub1.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/shrub2.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/simple_plant.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/tentacle.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/plants/vine.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/cord.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/dot_matrix_display.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/fan.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/lamp.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/lamp_back_ground_tiny.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/lamp_background.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/decoration/tech/large_chain.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/cabinet.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/destructible.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/drawer.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/empty_jar.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/lab_burner.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/lab_glassware.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/lab_microscope.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/lab_tube_rack.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/locker.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/mainframe.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/office_desk.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/sink.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/toilet.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/tv_all.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/tv_code.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/tv_info_news.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/tv_noise.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/tv_stock.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/urinal.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/destructible/vending_machine.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/humans/assault_rifle_human.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/humans/corpse.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/humans/flamethrower_human.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/humans/pistol_human.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/humans/unarmed_human.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/drone_seating.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/mech_left.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/mech_right.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/missile_tank.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/scout_drone.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/turret.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/enemies/robots/turret_flame.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/cocoon.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/door.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/elevator.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/elevator_left_closed.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/elevator_right_closed.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/floodgate_horizontal.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/floodgate_vertical.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/jammer.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/jammer_receiver.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/laser_down.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/laser_left.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/laser_right.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/laser_up.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/lever_left.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/lever_right.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/nuclear_core_dispenser.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/nuclear_generator.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/obstacle.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/palm_reader.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/palm_scanner.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/plain_door.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/portal.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/power_node.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/rivet_bottom.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/rivet_left.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/rivet_right.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/rivet_top.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/sequence_entrance.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/switch.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/trigger.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/turbine.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/flow/window.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/fluids/water.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/fog/clouds.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/fog/eternal_fog.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/fog/fog.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/fog/rain.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/interactions/examine.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/interactions/no_animation.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/interactions/open.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/interactions/pick_up.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/interactions/pull.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/monster/monster_3_nodes.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/progress/goal.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/progress/hive_checkpoint.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/progress/upgrade_container.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/system/chamber.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/system/marker.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/traps/instakill_grid.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/traps/sticky_bomb.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/Templates/utils/nuclear_core.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/TileSets/tiles-editor.png
.png
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/TileSets/tiles.json
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/logo.png
.png
CARRION v1.0.5.617-PiviGames.blog/DLC/GTOY/settings.json
CARRION v1.0.5.617-PiviGames.blog/Descarga JUEGOS GRATIS - PiviGames.blog.url
.url
CARRION v1.0.5.617-PiviGames.blog/EULA.txt
CARRION v1.0.5.617-PiviGames.blog/FMODWrapper.pdb
CARRION v1.0.5.617-PiviGames.blog/Galaxy64.dll
.dll windows:6 windows x64 arch:x64

53c1944248ee9ddf1a5409f6de728cd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

inet_addr
ntohl
bind
WSACleanup
htons
htonl
ntohs
closesocket
ioctlsocket
getpeername
getsockopt
inet_ntoa
recvfrom
sendto
setsockopt
socket
gethostbyname
gethostname
__WSAFDIsSet
WSASetLastError
WSAGetLastError
WSARecv
WSASend
inet_pton
WSASocketW
WSAAddressToStringW
WSAStringToAddressW
getaddrinfo
WSAIoctl
shutdown
send
freeaddrinfo
getsockname
select
recv
listen
connect
accept
WSAStartup

kernel32

MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetThreadPriority
Sleep
LocalFree
FormatMessageA
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SetFileTime
QueryPerformanceFrequency
GetWindowsDirectoryW
GetProcAddress
CreateDirectoryExW
CopyFileW
MoveFileExW
AreFileApisANSI
FreeLibrary
LoadLibraryA
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
QueryPerformanceCounter
GetModuleHandleA
FlushConsoleInputBuffer
GlobalMemoryStatus
GetSystemTime
GetFileSizeEx
CreateFileA
ExpandEnvironmentStringsA
GetSystemDirectoryA
InitializeCriticalSectionEx
GetTickCount64
SystemTimeToFileTime
CreateWaitableTimerA
GetSystemInfo
OpenEventA
SetConsoleTextAttribute
CreateEventA
QueryFullProcessImageNameA
OpenProcess
CreateProcessA
GetExitCodeProcess
SleepEx
VerifyVersionInfoA
WaitForMultipleObjects
TerminateThread
QueueUserAPC
SetWaitableTimer
GetQueuedCompletionStatus
CreateIoCompletionPort
VerSetConditionMask
OutputDebugStringA
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
TlsFree
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
GetLastError
RtlCaptureStackBackTrace
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
DeviceIoControl
GetCPInfo
FormatMessageW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
GetLocaleInfoW
GetStringTypeW
SetConsoleMode
SetEvent
ResetEvent
InitializeSListHead
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
WaitForSingleObject
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetConsoleCtrlHandler
GetFullPathNameA
ReadFile
ExitThread
ResumeThread
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetACP
GetStdHandle
GetFileType
GetDriveTypeW
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
FlushFileBuffers
WriteFile
GetConsoleCP
GetProcessHeap
GetTimeZoneInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW

user32

GetDC
GetUserObjectInformationW
ReleaseDC
WaitForInputIdle
MessageBoxW
LoadStringW
LoadStringA
GetProcessWindowStation

bcrypt

BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDecrypt
BCryptGenRandom
BCryptDestroySecret
BCryptSecretAgreement
BCryptDeriveKey
BCryptSignHash
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptExportKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptDestroyKey

wininet

InternetGetConnectedState

crypt32

CryptQueryObject
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA

iphlpapi

IcmpCreateFile
IcmpSendEcho

gdi32

GetDIBits
CreateCompatibleBitmap
DeleteObject
GetObjectW
GetDeviceCaps

shell32

SHGetFolderPathW

advapi32

StartServiceA
CloseServiceHandle
ControlService
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CryptAcquireContextA
CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam

mswsock

AcceptEx
GetAcceptExSockaddrs

Exports

Exports

?Apps@api@galaxy@@YAPEAVIApps@12@XZ
?Chat@api@galaxy@@YAPEAVIChat@12@XZ
?CustomNetworking@api@galaxy@@YAPEAVICustomNetworking@12@XZ
?Friends@api@galaxy@@YAPEAVIFriends@12@XZ
?GameServerListenerRegistrar@api@galaxy@@YAPEAVIListenerRegistrar@12@XZ
?GameServerLogger@api@galaxy@@YAPEAVILogger@12@XZ
?GameServerMatchmaking@api@galaxy@@YAPEAVIMatchmaking@12@XZ
?GameServerNetworking@api@galaxy@@YAPEAVINetworking@12@XZ
?GameServerTelemetry@api@galaxy@@YAPEAVITelemetry@12@XZ
?GameServerUser@api@galaxy@@YAPEAVIUser@12@XZ
?GameServerUtils@api@galaxy@@YAPEAVIUtils@12@XZ
?GetError@api@galaxy@@YAPEBVIError@12@XZ
?Init@api@galaxy@@YAXAEBUInitOptions@12@@Z
?InitGameServer@api@galaxy@@YAXAEBUInitOptions@12@@Z
?ListenerRegistrar@api@galaxy@@YAPEAVIListenerRegistrar@12@XZ
?Logger@api@galaxy@@YAPEAVILogger@12@XZ
?Matchmaking@api@galaxy@@YAPEAVIMatchmaking@12@XZ
?Networking@api@galaxy@@YAPEAVINetworking@12@XZ
?ProcessData@api@galaxy@@YAXXZ
?ProcessGameServerData@api@galaxy@@YAXXZ
?Shutdown@api@galaxy@@YAXXZ
?ShutdownGameServer@api@galaxy@@YAXXZ
?Stats@api@galaxy@@YAPEAVIStats@12@XZ
?Storage@api@galaxy@@YAPEAVIStorage@12@XZ
?Telemetry@api@galaxy@@YAPEAVITelemetry@12@XZ
?User@api@galaxy@@YAPEAVIUser@12@XZ
?Utils@api@galaxy@@YAPEAVIUtils@12@XZ
load

Sections

.text
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 591KB - Virtual size: 657KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 599KB - Virtual size: 598KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/GalaxyNative64.dll
.dll windows:6 windows x64 arch:x64

a31a41ed4f924ab1c161e6bc55518e9c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

galaxy64

?ListenerRegistrar@api@galaxy@@YAPEAVIListenerRegistrar@12@XZ
?Stats@api@galaxy@@YAPEAVIStats@12@XZ
?GetError@api@galaxy@@YAPEBVIError@12@XZ
?Init@api@galaxy@@YAXAEBUInitOptions@12@@Z
?ProcessData@api@galaxy@@YAXXZ
?Apps@api@galaxy@@YAPEAVIApps@12@XZ
?User@api@galaxy@@YAPEAVIUser@12@XZ
?Shutdown@api@galaxy@@YAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__std_terminate
_purecall
memset

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_initialize_narrow_environment
_initterm_e
_initterm
_cexit
_configure_narrow_argv
_seh_filter_dll

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime

Exports

Exports

Galaxy_AreAchievementsRetrieved
Galaxy_ClearAchievement
Galaxy_GetAuthStatus
Galaxy_GetCurrentGameLanguage
Galaxy_GetError
Galaxy_GetStatsAndAchievementsStatus
Galaxy_GetUserID
Galaxy_Init
Galaxy_IsAchievementUnlocked
Galaxy_IsLoggedOn
Galaxy_ProcessData
Galaxy_RequestStatsAndAchievements
Galaxy_SetAchievement
Galaxy_Shutdown
Galaxy_SignIn
Galaxy_StoreStatsAndAchievements

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Icon.ico
CARRION v1.0.5.617-PiviGames.blog/Licenses.txt
CARRION v1.0.5.617-PiviGames.blog/PlatformAPI.pdb
CARRION v1.0.5.617-PiviGames.blog/Redist/vc_redist.x644.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:c4:15:a1:23:fa:49:fb:dc:05:86:1f:21:48:b0:49:3b:d5:1d:dc:c6:72:35:17:aa:75:ea:bc:63:fa:76:f8
Signer

Actual PE Digest

6b:c4:15:a1:23:fa:49:fb:dc:05:86:1f:21:48:b0:49:3b:d5:1d:dc:c6:72:35:17:aa:75:ea:bc:63:fa:76:f8

Digest Algorithm

sha256

PE Digest Matches

true

57:19:7f:e6:ec:8b:ea:59:58:33:9f:f6:88:06:04:41:78:e0:04:94
Signer

Actual PE Digest

57:19:7f:e6:ec:8b:ea:59:58:33:9f:f6:88:06:04:41:78:e0:04:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vc_redist.x864.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4
Signer

Actual PE Digest

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4

Digest Algorithm

sha256

PE Digest Matches

true

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6
Signer

Actual PE Digest

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

a1f6f100bff4507a3332f3f0cdfc24f5

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7e:e6:b3:26:a0:5b:83:d2:4a:74:47:94:80:1b:e6:8c:ef:59:05:96
Signer

Actual PE Digest

7e:e6:b3:26:a0:5b:83:d2:4a:74:47:94:80:1b:e6:8c:ef:59:05:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf

advapi32

InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor

kernel32

CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime

user32

SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow

ntdll

NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x642.exe
.exe windows:5 windows x86 arch:x86

dcbe94b8cc54b8e53867c61cc96811d6

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:03:69:a4:40:7e:43:e2:00:c5:92:64:aa:e6:bc:8b:76:88:df:44:40:89:f4:ae:09:76:6c:f7:df:da:11:e1
Signer

Actual PE Digest

7c:03:69:a4:40:7e:43:e2:00:c5:92:64:aa:e6:bc:8b:76:88:df:44:40:89:f4:ae:09:76:6c:f7:df:da:11:e1

Digest Algorithm

sha256

PE Digest Matches

true

30:b3:61:3b:16:4e:9c:aa:e6:a5:4f:3b:72:a7:34:da:1d:ed:70:f9
Signer

Actual PE Digest

30:b3:61:3b:16:4e:9c:aa:e6:a5:4f:3b:72:a7:34:da:1d:ed:70:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
QueryServiceConfigW

user32

GetMessageW
PeekMessageW
PostMessageW
PostThreadMessageW
PostQuitMessage
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
IsDialogMessageW
MessageBoxW
GetWindowLongW
RegisterClassW
IsWindow
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
LoadBitmapW
GetCursorPos
MonitorFromPoint
CreateWindowExW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

gdi32

DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
DeleteDC
StretchBlt

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
CoCreateInstance
CoInitialize
StringFromGUID2
CoInitializeEx
CoUninitialize

kernel32

ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
RtlUnwind
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
DuplicateHandle
SetThreadExecutionState
CopyFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
CompareStringA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetVersionExW
GetCurrentThreadId
TlsAlloc
TlsSetValue
ReleaseMutex
GetLastError
Sleep
TlsGetValue
CloseHandle
DeleteCriticalSection
GetTimeZoneInformation
GetACP
GetCPInfo
RaiseException
HeapAlloc
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
GlobalFree
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsFree
InitializeCriticalSection
GetCurrentProcess
HeapSetInformation
GetOEMCP
SetFileAttributesW
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
FormatMessageW
GetTempFileNameW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap
GetModuleHandleA
GetFileSizeEx
GetUserDefaultLangID
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
MoveFileExW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
CopyFileW

cabinet

ord23
ord22
ord20

crypt32

CryptHashPublicKeyInfo
CertGetCertificateContextProperty

msi

ord116
ord17
ord125
ord171
ord8
ord115
ord118
ord205
ord45
ord137
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169

rpcrt4

UuidCreate

wininet

InternetCrackUrlW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetConnectW
InternetOpenW

wintrust

CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x643.exe
.exe windows:5 windows x86 arch:x86

33c6db41ca15b47cfcec52de6c2ab2b7

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:c5:3f:c6:cf:61:80:fa:ca:50:0d:be:3d:8c:71:96:9a:5f:de:3a:97:a3:72:8e:48:0f:76:c1:95:c7:4a:17
Signer

Actual PE Digest

07:c5:3f:c6:cf:61:80:fa:ca:50:0d:be:3d:8c:71:96:9a:5f:de:3a:97:a3:72:8e:48:0f:76:c1:95:c7:4a:17

Digest Algorithm

sha256

PE Digest Matches

true

6c:6c:5f:05:6b:fb:f9:61:c3:3a:07:4c:73:49:9c:53:7b:5f:c2:59
Signer

Actual PE Digest

6c:6c:5f:05:6b:fb:f9:61:c3:3a:07:4c:73:49:9c:53:7b:5f:c2:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CopyFileExW
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
ResetEvent
SetEndOfFile
DeleteFileW
GetThreadLocale
UnmapViewOfFile
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetLocalTime
SetFilePointer
GetComputerNameW
CreateFileA
GetProcessHeap
GetModuleHandleA
CopyFileW
MoveFileExW
GlobalFree
GlobalAlloc
GetFileSizeEx
GetCurrentDirectoryW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
RaiseException
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FormatMessageW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
CompareStringW
InitializeCriticalSection
CloseHandle
LocalFree
ReleaseMutex
GetVersionExW
GetProcessId
ReadFile
CreateNamedPipeW
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
WaitForSingleObject
OpenProcess
CreateFileW
SetFilePointerEx
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
VerifyVersionInfoW
VerSetConditionMask
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
GetExitCodeProcess
SetThreadExecutionState
FlushFileBuffers

msi

ord171
ord45
ord137
ord125
ord17
ord8
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
ord118
ord115
ord116
ord205

shell32

SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW

rpcrt4

UuidCreate

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetSetOptionW
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
StretchBlt

cabinet

ord23
ord22
ord20

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SetNamedSecurityInfoW
AllocateAndInitializeSid
CheckTokenMembership
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegOpenKeyExW
GetTokenInformation
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfigW
DecryptFileW
SetEntriesInAclW
InitializeAcl
CreateWellKnownSid
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceConfigW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

ole32

CLSIDFromProgID
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
StringFromGUID2

user32

LoadBitmapW
IsWindow
PostMessageW
PeekMessageW
GetMessageW
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
CreateWindowExW
RegisterClassW
MsgWaitForMultipleObjects
LoadCursorW
PostQuitMessage
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
PostThreadMessageW
MessageBoxW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

a1f6f100bff4507a3332f3f0cdfc24f5

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:c8:53:53:4b:f3:8d:17:29:22:b7:77:39:d5:7a:e2:70:d6:a5:b8
Signer

Actual PE Digest

5f:c8:53:53:4b:f3:8d:17:29:22:b7:77:39:d5:7a:e2:70:d6:a5:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf

advapi32

InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor

kernel32

CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime

user32

SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow

ntdll

NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.7MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x862.exe
.exe windows:5 windows x86 arch:x86

dcbe94b8cc54b8e53867c61cc96811d6

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:74:c3:79:56:e7:2b:5d:3a:c2:b9:84:ce:5e:5a:6e:87:d4:41:57:40:ea:74:ae:2c:8b:db:54:2a:69:14:3c
Signer

Actual PE Digest

af:74:c3:79:56:e7:2b:5d:3a:c2:b9:84:ce:5e:5a:6e:87:d4:41:57:40:ea:74:ae:2c:8b:db:54:2a:69:14:3c

Digest Algorithm

sha256

PE Digest Matches

true

c6:e9:00:f0:64:0e:2a:52:a2:da:4c:db:2e:25:f4:6b:1c:8c:4b:6b
Signer

Actual PE Digest

c6:e9:00:f0:64:0e:2a:52:a2:da:4c:db:2e:25:f4:6b:1c:8c:4b:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
QueryServiceConfigW

user32

GetMessageW
PeekMessageW
PostMessageW
PostThreadMessageW
PostQuitMessage
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
IsDialogMessageW
MessageBoxW
GetWindowLongW
RegisterClassW
IsWindow
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
LoadBitmapW
GetCursorPos
MonitorFromPoint
CreateWindowExW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

gdi32

DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
DeleteDC
StretchBlt

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
CoCreateInstance
CoInitialize
StringFromGUID2
CoInitializeEx
CoUninitialize

kernel32

ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
RtlUnwind
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
DuplicateHandle
SetThreadExecutionState
CopyFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
CompareStringA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetVersionExW
GetCurrentThreadId
TlsAlloc
TlsSetValue
ReleaseMutex
GetLastError
Sleep
TlsGetValue
CloseHandle
DeleteCriticalSection
GetTimeZoneInformation
GetACP
GetCPInfo
RaiseException
HeapAlloc
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
GlobalFree
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsFree
InitializeCriticalSection
GetCurrentProcess
HeapSetInformation
GetOEMCP
SetFileAttributesW
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
FormatMessageW
GetTempFileNameW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap
GetModuleHandleA
GetFileSizeEx
GetUserDefaultLangID
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
MoveFileExW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
CopyFileW

cabinet

ord23
ord22
ord20

crypt32

CryptHashPublicKeyInfo
CertGetCertificateContextProperty

msi

ord116
ord17
ord125
ord171
ord8
ord115
ord118
ord205
ord45
ord137
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169

rpcrt4

UuidCreate

wininet

InternetCrackUrlW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetConnectW
InternetOpenW

wintrust

CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/Redist/vcredist_x863.exe
.exe windows:5 windows x86 arch:x86

33c6db41ca15b47cfcec52de6c2ab2b7

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:e7:0c:89:55:fe:17:47:bf:fc:11:1e:47:bb:a8:d9:82:a5:1f:58:f1:9c:0e:1f:00:6a:71:79:e7:ff:75:22
Signer

Actual PE Digest

d4:e7:0c:89:55:fe:17:47:bf:fc:11:1e:47:bb:a8:d9:82:a5:1f:58:f1:9c:0e:1f:00:6a:71:79:e7:ff:75:22

Digest Algorithm

sha256

PE Digest Matches

true

36:8d:a7:ef:b6:4b:ef:51:51:7c:7b:1c:58:f3:56:1f:6d:97:57:92
Signer

Actual PE Digest

36:8d:a7:ef:b6:4b:ef:51:51:7c:7b:1c:58:f3:56:1f:6d:97:57:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CopyFileExW
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
ResetEvent
SetEndOfFile
DeleteFileW
GetThreadLocale
UnmapViewOfFile
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetLocalTime
SetFilePointer
GetComputerNameW
CreateFileA
GetProcessHeap
GetModuleHandleA
CopyFileW
MoveFileExW
GlobalFree
GlobalAlloc
GetFileSizeEx
GetCurrentDirectoryW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
RaiseException
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FormatMessageW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
CompareStringW
InitializeCriticalSection
CloseHandle
LocalFree
ReleaseMutex
GetVersionExW
GetProcessId
ReadFile
CreateNamedPipeW
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
WaitForSingleObject
OpenProcess
CreateFileW
SetFilePointerEx
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
VerifyVersionInfoW
VerSetConditionMask
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
GetExitCodeProcess
SetThreadExecutionState
FlushFileBuffers

msi

ord171
ord45
ord137
ord125
ord17
ord8
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
ord118
ord115
ord116
ord205

shell32

SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW

rpcrt4

UuidCreate

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetSetOptionW
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
StretchBlt

cabinet

ord23
ord22
ord20

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SetNamedSecurityInfoW
AllocateAndInitializeSid
CheckTokenMembership
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegOpenKeyExW
GetTokenInformation
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfigW
DecryptFileW
SetEntriesInAclW
InitializeAcl
CreateWellKnownSid
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceConfigW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

ole32

CLSIDFromProgID
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
StringFromGUID2

user32

LoadBitmapW
IsWindow
PostMessageW
PeekMessageW
GetMessageW
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
CreateWindowExW
RegisterClassW
MsgWaitForMultipleObjects
LoadCursorW
PostQuitMessage
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
PostThreadMessageW
MessageBoxW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/SDL2.dll
.dll windows:6 windows x64 arch:x64

e0c2f6a4de0f10db97446ece531f6edf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

winmm

waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveInUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutGetNumDevs
timeEndPeriod
waveInAddBuffer
waveInStart
waveInReset
timeGetTime
waveOutUnprepareHeader
timeBeginPeriod

imm32

ImmNotifyIME
ImmSetCompositionWindow
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetCandidateListW
ImmGetContext

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

CreateSemaphoreW
WideCharToMultiByte
WaitForSingleObjectEx
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
VerSetConditionMask
GetLastError
FormatMessageW
VerifyVersionInfoW
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryA
CreateFileW
GetFileSizeEx
ReleaseSemaphore
SetFilePointer
SetFilePointerEx
WriteFile
SetErrorMode
CreateDirectoryW
GetCurrentProcess
lstrcatW
lstrlenW
GetModuleHandleW
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
CreateEventA
LocalFree
CloseHandle
Process32First
Process32Next
GetSystemPowerStatus
ExitProcess
TerminateProcess
GetStdHandle
OutputDebugStringW
lstrlenA
AttachConsole
GetConsoleMode
WriteConsoleW
GetEnvironmentVariableA
SetEnvironmentVariableA
Sleep
VirtualAlloc
VirtualFree
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
GlobalUnlock
GlobalLock
GetTickCount
GetModuleFileNameW
CompareStringA
MulDiv
SetThreadExecutionState
WaitForSingleObject
CreateToolhelp32Snapshot
ReadFile

user32

CreateWindowExW
SetTimer
KillTimer
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
PeekMessageW
GetMessageExtraInfo
CallWindowProcW
GetClassInfoExW
IsWindowVisible
IsIconic
GetKeyState
GetAsyncKeyState
GetSystemMetrics
GetMenu
GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
IsRectEmpty
GetWindowLongW
LoadIconW
DestroyIcon
GetRawInputData
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
PostMessageW
DialogBoxIndirectParamW
UnregisterClassW
GetDlgItem
SetFocus
DrawTextW
GetDC
ReleaseDC
GetWindowLongPtrW
SetWindowLongPtrW
SystemParametersInfoA
SystemParametersInfoW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
SetCursorPos
LoadCursorW
CreateIconIndirect
RegisterRawInputDevices
SetWindowRgn
TrackMouseEvent
SendMessageW
RegisterClassW
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
GetFocus
SetForegroundWindow
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SetWindowLongW
GetParent
CreateIconFromResource
PostThreadMessageW
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcW
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetDoubleClickTime
MessageBoxA
GetDesktopWindow
RegisterClassExW
GetRawInputDeviceInfoA
TranslateMessage
GetMessageW
EndDialog
GetRawInputDeviceList
DispatchMessageW

gdi32

CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
GetDIBits
DeleteDC
BitBlt
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateRectRgn
CombineRgn
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateBitmap
CreateDCW
GetTextMetricsW
GetTextExtentPoint32A
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ExtractIconExW
DragAcceptFiles
DragFinish
SHGetFolderPathW
DragQueryFileW

ole32

CoUninitialize
CoInitializeEx
PropVariantClear
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString

Exports

Exports

SDL_AddEventWatch
SDL_AddHintCallback
SDL_AddTimer
SDL_AllocFormat
SDL_AllocPalette
SDL_AllocRW
SDL_AtomicAdd
SDL_AtomicCAS
SDL_AtomicCASPtr
SDL_AtomicGet
SDL_AtomicGetPtr
SDL_AtomicLock
SDL_AtomicSet
SDL_AtomicSetPtr
SDL_AtomicTryLock
SDL_AtomicUnlock
SDL_AudioInit
SDL_AudioQuit
SDL_AudioStreamAvailable
SDL_AudioStreamClear
SDL_AudioStreamFlush
SDL_AudioStreamGet
SDL_AudioStreamPut
SDL_BuildAudioCVT
SDL_CalculateGammaRamp
SDL_CaptureMouse
SDL_ClearError
SDL_ClearHints
SDL_ClearQueuedAudio
SDL_CloseAudio
SDL_CloseAudioDevice
SDL_ComposeCustomBlendMode
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertPixels
SDL_ConvertSurface
SDL_ConvertSurfaceFormat
SDL_CreateColorCursor
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateRGBSurfaceWithFormat
SDL_CreateRGBSurfaceWithFormatFrom
SDL_CreateRenderer
SDL_CreateSemaphore
SDL_CreateShapedWindow
SDL_CreateSoftwareRenderer
SDL_CreateSystemCursor
SDL_CreateTexture
SDL_CreateTextureFromSurface
SDL_CreateThread
SDL_CreateThreadWithStackSize
SDL_CreateWindow
SDL_CreateWindowAndRenderer
SDL_CreateWindowFrom
SDL_DXGIGetOutputInfo
SDL_DYNAPI_entry
SDL_DelEventWatch
SDL_DelHintCallback
SDL_Delay
SDL_DequeueAudio
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroyRenderer
SDL_DestroySemaphore
SDL_DestroyTexture
SDL_DestroyWindow
SDL_DetachThread
SDL_Direct3D9GetAdapterIndex
SDL_DisableScreenSaver
SDL_DuplicateSurface
SDL_EnableScreenSaver
SDL_EnclosePoints
SDL_Error
SDL_EventState
SDL_FillRect
SDL_FillRects
SDL_FilterEvents
SDL_FlushEvent
SDL_FlushEvents
SDL_FreeAudioStream
SDL_FreeCursor
SDL_FreeFormat
SDL_FreePalette
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_GL_BindTexture
SDL_GL_CreateContext
SDL_GL_DeleteContext
SDL_GL_ExtensionSupported
SDL_GL_GetAttribute
SDL_GL_GetCurrentContext
SDL_GL_GetCurrentWindow
SDL_GL_GetDrawableSize
SDL_GL_GetProcAddress
SDL_GL_GetSwapInterval
SDL_GL_LoadLibrary
SDL_GL_MakeCurrent
SDL_GL_ResetAttributes
SDL_GL_SetAttribute
SDL_GL_SetSwapInterval
SDL_GL_SwapWindow
SDL_GL_UnbindTexture
SDL_GL_UnloadLibrary
SDL_GameControllerAddMapping
SDL_GameControllerAddMappingsFromRW
SDL_GameControllerClose
SDL_GameControllerEventState
SDL_GameControllerFromInstanceID
SDL_GameControllerFromPlayerIndex
SDL_GameControllerGetAttached
SDL_GameControllerGetAxis
SDL_GameControllerGetAxisFromString
SDL_GameControllerGetBindForAxis
SDL_GameControllerGetBindForButton
SDL_GameControllerGetButton
SDL_GameControllerGetButtonFromString
SDL_GameControllerGetJoystick
SDL_GameControllerGetPlayerIndex
SDL_GameControllerGetProduct
SDL_GameControllerGetProductVersion
SDL_GameControllerGetStringForAxis
SDL_GameControllerGetStringForButton
SDL_GameControllerGetType
SDL_GameControllerGetVendor
SDL_GameControllerMapping
SDL_GameControllerMappingForDeviceIndex
SDL_GameControllerMappingForGUID
SDL_GameControllerMappingForIndex
SDL_GameControllerName
SDL_GameControllerNameForIndex
SDL_GameControllerNumMappings
SDL_GameControllerOpen
SDL_GameControllerRumble
SDL_GameControllerSetPlayerIndex
SDL_GameControllerTypeForIndex
SDL_GameControllerUpdate
SDL_GetAssertionHandler
SDL_GetAssertionReport
SDL_GetAudioDeviceName
SDL_GetAudioDeviceStatus
SDL_GetAudioDriver
SDL_GetAudioStatus
SDL_GetBasePath
SDL_GetCPUCacheLineSize
SDL_GetCPUCount
SDL_GetClipRect
SDL_GetClipboardText
SDL_GetClosestDisplayMode
SDL_GetColorKey
SDL_GetCurrentAudioDriver
SDL_GetCurrentDisplayMode
SDL_GetCurrentVideoDriver
SDL_GetCursor
SDL_GetDefaultAssertionHandler
SDL_GetDefaultCursor
SDL_GetDesktopDisplayMode
SDL_GetDisplayBounds
SDL_GetDisplayDPI
SDL_GetDisplayMode
SDL_GetDisplayName
SDL_GetDisplayOrientation
SDL_GetDisplayUsableBounds
SDL_GetError
SDL_GetEventFilter
SDL_GetGlobalMouseState
SDL_GetGrabbedWindow
SDL_GetHint
SDL_GetHintBoolean
SDL_GetKeyFromName
SDL_GetKeyFromScancode
SDL_GetKeyName
SDL_GetKeyboardFocus
SDL_GetKeyboardState
SDL_GetMemoryFunctions
SDL_GetModState
SDL_GetMouseFocus
SDL_GetMouseState
SDL_GetNumAllocations
SDL_GetNumAudioDevices
SDL_GetNumAudioDrivers
SDL_GetNumDisplayModes
SDL_GetNumRenderDrivers
SDL_GetNumTouchDevices
SDL_GetNumTouchFingers
SDL_GetNumVideoDisplays
SDL_GetNumVideoDrivers
SDL_GetPerformanceCounter
SDL_GetPerformanceFrequency
SDL_GetPixelFormatName
SDL_GetPlatform
SDL_GetPowerInfo
SDL_GetPrefPath
SDL_GetQueuedAudioSize
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseMode
SDL_GetRelativeMouseState
SDL_GetRenderDrawBlendMode
SDL_GetRenderDrawColor
SDL_GetRenderDriverInfo
SDL_GetRenderTarget
SDL_GetRenderer
SDL_GetRendererInfo
SDL_GetRendererOutputSize
SDL_GetRevision
SDL_GetRevisionNumber
SDL_GetScancodeFromKey
SDL_GetScancodeFromName
SDL_GetScancodeName
SDL_GetShapedWindowMode
SDL_GetSurfaceAlphaMod
SDL_GetSurfaceBlendMode
SDL_GetSurfaceColorMod
SDL_GetSystemRAM
SDL_GetTextureAlphaMod
SDL_GetTextureBlendMode
SDL_GetTextureColorMod
SDL_GetTextureScaleMode
SDL_GetThreadID
SDL_GetThreadName
SDL_GetTicks
SDL_GetTouchDevice
SDL_GetTouchDeviceType
SDL_GetTouchFinger
SDL_GetVersion
SDL_GetVideoDriver
SDL_GetWindowBordersSize
SDL_GetWindowBrightness
SDL_GetWindowData
SDL_GetWindowDisplayIndex
SDL_GetWindowDisplayMode
SDL_GetWindowFlags
SDL_GetWindowFromID
SDL_GetWindowGammaRamp
SDL_GetWindowGrab
SDL_GetWindowID
SDL_GetWindowMaximumSize
SDL_GetWindowMinimumSize
SDL_GetWindowOpacity
SDL_GetWindowPixelFormat
SDL_GetWindowPosition
SDL_GetWindowSize
SDL_GetWindowSurface
SDL_GetWindowTitle
SDL_GetWindowWMInfo
SDL_GetYUVConversionMode
SDL_GetYUVConversionModeForResolution
SDL_HapticClose
SDL_HapticDestroyEffect
SDL_HapticEffectSupported
SDL_HapticGetEffectStatus
SDL_HapticIndex
SDL_HapticName
SDL_HapticNewEffect
SDL_HapticNumAxes
SDL_HapticNumEffects
SDL_HapticNumEffectsPlaying
SDL_HapticOpen
SDL_HapticOpenFromJoystick
SDL_HapticOpenFromMouse
SDL_HapticOpened
SDL_HapticPause
SDL_HapticQuery
SDL_HapticRumbleInit
SDL_HapticRumblePlay
SDL_HapticRumbleStop
SDL_HapticRumbleSupported
SDL_HapticRunEffect
SDL_HapticSetAutocenter
SDL_HapticSetGain
SDL_HapticStopAll
SDL_HapticStopEffect
SDL_HapticUnpause
SDL_HapticUpdateEffect
SDL_Has3DNow
SDL_HasARMSIMD
SDL_HasAVX
SDL_HasAVX2
SDL_HasAVX512F
SDL_HasAltiVec
SDL_HasClipboardText
SDL_HasColorKey
SDL_HasEvent
SDL_HasEvents
SDL_HasIntersection
SDL_HasMMX
SDL_HasNEON
SDL_HasRDTSC
SDL_HasSSE
SDL_HasSSE2
SDL_HasSSE3
SDL_HasSSE41
SDL_HasSSE42
SDL_HasScreenKeyboardSupport
SDL_HideWindow
SDL_Init
SDL_InitSubSystem
SDL_IntersectRect
SDL_IntersectRectAndLine
SDL_IsGameController
SDL_IsScreenKeyboardShown
SDL_IsScreenSaverEnabled
SDL_IsShapedWindow
SDL_IsTablet
SDL_IsTextInputActive
SDL_JoystickClose
SDL_JoystickCurrentPowerLevel
SDL_JoystickEventState
SDL_JoystickFromInstanceID
SDL_JoystickFromPlayerIndex
SDL_JoystickGetAttached
SDL_JoystickGetAxis
SDL_JoystickGetAxisInitialState
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetDeviceGUID
SDL_JoystickGetDeviceInstanceID
SDL_JoystickGetDevicePlayerIndex
SDL_JoystickGetDeviceProduct
SDL_JoystickGetDeviceProductVersion
SDL_JoystickGetDeviceType
SDL_JoystickGetDeviceVendor
SDL_JoystickGetGUID
SDL_JoystickGetGUIDFromString
SDL_JoystickGetGUIDString
SDL_JoystickGetHat
SDL_JoystickGetPlayerIndex
SDL_JoystickGetProduct
SDL_JoystickGetProductVersion
SDL_JoystickGetType
SDL_JoystickGetVendor
SDL_JoystickInstanceID
SDL_JoystickIsHaptic
SDL_JoystickName
SDL_JoystickNameForIndex
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickRumble
SDL_JoystickSetPlayerIndex
SDL_JoystickUpdate
SDL_LoadBMP_RW
SDL_LoadDollarTemplates
SDL_LoadFile
SDL_LoadFile_RW
SDL_LoadFunction
SDL_LoadObject
SDL_LoadWAV_RW
SDL_LockAudio
SDL_LockAudioDevice
SDL_LockJoysticks
SDL_LockMutex
SDL_LockSurface
SDL_LockTexture
SDL_LockTextureToSurface
SDL_Log
SDL_LogCritical
SDL_LogDebug
SDL_LogError
SDL_LogGetOutputFunction
SDL_LogGetPriority
SDL_LogInfo
SDL_LogMessage
SDL_LogMessageV
SDL_LogResetPriorities
SDL_LogSetAllPriority
SDL_LogSetOutputFunction
SDL_LogSetPriority
SDL_LogVerbose
SDL_LogWarn
SDL_LowerBlit
SDL_LowerBlitScaled
SDL_MapRGB
SDL_MapRGBA
SDL_MasksToPixelFormatEnum
SDL_MaximizeWindow
SDL_MemoryBarrierAcquireFunction
SDL_MemoryBarrierReleaseFunction
SDL_Metal_CreateView
SDL_Metal_DestroyView
SDL_MinimizeWindow
SDL_MixAudio
SDL_MixAudioFormat
SDL_MouseIsHaptic
SDL_NewAudioStream
SDL_NumHaptics
SDL_NumJoysticks
SDL_NumSensors
SDL_OnApplicationDidBecomeActive
SDL_OnApplicationDidEnterBackground
SDL_OnApplicationDidReceiveMemoryWarning
SDL_OnApplicationWillEnterForeground
SDL_OnApplicationWillResignActive
SDL_OnApplicationWillTerminate
SDL_OpenAudio
SDL_OpenAudioDevice
SDL_PauseAudio
SDL_PauseAudioDevice
SDL_PeepEvents
SDL_PixelFormatEnumToMasks
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_QueryTexture
SDL_QueueAudio
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromConstMem
SDL_RWFromFP
SDL_RWFromFile
SDL_RWFromMem
SDL_RWclose
SDL_RWread
SDL_RWseek
SDL_RWsize
SDL_RWtell
SDL_RWwrite
SDL_RaiseWindow
SDL_ReadBE16
SDL_ReadBE32
SDL_ReadBE64
SDL_ReadLE16
SDL_ReadLE32
SDL_ReadLE64
SDL_ReadU8
SDL_RecordGesture
SDL_RegisterApp
SDL_RegisterEvents
SDL_RemoveTimer
SDL_RenderClear
SDL_RenderCopy
SDL_RenderCopyEx
SDL_RenderCopyExF
SDL_RenderCopyF
SDL_RenderDrawLine
SDL_RenderDrawLineF
SDL_RenderDrawLines
SDL_RenderDrawLinesF
SDL_RenderDrawPoint
SDL_RenderDrawPointF
SDL_RenderDrawPoints
SDL_RenderDrawPointsF
SDL_RenderDrawRect
SDL_RenderDrawRectF
SDL_RenderDrawRects
SDL_RenderDrawRectsF
SDL_RenderFillRect
SDL_RenderFillRectF
SDL_RenderFillRects
SDL_RenderFillRectsF
SDL_RenderFlush
SDL_RenderGetClipRect
SDL_RenderGetD3D9Device
SDL_RenderGetIntegerScale
SDL_RenderGetLogicalSize
SDL_RenderGetMetalCommandEncoder
SDL_RenderGetMetalLayer
SDL_RenderGetScale
SDL_RenderGetViewport
SDL_RenderIsClipEnabled
SDL_RenderPresent
SDL_RenderReadPixels
SDL_RenderSetClipRect
SDL_RenderSetIntegerScale
SDL_RenderSetLogicalSize
SDL_RenderSetScale
SDL_RenderSetViewport
SDL_RenderTargetSupported
SDL_ReportAssertion
SDL_ResetAssertionReport
SDL_RestoreWindow
SDL_SIMDAlloc
SDL_SIMDFree
SDL_SIMDGetAlignment
SDL_SaveAllDollarTemplates
SDL_SaveBMP_RW
SDL_SaveDollarTemplate
SDL_SemPost
SDL_SemTryWait
SDL_SemValue
SDL_SemWait
SDL_SemWaitTimeout
SDL_SensorClose
SDL_SensorFromInstanceID
SDL_SensorGetData
SDL_SensorGetDeviceInstanceID
SDL_SensorGetDeviceName
SDL_SensorGetDeviceNonPortableType
SDL_SensorGetDeviceType
SDL_SensorGetInstanceID
SDL_SensorGetName

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/SharedMonogameTypes.pdb
CARRION v1.0.5.617-PiviGames.blog/SharedTypes.pdb
CARRION v1.0.5.617-PiviGames.blog/fmod64.dll
.dll windows:6 windows x64 arch:x64

0f806537913df98304a9550a58864e5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

freeaddrinfo
getaddrinfo
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
send
select
recv
listen
htons
htonl
getsockopt
ioctlsocket
connect
closesocket
bind
accept

winmm

waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetDevCapsW
timeGetTime
waveOutGetNumDevs

msacm32

acmStreamOpen
acmStreamSize
acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmFormatSuggest

kernel32

GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
SetEnvironmentVariableA
SetFilePointerEx
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
HeapSize
GetStringTypeW
GetProcessHeap
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
AreFileApisANSI
ExitProcess
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObject
CloseHandle
CreateEventA
GetProcAddress
LoadLibraryA
FreeLibrary
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
Sleep
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentDirectoryW
SetStdHandle
ReadConsoleW
GetCurrentProcess
RtlCaptureContext
SetEndOfFile
GetTimeZoneInformation
LCMapStringW
CompareStringW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
RtlUnwindEx
GetCommandLineA
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
RaiseException

user32

GetDesktopWindow

advapi32

RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

ole32

PropVariantClear
CoTaskMemFree
CLSIDFromString
CoUninitialize
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoInitializeEx

Exports

Exports

?addCallback@AsyncThread@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@H@Z@Z
?addDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVDSP@2@@Z
?addFadePoint@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_KM@Z
?addGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@_NPEAPEAVDSPConnection@2@@Z
?addInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAPEAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?addPolygon@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@MM_NHPEBUFMOD_VECTOR@@PEAH@Z
?addSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEBDPEAPEAUFMOD_SYNCPOINT@@@Z
?attachChannelGroupToPort@System@FMOD@@QEAA?AW4FMOD_RESULT@@I_KPEAVChannelGroup@2@_N@Z
?attachFileSystem@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEBDPEAIPEAPEAXPEAX@ZP6A?AW43@33@ZP6A?AW43@33I13@ZP6A?AW43@3I3@Z@Z
?close@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVChannelGroup@2@@Z
?createClientProfile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_DSP_DESCRIPTION@@PEAPEAVDSP@2@@Z
?createDSPByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAPEAVDSP@2@@Z
?createDSPByType@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PEAPEAVDSP@2@@Z
?createDiskFile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVFile@2@PEA_N@Z
?createGeometry@System@FMOD@@QEAA?AW4FMOD_RESULT@@HHPEAPEAVGeometry@2@@Z
?createMemoryFile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVFile@2@@Z
?createReverb3D@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVReverb3D@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSoundGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVSoundGroup@2@@Z
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?deleteSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_SYNCPOINT@@@Z
?detachChannelGroupFromPort@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVChannelGroup@2@@Z
?disconnectAll@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?disconnectFrom@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAVDSPConnection@2@@Z
?get3DAttributes@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@00@Z
?get3DAttributes@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@PEAM1@Z
?get3DConeOrientation@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@@Z
?get3DConeSettings@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM00@Z
?get3DConeSettings@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM00@Z
?get3DCustomRolloff@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAUFMOD_VECTOR@@PEAH@Z
?get3DCustomRolloff@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAUFMOD_VECTOR@@PEAH@Z
?get3DDistanceFilter@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_NPEAM1@Z
?get3DDopplerLevel@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?get3DLevel@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?get3DListenerAttributes@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_VECTOR@@000@Z
?get3DMinMaxDistance@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0@Z
?get3DMinMaxDistance@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0@Z
?get3DNumListeners@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?get3DOcclusion@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0@Z
?get3DSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM00@Z
?get3DSpread@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getActive@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getActive@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getActive@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?getAsyncThread@AsyncThread@FMOD@@SA?AW4FMOD_RESULT@@PEAVSystemI@2@HPEAPEAV12@@Z
?getAudibility@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getCPUUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0000@Z
?getChannel@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?getChannel@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?getChannelFormat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAIPEAHPEAW4FMOD_SPEAKERMODE@@@Z
?getChannelGroup@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getChannelsPlaying@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z
?getCurrentSound@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSound@2@@Z
?getDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVDSP@2@@Z
?getDSPBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAIPEAH@Z
?getDSPClock@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0@Z
?getDSPIndex@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAH@Z
?getDSPInfoByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAPEBUFMOD_DSP_DESCRIPTION@@@Z
?getDataParameterIndex@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAH@Z
?getDefaultMixMatrix@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@0PEAMH@Z
?getDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH@Z
?getDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0PEA_N@Z
?getDriver@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getDriverInfo@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEADHPEAUFMOD_GUID@@PEAHPEAW4FMOD_SPEAKERMODE@@2@Z
?getFadePoints@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAIPEA_KPEAM@Z
?getFileUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_J00@Z
?getFormat@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SOUND_TYPE@@PEAW4FMOD_SOUND_FORMAT@@PEAH2@Z
?getFrequency@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getGeometryOcclusion@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@0PEAM1@Z
?getGeometrySettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getGlobals@FMOD@@YAXPEAPEAVGlobal@1@@Z
?getGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?getIdle@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getIndex@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEADPEAIPEAH22@Z
?getInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getInput@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVDSP@2@@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getLoopCount@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getLoopCount@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getLoopPoints@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII0I@Z
?getLoopPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII0I@Z
?getLowPassGain@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getMasterSoundGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSoundGroup@2@@Z
?getMaxAudible@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getMaxAudibleBehavior@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SOUNDGROUP_BEHAVIOR@@@Z
?getMaxPolygons@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z
?getMeteringEnabled@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N0@Z
?getMeteringInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_DSP_METERING_INFO@@0@Z
?getMix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getMixMatrix@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH1H@Z
?getMixMatrix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH1H@Z
?getMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getMode@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getMusicChannelVolume@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM@Z
?getMusicNumChannels@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getMusicSpeed@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getMute@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getMuteFadeSpeed@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getName@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEADH@Z
?getName@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEADH@Z
?getName@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEADH@Z
?getNestedPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@IHPEAI@Z
?getNetworkProxy@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEADH@Z
?getNetworkTimeout@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumChannels@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumDSPs@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumGroups@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumInputs@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumNestedPlugins@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAH@Z
?getNumOutputs@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumParameters@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumPlaying@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumPlugins@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@PEAH@Z
?getNumPolygons@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumSounds@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumSubSounds@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumSyncPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getNumTags@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z
?getOpenState@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OPENSTATE@@PEAIPEA_N2@Z
?getOutput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getOutput@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVDSP@2@@Z
?getOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OUTPUTTYPE@@@Z
?getOutputByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getOutputChannelFormat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@PEAIPEAHPEAW44@@Z
?getOutputHandle@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getParameterBool@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEA_NPEADH@Z
?getParameterData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAXPEAIPEADH@Z
?getParameterFloat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAMPEADH@Z
?getParameterInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAUFMOD_DSP_PARAMETER_DESC@@@Z
?getParameterInt@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAHPEADH@Z
?getParentGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAV12@@Z
?getPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getPitch@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getPluginHandle@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@HPEAI@Z
?getPluginInfo@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAW4FMOD_PLUGINTYPE@@PEADHPEAI@Z
?getPolygonAttributes@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM0PEA_N@Z
?getPolygonNumVertices@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAH@Z
?getPolygonVertex@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@HHPEAUFMOD_VECTOR@@@Z
?getPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getPosition@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@@Z
?getPriority@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getProperties@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_REVERB_PROPERTIES@@@Z
?getRecordDriverInfo@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEADHPEAUFMOD_GUID@@PEAHPEAW4FMOD_SPEAKERMODE@@2PEAI@Z
?getRecordNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z
?getRecordPosition@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAI@Z
?getReverbProperties@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM@Z
?getReverbProperties@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_REVERB_PROPERTIES@@@Z
?getRotation@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@0@Z
?getScale@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@@Z
?getSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SPEAKERMODE@@0@Z
?getSound@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVSound@2@@Z
?getSoundGroup@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSoundGroup@2@@Z
?getSoundRAM@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH00@Z
?getSpeakerModeChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@PEAH@Z
?getSpeakerPosition@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PEAM1PEA_N@Z
?getStreamBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI0@Z
?getSubSound@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?getSubSoundParent@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAV12@@Z
?getSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAUFMOD_SYNCPOINT@@@Z
?getSyncPointInfo@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_SYNCPOINT@@PEADHPEAII@Z
?getSystemObject@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?getSystemObject@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?getSystemObject@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?getSystemObject@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?getTag@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDHPEAUFMOD_TAG@@@Z
?getType@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_DSP_TYPE@@@Z
?getType@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_DSPCONNECTION_TYPE@@@Z
?getUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@GeometryI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserDataInternal@SoundI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getVersion@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getVolume@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getVolumeRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getWetDryMix@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM00@Z
?init@System@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAX@Z
?isPlaying@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?isRecording@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEA_N@Z
?isVirtual@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?loadGeometry@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBXHPEAPEAVGeometry@2@@Z
?loadPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAII@Z
?lock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAX0PEAI1@Z
?lockDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?mixerResume@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?mixerSuspend@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?playDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSound@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?readData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAXIPEAI@Z
?recordStart@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVSound@2@_N@Z
?recordStop@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?registerCodec@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_CODEC_DESCRIPTION@@PEAII@Z
?registerDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_DSP_DESCRIPTION@@PEAI@Z
?registerOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_OUTPUT_DESCRIPTION@@PEAI@Z
?release@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?removeCallback@AsyncThread@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@H@Z@Z
?removeDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@@Z
?removeFadePoints@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_K0@Z
?reset@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?save@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAXPEAH@Z
?seekData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?set3DAttributes@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@00@Z
?set3DAttributes@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@MM@Z
?set3DConeOrientation@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@@Z
?set3DConeSettings@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@MMM@Z
?set3DConeSettings@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@MMM@Z
?set3DCustomRolloff@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@H@Z
?set3DCustomRolloff@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_VECTOR@@H@Z
?set3DDistanceFilter@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_NMM@Z
?set3DDopplerLevel@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DLevel@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DListenerAttributes@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z
?set3DMinMaxDistance@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@MM@Z
?set3DMinMaxDistance@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@MM@Z
?set3DNumListeners@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?set3DOcclusion@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@MM@Z
?set3DRolloffCallback@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6AMPEAUFMOD_CHANNELCONTROL@@M@Z@Z
?set3DSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@MMM@Z
?set3DSpread@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setActive@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setActive@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setActive@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?setBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setCallback@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_CHANNELCONTROL@@W4FMOD_CHANNELCONTROL_TYPE@@W4FMOD_CHANNELCONTROL_CALLBACK_TYPE@@PEAX3@Z@Z
?setCallback@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_SYSTEM@@IPEAX11@ZI@Z
?setChannelFormat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@@Z
?setChannelGroup@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVChannelGroup@2@@Z
?setDSPBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@IH@Z
?setDSPIndex@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@H@Z
?setDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@MH@Z
?setDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_K0_N@Z
?setDriver@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setFadePointRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_KM@Z
?setFileSystem@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEBDPEAIPEAPEAXPEAX@ZP6A?AW43@33@ZP6A?AW43@33I13@ZP6A?AW43@3I3@ZP6A?AW43@PEAUFMOD_ASYNCREADINFO@@3@Z9H@Z
?setFrequency@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setGeometrySettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setLoopCount@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setLoopCount@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setLoopPoints@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@IIII@Z
?setLoopPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@IIII@Z
?setLowPassGain@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setMaxAudible@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setMaxAudibleBehavior@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SOUNDGROUP_BEHAVIOR@@@Z
?setMeteringEnabled@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?setMix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setMixLevelsInput@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMH@Z
?setMixLevelsOutput@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@MMMMMMMM@Z
?setMixMatrix@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMHHH@Z
?setMixMatrix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMHHH@Z
?setMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?setMode@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?setMusicChannelVolume@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setMusicSpeed@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setMute@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setMuteFadeSpeed@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setNetworkProxy@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?setNetworkTimeout@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?setOutputByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?setPan@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setParameterBool@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@H_N@Z
?setParameterData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAXI@Z
?setParameterFloat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setParameterInt@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HH@Z
?setPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPitch@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setPluginPath@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?setPolygonAttributes@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@HMM_N@Z
?setPolygonVertex@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@HHPEBUFMOD_VECTOR@@@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?setPosition@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@@Z
?setPriority@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setProperties@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_REVERB_PROPERTIES@@@Z
?setReverbProperties@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setReverbProperties@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_REVERB_PROPERTIES@@@Z
?setRotation@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@0@Z
?setScale@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@@Z
?setSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?setSoundGroup@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSoundGroup@2@@Z
?setSpeakerPosition@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@MM_N@Z
?setStreamBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?setUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@Geometry@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@GeometryI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@Reverb3D@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserDataInternal@SoundI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setVolume@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setVolumeRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setWetDryMix@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@MMM@Z
?showConfigDialog@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX_N@Z
?stop@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?stop@SoundGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?unlock@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX0II@Z
?unlockDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?update@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?validate@ChannelI@FMOD@@SA?AW4FMOD_RESULT@@PEAVChannel@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?validate@DSPI@FMOD@@SA?AW4FMOD_RESULT@@PEAVDSP@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?validate@SystemI@FMOD@@SA?AW4FMOD_RESULT@@PEAVSystem@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?wakeupThread@AsyncThread@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
FMOD5_ChannelGroup_AddDSP
FMOD5_ChannelGroup_AddFadePoint
FMOD5_ChannelGroup_AddGroup
FMOD5_ChannelGroup_Get3DAttributes
FMOD5_ChannelGroup_Get3DConeOrientation
FMOD5_ChannelGroup_Get3DConeSettings
FMOD5_ChannelGroup_Get3DCustomRolloff
FMOD5_ChannelGroup_Get3DDistanceFilter
FMOD5_ChannelGroup_Get3DDopplerLevel
FMOD5_ChannelGroup_Get3DLevel
FMOD5_ChannelGroup_Get3DMinMaxDistance
FMOD5_ChannelGroup_Get3DOcclusion
FMOD5_ChannelGroup_Get3DSpread
FMOD5_ChannelGroup_GetAudibility
FMOD5_ChannelGroup_GetChannel
FMOD5_ChannelGroup_GetDSP
FMOD5_ChannelGroup_GetDSPClock
FMOD5_ChannelGroup_GetDSPIndex
FMOD5_ChannelGroup_GetDelay
FMOD5_ChannelGroup_GetFadePoints
FMOD5_ChannelGroup_GetGroup
FMOD5_ChannelGroup_GetLowPassGain
FMOD5_ChannelGroup_GetMixMatrix
FMOD5_ChannelGroup_GetMode
FMOD5_ChannelGroup_GetMute
FMOD5_ChannelGroup_GetName
FMOD5_ChannelGroup_GetNumChannels
FMOD5_ChannelGroup_GetNumDSPs
FMOD5_ChannelGroup_GetNumGroups
FMOD5_ChannelGroup_GetParentGroup
FMOD5_ChannelGroup_GetPaused
FMOD5_ChannelGroup_GetPitch
FMOD5_ChannelGroup_GetReverbProperties
FMOD5_ChannelGroup_GetSystemObject
FMOD5_ChannelGroup_GetUserData
FMOD5_ChannelGroup_GetVolume
FMOD5_ChannelGroup_GetVolumeRamp
FMOD5_ChannelGroup_IsPlaying
FMOD5_ChannelGroup_Release
FMOD5_ChannelGroup_RemoveDSP
FMOD5_ChannelGroup_RemoveFadePoints
FMOD5_ChannelGroup_Set3DAttributes
FMOD5_ChannelGroup_Set3DConeOrientation
FMOD5_ChannelGroup_Set3DConeSettings
FMOD5_ChannelGroup_Set3DCustomRolloff
FMOD5_ChannelGroup_Set3DDistanceFilter
FMOD5_ChannelGroup_Set3DDopplerLevel
FMOD5_ChannelGroup_Set3DLevel
FMOD5_ChannelGroup_Set3DMinMaxDistance
FMOD5_ChannelGroup_Set3DOcclusion
FMOD5_ChannelGroup_Set3DSpread
FMOD5_ChannelGroup_SetCallback
FMOD5_ChannelGroup_SetDSPIndex
FMOD5_ChannelGroup_SetDelay
FMOD5_ChannelGroup_SetFadePointRamp
FMOD5_ChannelGroup_SetLowPassGain
FMOD5_ChannelGroup_SetMixLevelsInput
FMOD5_ChannelGroup_SetMixLevelsOutput
FMOD5_ChannelGroup_SetMixMatrix
FMOD5_ChannelGroup_SetMode
FMOD5_ChannelGroup_SetMute
FMOD5_ChannelGroup_SetPan
FMOD5_ChannelGroup_SetPaused
FMOD5_ChannelGroup_SetPitch
FMOD5_ChannelGroup_SetReverbProperties
FMOD5_ChannelGroup_SetUserData
FMOD5_ChannelGroup_SetVolume
FMOD5_ChannelGroup_SetVolumeRamp
FMOD5_ChannelGroup_Stop
FMOD5_Channel_AddDSP
FMOD5_Channel_AddFadePoint
FMOD5_Channel_Get3DAttributes
FMOD5_Channel_Get3DConeOrientation
FMOD5_Channel_Get3DConeSettings
FMOD5_Channel_Get3DCustomRolloff
FMOD5_Channel_Get3DDistanceFilter
FMOD5_Channel_Get3DDopplerLevel
FMOD5_Channel_Get3DLevel
FMOD5_Channel_Get3DMinMaxDistance
FMOD5_Channel_Get3DOcclusion
FMOD5_Channel_Get3DSpread
FMOD5_Channel_GetAudibility
FMOD5_Channel_GetChannelGroup
FMOD5_Channel_GetCurrentSound
FMOD5_Channel_GetDSP
FMOD5_Channel_GetDSPClock
FMOD5_Channel_GetDSPIndex
FMOD5_Channel_GetDelay
FMOD5_Channel_GetFadePoints
FMOD5_Channel_GetFrequency
FMOD5_Channel_GetIndex
FMOD5_Channel_GetLoopCount
FMOD5_Channel_GetLoopPoints
FMOD5_Channel_GetLowPassGain
FMOD5_Channel_GetMixMatrix
FMOD5_Channel_GetMode
FMOD5_Channel_GetMute
FMOD5_Channel_GetNumDSPs
FMOD5_Channel_GetPaused
FMOD5_Channel_GetPitch
FMOD5_Channel_GetPosition
FMOD5_Channel_GetPriority
FMOD5_Channel_GetReverbProperties
FMOD5_Channel_GetSystemObject
FMOD5_Channel_GetUserData
FMOD5_Channel_GetVolume
FMOD5_Channel_GetVolumeRamp
FMOD5_Channel_IsPlaying
FMOD5_Channel_IsVirtual
FMOD5_Channel_RemoveDSP
FMOD5_Channel_RemoveFadePoints
FMOD5_Channel_Set3DAttributes
FMOD5_Channel_Set3DConeOrientation
FMOD5_Channel_Set3DConeSettings
FMOD5_Channel_Set3DCustomRolloff
FMOD5_Channel_Set3DDistanceFilter
FMOD5_Channel_Set3DDopplerLevel
FMOD5_Channel_Set3DLevel
FMOD5_Channel_Set3DMinMaxDistance
FMOD5_Channel_Set3DOcclusion
FMOD5_Channel_Set3DSpread
FMOD5_Channel_SetCallback
FMOD5_Channel_SetChannelGroup
FMOD5_Channel_SetDSPIndex
FMOD5_Channel_SetDelay
FMOD5_Channel_SetFadePointRamp
FMOD5_Channel_SetFrequency
FMOD5_Channel_SetLoopCount
FMOD5_Channel_SetLoopPoints
FMOD5_Channel_SetLowPassGain
FMOD5_Channel_SetMixLevelsInput
FMOD5_Channel_SetMixLevelsOutput
FMOD5_Channel_SetMixMatrix
FMOD5_Channel_SetMode
FMOD5_Channel_SetMute
FMOD5_Channel_SetPan
FMOD5_Channel_SetPaused
FMOD5_Channel_SetPitch
FMOD5_Channel_SetPosition
FMOD5_Channel_SetPriority
FMOD5_Channel_SetReverbProperties
FMOD5_Channel_SetUserData
FMOD5_Channel_SetVolume
FMOD5_Channel_SetVolumeRamp
FMOD5_Channel_Stop
FMOD5_DSPConnection_GetInput
FMOD5_DSPConnection_GetMix
FMOD5_DSPConnection_GetMixMatrix
FMOD5_DSPConnection_GetOutput
FMOD5_DSPConnection_GetType
FMOD5_DSPConnection_GetUserData
FMOD5_DSPConnection_SetMix
FMOD5_DSPConnection_SetMixMatrix
FMOD5_DSPConnection_SetUserData
FMOD5_DSP_AddInput
FMOD5_DSP_DisconnectAll
FMOD5_DSP_DisconnectFrom
FMOD5_DSP_GetActive
FMOD5_DSP_GetBypass
FMOD5_DSP_GetChannelFormat
FMOD5_DSP_GetDataParameterIndex
FMOD5_DSP_GetIdle
FMOD5_DSP_GetInfo
FMOD5_DSP_GetInput
FMOD5_DSP_GetMeteringEnabled
FMOD5_DSP_GetMeteringInfo
FMOD5_DSP_GetNumInputs
FMOD5_DSP_GetNumOutputs
FMOD5_DSP_GetNumParameters
FMOD5_DSP_GetOutput
FMOD5_DSP_GetOutputChannelFormat
FMOD5_DSP_GetParameterBool

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/fmodstudio64.dll
.dll windows:6 windows x64 arch:x64

ebaa4a2b64f04c35bd9e03796de1418e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

kernel32

SetEndOfFile
DecodePointer
HeapFree
WriteConsoleW
SetStdHandle
GetStringTypeW
RaiseException
LCMapStringW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
GetFileType
ReadConsoleW
SetFilePointerEx
GetProcAddress
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
WriteFile
ReadFile
FlushFileBuffers
CloseHandle
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetLastError
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleFileNameW
GetStdHandle
GetCommandLineA
RtlUnwindEx
LoadLibraryExW
ExitThread
CreateThread
HeapReAlloc
HeapAlloc
EncodePointer

ole32

CoInitializeEx
CoUninitialize

fmod64

?getParameterData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAXPEAIPEADH@Z
?getType@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_DSP_TYPE@@@Z
?validate@DSPI@FMOD@@SA?AW4FMOD_RESULT@@PEAVDSP@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?setVolumeRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setReverbProperties@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?getMode@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?setDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_K0_N@Z
?getDelay@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0PEA_N@Z
?addFadePoint@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_KM@Z
?setFadePointRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_KM@Z
?removeFadePoints@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_K0@Z
?setPriority@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getNumGroups@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?getParentGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAV12@@Z
?getNumChannels@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getChannel@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?getAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?update@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSound@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?playDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@MH@Z
?getDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH@Z
?getSubSound@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getOpenState@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OPENSTATE@@PEAIPEA_N2@Z
?setMode@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?getMode@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getLoopPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII0I@Z
?getVersion@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getGlobals@FMOD@@YAXPEAPEAVGlobal@1@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createMemoryFile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVFile@2@@Z
?createDiskFile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVFile@2@PEA_N@Z
?getAudibility@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?validate@ChannelI@FMOD@@SA?AW4FMOD_RESULT@@PEAVChannel@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?set3DNumListeners@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?set3DListenerAttributes@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z
?isVirtual@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?createDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_DSP_DESCRIPTION@@PEAPEAVDSP@2@@Z
?getUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getDefaultMixMatrix@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@0PEAMH@Z
?getFormat@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SOUND_TYPE@@PEAW4FMOD_SOUND_FORMAT@@PEAH2@Z
?stop@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?isPlaying@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setMixMatrix@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMHHH@Z
?set3DAttributes@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@00@Z
?getParameterInt@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAHPEADH@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?getPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?setChannelGroup@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVChannelGroup@2@@Z
?setLoopCount@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getLoopCount@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getCurrentSound@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSound@2@@Z
?setMixMatrix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMHHH@Z
?getVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?setVolume@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getSystemObject@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?createChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVChannelGroup@2@@Z
?createClientProfile@SystemI@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?validate@SystemI@FMOD@@SA?AW4FMOD_RESULT@@PEAVSystem@2@PEAPEAV12@PEAVSystemLockScope@2@@Z
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getFileUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_J00@Z
?getCPUUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM0000@Z
?getSpeakerModeChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@PEAH@Z
?get3DListenerAttributes@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_VECTOR@@000@Z
?init@System@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAX@Z
?registerDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_DSP_DESCRIPTION@@PEAI@Z
?createDSPByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAPEAVDSP@2@@Z
?unloadPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?getDSPBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAIPEAH@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SPEAKERMODE@@0@Z
?getOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OUTPUTTYPE@@@Z
?setOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?release@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
FMOD_System_Create
FMOD_Memory_GetStats
?getMeteringInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_DSP_METERING_INFO@@0@Z
?setParameterData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAXI@Z
?setParameterBool@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@H_N@Z
?setParameterInt@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HH@Z
?setParameterFloat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?getPluginHandle@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@HPEAI@Z
?getNumPlugins@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@PEAH@Z
?getInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEADPEAIPEAH22@Z
?getParameterInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAUFMOD_DSP_PARAMETER_DESC@@@Z
?getNumParameters@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?release@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createDSPByType@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PEAPEAVDSP@2@@Z
?getDSPInfoByPlugin@System@FMOD@@QEAA?AW4FMOD_RESULT@@IPEAPEBUFMOD_DSP_DESCRIPTION@@@Z
?setBypass@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?disconnectFrom@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAVDSPConnection@2@@Z
?addInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAPEAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?setMeteringEnabled@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?getIdle@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?reset@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setChannelFormat@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@@Z
?setActive@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getSystemObject@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?addGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@_NPEAPEAVDSPConnection@2@@Z
?release@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getDSPIndex@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@PEAH@Z
?removeDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVDSP@2@@Z
?addDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAVDSP@2@@Z
?getDSP@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVDSP@2@@Z
?getDSPClock@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_K0@Z
?setMute@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getPitch@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?setPitch@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DDopplerLevel@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getVolumeRamp@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?get3DSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM00@Z

Exports

Exports

?create@System@Studio@FMOD@@SA?AW4FMOD_RESULT@@PEAPEAV123@I@Z
?createInstance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@@Z
?flushCommands@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?flushSampleLoading@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?get3DAttributes@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_3D_ATTRIBUTES@@@Z
?getAdvancedSettings@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_ADVANCEDSETTINGS@@@Z
?getBank@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVBank@23@@Z
?getBankByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBUFMOD_GUID@@PEAPEAVBank@23@@Z
?getBankCount@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getBankList@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVBank@23@HPEAH@Z
?getBufferUsage@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_BUFFER_USAGE@@@Z
?getBus@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVBus@23@@Z
?getBusByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBUFMOD_GUID@@PEAPEAVBus@23@@Z
?getBusCount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getBusList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVBus@23@HPEAH@Z
?getCPUUsage@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_CPU_USAGE@@@Z
?getChannelGroup@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@3@@Z
?getChannelGroup@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@3@@Z
?getCommandAtTime@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@MPEAH@Z
?getCommandCount@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getCommandInfo@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_STUDIO_COMMAND_INFO@@@Z
?getCommandString@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEADH@Z
?getCurrentCommand@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAHPEAM@Z
?getDescription@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@@Z
?getDescription@ParameterInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getEvent@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVEventDescription@23@@Z
?getEventByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBUFMOD_GUID@@PEAPEAVEventDescription@23@@Z
?getEventCount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getEventList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@HPEAH@Z
?getID@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_GUID@@@Z
?getID@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_GUID@@@Z
?getID@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_GUID@@@Z
?getID@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_GUID@@@Z
?getInstanceCount@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getInstanceList@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@HPEAH@Z
?getLength@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM@Z
?getLength@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getListenerAttributes@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_3D_ATTRIBUTES@@@Z
?getListenerMask@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAI@Z
?getListenerWeight@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM@Z
?getLoadingState@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getLowLevelSystem@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAV13@@Z
?getMaximumDistance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM@Z
?getMinimumDistance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM@Z
?getMute@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getNumListeners@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getParameter@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameter@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVParameterInstance@23@@Z
?getParameterByIndex@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameterByIndex@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAPEAVParameterInstance@23@@Z
?getParameterCount@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getParameterCount@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getParameterValue@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAM1@Z
?getParameterValueByIndex@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM0@Z
?getPath@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPaused@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getPaused@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getPaused@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getPitch@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?getPlaybackState@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?getPlaybackState@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?getProperty@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@W4FMOD_STUDIO_EVENT_PROPERTY@@PEAM@Z
?getReverbLevel@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAM@Z
?getSampleLoadingState@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getSampleLoadingState@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getSoundInfo@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_STUDIO_SOUND_INFO@@@Z
?getSoundSize@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM@Z
?getStringCount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getStringInfo@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_GUID@@PEADHPEAH@Z
?getSystem@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVSystem@23@@Z
?getTimelinePosition@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getUserData@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@CommandReplay@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserData@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?getUserProperty@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_STUDIO_USER_PROPERTY@@@Z
?getUserPropertyByIndex@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_STUDIO_USER_PROPERTY@@@Z
?getUserPropertyCount@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getVCA@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVVCA@23@@Z
?getVCAByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBUFMOD_GUID@@PEAPEAVVCA@23@@Z
?getVCACount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getVCAList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVVCA@23@HPEAH@Z
?getValue@ParameterInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM@Z
?getVolume@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?getVolume@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?getVolume@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?hasCue@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?initialize@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HIIPEAX@Z
?is3D@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?isOneshot@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?isSnapshot@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?isStream@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?isValid@Bank@Studio@FMOD@@QEBA_NXZ
?isValid@Bus@Studio@FMOD@@QEBA_NXZ
?isValid@CommandReplay@Studio@FMOD@@QEBA_NXZ
?isValid@EventDescription@Studio@FMOD@@QEBA_NXZ
?isValid@EventInstance@Studio@FMOD@@QEBA_NXZ
?isValid@ParameterInstance@Studio@FMOD@@QEBA_NXZ
?isValid@System@Studio@FMOD@@QEBA_NXZ
?isValid@VCA@Studio@FMOD@@QEBA_NXZ
?isVirtual@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?loadBankCustom@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_STUDIO_BANK_INFO@@IPEAPEAVBank@23@@Z
?loadBankFile@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVBank@23@@Z
?loadBankMemory@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDHW4FMOD_STUDIO_LOAD_MEMORY_MODE@@IPEAPEAVBank@23@@Z
?loadCommandReplay@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVCommandReplay@23@@Z
?loadSampleData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?loadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?lockChannelGroup@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?lookupID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_GUID@@@Z
?lookupPath@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBUFMOD_GUID@@PEADHPEAH@Z
?registerPlugin@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_DSP_DESCRIPTION@@@Z
?release@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?release@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?releaseAllInstances@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?resetBufferUsage@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?seekToCommand@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?seekToTime@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DAttributes@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_3D_ATTRIBUTES@@@Z
?setAdvancedSettings@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_ADVANCEDSETTINGS@@@Z
?setBankPath@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?setCallback@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@IPEAUFMOD_STUDIO_EVENTINSTANCE@@PEAX@ZI@Z
?setCallback@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@IPEAUFMOD_STUDIO_EVENTINSTANCE@@PEAX@ZI@Z
?setCallback@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@PEAUFMOD_STUDIO_SYSTEM@@IPEAX1@ZI@Z
?setCreateInstanceCallback@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@PEAUFMOD_STUDIO_COMMANDREPLAY@@HPEAUFMOD_STUDIO_EVENTDESCRIPTION@@PEAPEAUFMOD_STUDIO_EVENTINSTANCE@@PEAX@Z@Z
?setFrameCallback@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@PEAUFMOD_STUDIO_COMMANDREPLAY@@HMPEAX@Z@Z
?setListenerAttributes@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_3D_ATTRIBUTES@@@Z
?setListenerMask@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?setListenerWeight@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setLoadBankCallback@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@PEAUFMOD_STUDIO_COMMANDREPLAY@@HPEBUFMOD_GUID@@PEBDIPEAPEAUFMOD_STUDIO_BANK@@PEAX@Z@Z
?setMute@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setNumListeners@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setParameterValue@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDM@Z
?setParameterValueByIndex@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setParameterValuesByIndices@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAMH@Z
?setPaused@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPaused@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPaused@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPitch@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setProperty@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_EVENT_PROPERTY@@M@Z
?setReverbLevel@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?setTimelinePosition@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?setUserData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setUserData@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setValue@ParameterInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setVolume@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setVolume@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setVolume@VCA@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?start@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?start@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?startCommandCapture@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDI@Z
?stop@CommandReplay@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?stop@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?stopAllEvents@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?stopCommandCapture@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?triggerCue@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unload@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadAll@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadSampleData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unlockChannelGroup@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unregisterPlugin@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?update@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
FMOD_Studio_Bank_GetBusCount
FMOD_Studio_Bank_GetBusList
FMOD_Studio_Bank_GetEventCount
FMOD_Studio_Bank_GetEventList
FMOD_Studio_Bank_GetID
FMOD_Studio_Bank_GetLoadingState
FMOD_Studio_Bank_GetPath
FMOD_Studio_Bank_GetSampleLoadingState
FMOD_Studio_Bank_GetStringCount
FMOD_Studio_Bank_GetStringInfo
FMOD_Studio_Bank_GetUserData
FMOD_Studio_Bank_GetVCACount
FMOD_Studio_Bank_GetVCAList
FMOD_Studio_Bank_IsValid
FMOD_Studio_Bank_LoadSampleData
FMOD_Studio_Bank_SetUserData
FMOD_Studio_Bank_Unload
FMOD_Studio_Bank_UnloadSampleData
FMOD_Studio_Bus_GetChannelGroup
FMOD_Studio_Bus_GetID
FMOD_Studio_Bus_GetMute
FMOD_Studio_Bus_GetPath
FMOD_Studio_Bus_GetPaused
FMOD_Studio_Bus_GetVolume
FMOD_Studio_Bus_IsValid
FMOD_Studio_Bus_LockChannelGroup
FMOD_Studio_Bus_SetMute
FMOD_Studio_Bus_SetPaused
FMOD_Studio_Bus_SetVolume
FMOD_Studio_Bus_StopAllEvents
FMOD_Studio_Bus_UnlockChannelGroup
FMOD_Studio_CommandReplay_GetCommandAtTime
FMOD_Studio_CommandReplay_GetCommandCount
FMOD_Studio_CommandReplay_GetCommandInfo
FMOD_Studio_CommandReplay_GetCommandString
FMOD_Studio_CommandReplay_GetCurrentCommand
FMOD_Studio_CommandReplay_GetLength
FMOD_Studio_CommandReplay_GetPaused
FMOD_Studio_CommandReplay_GetPlaybackState
FMOD_Studio_CommandReplay_GetSystem
FMOD_Studio_CommandReplay_GetUserData
FMOD_Studio_CommandReplay_IsValid
FMOD_Studio_CommandReplay_Release
FMOD_Studio_CommandReplay_SeekToCommand
FMOD_Studio_CommandReplay_SeekToTime
FMOD_Studio_CommandReplay_SetBankPath
FMOD_Studio_CommandReplay_SetCreateInstanceCallback
FMOD_Studio_CommandReplay_SetFrameCallback
FMOD_Studio_CommandReplay_SetLoadBankCallback
FMOD_Studio_CommandReplay_SetPaused
FMOD_Studio_CommandReplay_SetUserData
FMOD_Studio_CommandReplay_Start
FMOD_Studio_CommandReplay_Stop
FMOD_Studio_EventDescription_CreateInstance
FMOD_Studio_EventDescription_GetID
FMOD_Studio_EventDescription_GetInstanceCount
FMOD_Studio_EventDescription_GetInstanceList
FMOD_Studio_EventDescription_GetLength
FMOD_Studio_EventDescription_GetMaximumDistance
FMOD_Studio_EventDescription_GetMinimumDistance
FMOD_Studio_EventDescription_GetParameter
FMOD_Studio_EventDescription_GetParameterByIndex
FMOD_Studio_EventDescription_GetParameterCount
FMOD_Studio_EventDescription_GetPath
FMOD_Studio_EventDescription_GetSampleLoadingState
FMOD_Studio_EventDescription_GetSoundSize
FMOD_Studio_EventDescription_GetUserData
FMOD_Studio_EventDescription_GetUserProperty
FMOD_Studio_EventDescription_GetUserPropertyByIndex
FMOD_Studio_EventDescription_GetUserPropertyCount
FMOD_Studio_EventDescription_HasCue
FMOD_Studio_EventDescription_Is3D
FMOD_Studio_EventDescription_IsOneshot
FMOD_Studio_EventDescription_IsSnapshot
FMOD_Studio_EventDescription_IsStream
FMOD_Studio_EventDescription_IsValid
FMOD_Studio_EventDescription_LoadSampleData
FMOD_Studio_EventDescription_ReleaseAllInstances
FMOD_Studio_EventDescription_SetCallback
FMOD_Studio_EventDescription_SetUserData
FMOD_Studio_EventDescription_UnloadSampleData
FMOD_Studio_EventInstance_Get3DAttributes
FMOD_Studio_EventInstance_GetChannelGroup
FMOD_Studio_EventInstance_GetDescription
FMOD_Studio_EventInstance_GetListenerMask
FMOD_Studio_EventInstance_GetParameter
FMOD_Studio_EventInstance_GetParameterByIndex
FMOD_Studio_EventInstance_GetParameterCount
FMOD_Studio_EventInstance_GetParameterValue
FMOD_Studio_EventInstance_GetParameterValueByIndex
FMOD_Studio_EventInstance_GetPaused
FMOD_Studio_EventInstance_GetPitch
FMOD_Studio_EventInstance_GetPlaybackState
FMOD_Studio_EventInstance_GetProperty
FMOD_Studio_EventInstance_GetReverbLevel
FMOD_Studio_EventInstance_GetTimelinePosition
FMOD_Studio_EventInstance_GetUserData
FMOD_Studio_EventInstance_GetVolume
FMOD_Studio_EventInstance_IsValid
FMOD_Studio_EventInstance_IsVirtual
FMOD_Studio_EventInstance_Release
FMOD_Studio_EventInstance_Set3DAttributes
FMOD_Studio_EventInstance_SetCallback
FMOD_Studio_EventInstance_SetListenerMask
FMOD_Studio_EventInstance_SetParameterValue
FMOD_Studio_EventInstance_SetParameterValueByIndex
FMOD_Studio_EventInstance_SetParameterValuesByIndices
FMOD_Studio_EventInstance_SetPaused
FMOD_Studio_EventInstance_SetPitch
FMOD_Studio_EventInstance_SetProperty
FMOD_Studio_EventInstance_SetReverbLevel
FMOD_Studio_EventInstance_SetTimelinePosition
FMOD_Studio_EventInstance_SetUserData
FMOD_Studio_EventInstance_SetVolume
FMOD_Studio_EventInstance_Start
FMOD_Studio_EventInstance_Stop
FMOD_Studio_EventInstance_TriggerCue
FMOD_Studio_ParameterInstance_GetDescription
FMOD_Studio_ParameterInstance_GetValue
FMOD_Studio_ParameterInstance_IsValid
FMOD_Studio_ParameterInstance_SetValue
FMOD_Studio_ParseID
FMOD_Studio_System_Create
FMOD_Studio_System_FlushCommands
FMOD_Studio_System_FlushSampleLoading
FMOD_Studio_System_GetAdvancedSettings
FMOD_Studio_System_GetBank
FMOD_Studio_System_GetBankByID
FMOD_Studio_System_GetBankCount
FMOD_Studio_System_GetBankList
FMOD_Studio_System_GetBufferUsage
FMOD_Studio_System_GetBus
FMOD_Studio_System_GetBusByID
FMOD_Studio_System_GetCPUUsage
FMOD_Studio_System_GetEvent
FMOD_Studio_System_GetEventByID
FMOD_Studio_System_GetListenerAttributes
FMOD_Studio_System_GetListenerWeight
FMOD_Studio_System_GetLowLevelSystem
FMOD_Studio_System_GetNumListeners
FMOD_Studio_System_GetSoundInfo
FMOD_Studio_System_GetUserData
FMOD_Studio_System_GetVCA
FMOD_Studio_System_GetVCAByID
FMOD_Studio_System_Initialize
FMOD_Studio_System_IsValid
FMOD_Studio_System_LoadBankCustom
FMOD_Studio_System_LoadBankFile
FMOD_Studio_System_LoadBankMemory
FMOD_Studio_System_LoadCommandReplay
FMOD_Studio_System_LookupID
FMOD_Studio_System_LookupPath
FMOD_Studio_System_RegisterPlugin
FMOD_Studio_System_Release
FMOD_Studio_System_ResetBufferUsage
FMOD_Studio_System_SetAdvancedSettings
FMOD_Studio_System_SetCallback
FMOD_Studio_System_SetListenerAttributes
FMOD_Studio_System_SetListenerWeight
FMOD_Studio_System_SetNumListeners
FMOD_Studio_System_SetUserData
FMOD_Studio_System_StartCommandCapture
FMOD_Studio_System_StopCommandCapture
FMOD_Studio_System_UnloadAll
FMOD_Studio_System_UnregisterPlugin
FMOD_Studio_System_Update
FMOD_Studio_VCA_GetID
FMOD_Studio_VCA_GetPath
FMOD_Studio_VCA_GetVolume
FMOD_Studio_VCA_IsValid
FMOD_Studio_VCA_SetVolume

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/fsbank64.dll
.dll windows:6 windows x64 arch:x64

bc56d7b14e37e88080053d5e9414f07c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FindFirstFileExW
HeapSize
FreeLibrary
GetProcAddress
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
CloseHandle
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
MultiByteToWideChar
SetEndOfFile
GetTimeZoneInformation
GetStringTypeW
WriteConsoleW
SetStdHandle
LCMapStringW
CompareStringW
OutputDebugStringW
RaiseException
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
CreateDirectoryW
FileTimeToLocalFileTime
FindClose
SetEnvironmentVariableA
GetDriveTypeW
FileTimeToSystemTime
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetProcessHeap
ExitProcess
GetModuleHandleExW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
WideCharToMultiByte
GetConsoleCP
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
GetModuleFileNameA

ole32

CoInitializeEx
CoUninitialize

fmod64

FMOD_Memory_GetStats
FMOD_Memory_Initialize
?getLoopPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII0I@Z
?getSyncPointInfo@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_SYNCPOINT@@PEADHPEAII@Z
?getSyncPoint@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAUFMOD_SYNCPOINT@@@Z
?getNumSyncPoints@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?readData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAXIPEAI@Z
?getNumSubSounds@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getFormat@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SOUND_TYPE@@PEAW4FMOD_SOUND_FORMAT@@PEAH2@Z
FMOD_Debug_Initialize
?getSubSound@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?getDefaults@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAMPEAH@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?init@System@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAX@Z
?setOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?release@System@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
FMOD_System_Create
?getGlobals@FMOD@@YAXPEAPEAVGlobal@1@@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z

Exports

Exports

FSBank_Build
FSBank_BuildCancel
FSBank_FetchFSBMemory
FSBank_FetchNextProgressItem
FSBank_Init
FSBank_MemoryGetStats
FSBank_MemoryInit
FSBank_Release
FSBank_ReleaseProgressItem

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/gog.ico
CARRION v1.0.5.617-PiviGames.blog/goggame-1785384169.hashdb
.zip
goggame-1785384169.hashdb
CARRION v1.0.5.617-PiviGames.blog/goggame-1785384169.ico
CARRION v1.0.5.617-PiviGames.blog/goggame-1785384169.id
CARRION v1.0.5.617-PiviGames.blog/goggame-1785384169.info
CARRION v1.0.5.617-PiviGames.blog/libfsbvorbis64.dll
.dll windows:5 windows x64 arch:x64

a1303b0833ab988f25054131fbc2300a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
RaiseException
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetStringTypeW

Exports

Exports

_floor_P
_mapping_P
_residue_P
vorbis_analysis
vorbis_analysis_blockout
vorbis_analysis_buffer
vorbis_analysis_headerout
vorbis_analysis_init
vorbis_analysis_wrote
vorbis_bitrate_addblock
vorbis_bitrate_flushpacket
vorbis_block_clear
vorbis_block_init
vorbis_comment_add
vorbis_comment_add_tag
vorbis_comment_clear
vorbis_comment_init
vorbis_comment_query
vorbis_comment_query_count
vorbis_commentheader_out
vorbis_dsp_clear
vorbis_encode_ctl
vorbis_encode_init
vorbis_encode_init_vbr
vorbis_encode_setup_init
vorbis_encode_setup_managed
vorbis_encode_setup_vbr
vorbis_granule_time
vorbis_info_blocksize
vorbis_info_clear
vorbis_info_init
vorbis_packet_blocksize
vorbis_synthesis
vorbis_synthesis_blockin
vorbis_synthesis_halfrate
vorbis_synthesis_halfrate_p
vorbis_synthesis_headerin
vorbis_synthesis_idheader
vorbis_synthesis_init
vorbis_synthesis_lapout
vorbis_synthesis_pcmout
vorbis_synthesis_read
vorbis_synthesis_restart
vorbis_synthesis_trackonly
vorbis_version_string
vorbis_window

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/lua54.dll
.dll windows:6 windows x64 arch:x64

54527fac3824e8db3a270bb26538dad3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ReadFile
CloseHandle
DuplicateHandle
CreateProcessW
GetTempPathW
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
GetFileSizeEx
SetFilePointerEx
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
MoveFileExW
GetCPInfo
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
HeapSize
SetEndOfFile

Exports

Exports

luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resetthread
lua_resume
lua_rotate
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_toclose
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_xmove
lua_yieldk
luaopen_base
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8

Sections

.text
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/support.ico
CARRION v1.0.5.617-PiviGames.blog/unins000.dat
CARRION v1.0.5.617-PiviGames.blog/unins000.exe
.exe windows:6 windows x86 arch:x86

9825b4c9a35eb9a5c5e347cb9ca988ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

mpr

WNetEnumResourceW
WNetGetUniversalNameW
WNetGetConnectionW
WNetCloseEnum
WNetOpenEnumW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

comctl32

FlatSB_SetScrollInfo
InitCommonControls
ImageList_DragMove
ImageList_Destroy
_TrackMouseEvent
ImageList_DragShowNolock
ImageList_Add
FlatSB_SetScrollProp
ImageList_GetDragImage
ImageList_Create
ImageList_EndDrag
ImageList_DrawEx
ImageList_SetImageCount
FlatSB_GetScrollPos
FlatSB_SetScrollPos
InitializeFlatSB
FlatSB_GetScrollInfo
ImageList_Write
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_GetIcon
ImageList_GetImageCount
ImageList_DragEnter
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_Read
ImageList_DragLeave
ImageList_Draw
ImageList_Remove

shell32

SHBrowseForFolderW
SHGetMalloc
SHGetFileInfoW
SHChangeNotify
Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW
ShellExecuteExW

user32

CopyImage
CreateWindowExW
GetMenuItemInfoW
SetMenuItemInfoW
DefFrameProcW
GetDCEx
GetMessageW
PeekMessageW
MonitorFromWindow
GetDlgCtrlID
ScrollWindowEx
SetTimer
WindowFromPoint
BeginPaint
RegisterClipboardFormatW
FrameRect
MapVirtualKeyW
OffsetRect
IsWindowUnicode
RegisterWindowMessageW
FillRect
GetMenuStringW
DispatchMessageW
SendMessageA
DefMDIChildProcW
EnumWindows
GetClassInfoW
GetSystemMenu
WaitForInputIdle
ShowOwnedPopups
GetScrollRange
GetScrollPos
SetScrollPos
GetActiveWindow
SetActiveWindow
DrawEdge
InflateRect
GetKeyboardLayoutList
OemToCharBuffA
LoadBitmapW
DrawFocusRect
EnumChildWindows
GetScrollBarInfo
SendNotifyMessageW
ReleaseCapture
UnhookWindowsHookEx
LoadCursorW
GetCapture
SetCapture
CreatePopupMenu
ScrollWindow
ShowCaret
GetMenuItemID
GetLastActivePopup
CharLowerBuffW
GetSystemMetrics
SetWindowLongW
PostMessageW
DrawMenuBar
SetParent
IsZoomed
CharUpperBuffW
GetClientRect
IsChild
ClientToScreen
SetWindowPlacement
IsIconic
CallNextHookEx
GetMonitorInfoW
ShowWindow
CheckMenuItem
CharUpperW
DefWindowProcW
GetForegroundWindow
SetForegroundWindow
GetWindowTextW
EnableWindow
DestroyWindow
IsDialogMessageW
EndMenu
RegisterClassW
CharNextW
GetWindowThreadProcessId
RedrawWindow
GetDC
GetFocus
SetFocus
EndPaint
ExitWindowsEx
ReleaseDC
MsgWaitForMultipleObjectsEx
LoadKeyboardLayoutW
GetClassLongW
ActivateKeyboardLayout
GetParent
CharToOemBuffA
DrawTextW
SetScrollRange
InsertMenuItemW
PeekMessageA
GetPropW
SetClassLongW
MessageBoxW
MessageBeep
SetPropW
SetRectEmpty
UpdateWindow
RemovePropW
GetSubMenu
MsgWaitForMultipleObjects
DestroyMenu
DestroyIcon
SetWindowsHookExW
IsWindowVisible
DispatchMessageA
UnregisterClassW
GetTopWindow
SendMessageW
AdjustWindowRectEx
DrawIcon
IsWindow
EnumThreadWindows
InvalidateRect
GetKeyboardState
DrawFrameControl
ScreenToClient
SendMessageTimeoutW
BringWindowToTop
SetCursor
CreateIcon
CreateMenu
LoadStringW
CharLowerW
SetWindowPos
SetWindowRgn
GetMenuItemCount
RemoveMenu
AppendMenuW
GetSysColorBrush
GetKeyboardLayoutNameW
GetWindowDC
TranslateMessage
DrawTextExW
MapWindowPoints
EnumDisplayMonitors
CallWindowProcW
DestroyCursor
ReplyMessage
GetScrollInfo
SetWindowTextW
GetMessageExtraInfo
EnableScrollBar
GetSysColor
TrackPopupMenu
DrawIconEx
PostQuitMessage
GetClassNameW
ShowScrollBar
EnableMenuItem
GetIconInfo
GetMessagePos
LoadImageW
SetScrollInfo
GetKeyNameTextW
GetDesktopWindow
GetCursorPos
SetCursorPos
HideCaret
GetMenu
GetMenuState
SetMenu
SetRect
GetKeyState
FindWindowExW
MonitorFromPoint
SystemParametersInfoW
LoadIconW
GetCursor
GetWindow
GetWindowLongW
GetWindowRect
InsertMenuW
KillTimer
WaitMessage
IsWindowEnabled
IsDialogMessageA
TranslateMDISysAccel
GetWindowPlacement
FindWindowW
DeleteMenu
GetKeyboardLayout

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

oleaut32

SafeArrayPutElement
LoadTypeLib
GetErrorInfo
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
SafeArrayCreate
SafeArrayGetElement
GetActiveObject
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
VariantCopy
RegisterTypeLib
VariantChangeType
VariantCopyInd

advapi32

RegSetValueExW
RegEnumKeyExW
AdjustTokenPrivileges
OpenThreadToken
GetUserNameW
RegDeleteKeyW
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegQueryInfoKeyW
AllocateAndInitializeSid
FreeSid
EqualSid
RegDeleteValueW
RegFlushKey
RegQueryValueExW
RegEnumValueW
GetTokenInformation
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
SetSecurityDescriptorDacl

netapi32

NetWkstaGetInfo
NetApiBufferFree

msvcrt

memcpy

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSendRequest
WinHttpQueryOption

kernel32

SetFileAttributesW
SetFileTime
GetACP
GetExitCodeProcess
IsBadWritePtr
CloseHandle
LocalFree
GetCurrentProcessId
SizeofResource
VirtualProtect
TerminateThread
QueryPerformanceFrequency
IsDebuggerPresent
FindNextFileW
GetFullPathNameW
VirtualFree
HeapAlloc
ExitProcess
WriteProfileStringW
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetTimeZoneInformation
FileTimeToLocalFileTime
GetModuleHandleW
FreeLibrary
HeapDestroy
CompareFileTime
ReadFile
CreateProcessW
TransactNamedPipe
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
OpenMutexW
CreateThread
CompareStringW
CopyFileW
CreateMutexW
LoadLibraryA
ResetEvent
MulDiv
FreeResource
GetDriveTypeW
GetVersion
RaiseException
MoveFileW
GlobalAddAtomW
GetSystemTimeAsFileTime
FormatMessageW
OpenProcess
SwitchToThread
GetExitCodeThread
OutputDebugStringW
GetCurrentThread
GetLogicalDrives
LocalFileTimeToFileTime
SetNamedPipeHandleState
LoadLibraryExW
TerminateProcess
LockResource
FileTimeToSystemTime
GetShortPathNameW
GetCurrentThreadId
UnhandledExceptionFilter
MoveFileExW
GlobalFindAtomW
VirtualQuery
GlobalFree
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
ReleaseMutex
FlushFileBuffers
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetFileSize
GlobalDeleteAtom
GetStartupInfoW
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
DeviceIoControl
LCMapStringW
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
lstrcmpW
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetEnvironmentVariableW
GetLocalTime
WaitForSingleObject
WriteFile
CreateNamedPipeW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
SetErrorMode
GetComputerNameW
IsValidLocale
TlsSetValue
CreateDirectoryW
GetOverlappedResult
GetSystemDefaultUILanguage
EnumCalendarInfoW
GetProfileStringW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
IsDBCSLeadByte
CreateEventW
GetPrivateProfileStringW
WaitForMultipleObjectsEx
GetThreadLocale
SetThreadLocale

ole32

StgCreateDocfileOnILockBytes
CoCreateInstance
CLSIDFromString
CoUninitialize
IsEqualGUID
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
CLSIDFromProgID
OleUninitialize
CoDisconnectObject
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID

gdi32

Arc
Pie
SetBkMode
SelectPalette
CreateCompatibleBitmap
ExcludeClipRect
RectVisible
SetWindowOrgEx
MaskBlt
AngleArc
Chord
SetTextColor
StretchBlt
SetDIBits
SetViewportOrgEx
CreateRectRgn
RealizePalette
SetDIBColorTable
GetDIBColorTable
RoundRect
RestoreDC
SetRectRgn
GetTextMetricsW
RemoveFontResourceW
GetWindowOrgEx
CreatePalette
CreateBrushIndirect
PatBlt
LineDDA
PolyBezierTo
GetStockObject
CreateSolidBrush
Polygon
Rectangle
MoveToEx
DeleteDC
SaveDC
BitBlt
Ellipse
FrameRgn
GetDeviceCaps
GetBitmapBits
GetTextExtentPoint32W
GetClipBox
Polyline
IntersectClipRect
GetSystemPaletteEntries
CreateBitmap
AddFontResourceW
CreateDIBitmap
GetStretchBltMode
CreateDIBSection
CreatePenIndirect
SetStretchBltMode
GetDIBits
CreateFontIndirectW
PolyBezier
LineTo
GetRgnBox
EnumFontsW
CreateHalftonePalette
DeleteObject
SelectObject
ExtFloodFill
UnrealizeObject
SetBkColor
CreateCompatibleDC
GetObjectW
GetBrushOrgEx
GetCurrentPositionEx
SetROP2
GetTextExtentPointW
ExtTextOutW
SetBrushOrgEx
GetPixel
ArcTo
GdiFlush
SetPixel
EnumFontFamiliesExW
GetPaletteEntries

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 30KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 151B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 76B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/webcache.zip
.zip
77b058909cf17f0aa662e5e798e4a54a88f23aed14cfa3d829ce43f9487bad71.jpg
.jpg
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_menu_notification_av.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_menu_notification_av2.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_sbicon.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_sbicon_2x.png
.png
fbb450bb1c6db10a6680dcbf4ceea307b0ab9c83c7f32ab52cc2e6c51d6c3f78_glx_logo.jpg
.jpg
fbb450bb1c6db10a6680dcbf4ceea307b0ab9c83c7f32ab52cc2e6c51d6c3f78_glx_logo_2x.jpg
.jpg
resources.json
CARRION v1.0.5.617-PiviGames.blog/x32/API-MS-Win-core-xstate-l2-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25
Signer

Actual PE Digest

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CopyContext
GetEnabledXStateFeatures
GetXStateFeaturesMask
InitializeContext
LocateXStateFeature
SetXStateFeaturesMask

Sections

.text
Size: 1024B - Virtual size: 682B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.deps.json
CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.dll.config
.xml
CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.exe
.exe windows:6 windows x86 arch:x86

bf1462ce2cfa173883d7ac57d7af7b93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
GetTempPathW
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
RtlUnwind
RaiseException
OutputDebugStringW
GetModuleHandleW
GetCurrentProcessId
Sleep
RemoveDirectoryW
DeleteCriticalSection
CreateDirectoryW
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
_register_thread_local_exe_atexit_callback
_errno
_c_exit
__p___wargv
_seh_filter_exe
__p___argc
_configure_wide_argv
_cexit
_crt_atexit
_exit
exit
_register_onexit_function
_initialize_onexit_table
_set_app_type
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
abort

api-ms-win-crt-heap-l1-1-0

calloc
free
_set_new_mode
_callnewh
malloc

api-ms-win-crt-math-l1-1-0

frexp
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vsprintf_s
__p__commode
fflush
_wfopen
__stdio_common_vfwprintf
fputws
fclose
fread
fseek
fwrite
__acrt_iob_func
fputwc
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s
memset
strcspn
wcsncmp
_wcsicmp
_wcsnicmp
wcsnlen
_wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func
setlocale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename
_wremove

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_time64
wcsftime
_gmtime64

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Carrion.runtimeconfig.json
CARRION v1.0.5.617-PiviGames.blog/x32/CarrionJson.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/CarrionJson.pdb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Animations/ParkaHuman.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Animations/RegularFemale.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Animations/RegularMale.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Animations/SWATHuman.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Audio/MasterBank.bank
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Audio/MasterBank.strings.bank
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Audio/Sounds.bank
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/BasicEffect.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/CRT_1.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/CRT_2.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Common/Common.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Common/Macros.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/DefaultText.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Enemies/MonsterTransformation.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Enemies/MultichannelVariant.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/LevelLayer.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/LevelLayerColorCorrection.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/LevelLayerLightMask.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Lighting/ChamberShadowEffect.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Lighting/LightPostprocessing.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Lighting/Shadow.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Models/DefaultModel.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/NearestNeighborSmoothing.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/EternalFog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/Fog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/Gibs.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/HivePlaceGlow.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/Parallax.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/PremultipliedAlpha.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/TwitchingMeat.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Objects/Water.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/Birth.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/BloomFog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/BloomFogPost.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/Cells.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/CellsPost.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/FadeOut.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/Hurt.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/Impersonation.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Postprocessing/LUT.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/Pseudo3D.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Effects/TextsShader.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/DefaultFont-CH.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/DefaultFont-JP.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/DefaultFont-Korean.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/DefaultFont.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/Licenses/GohuFont.txt
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/MenuLarge.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/MenuSmall.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Fonts/Small.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/General/Localization.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/General/LocalizationTokens.bin
CARRION v1.0.5.617-PiviGames.blog/x32/Content/General/autoexec.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/General/music_interaction.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/bunker.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/bureau.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/demo.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/dev.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/ending.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/jungle.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/junkyard.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/lab.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/mines.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/nuclear.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/overworld.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/sequence0.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/sequence1.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/sequence2.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/water.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Levels/weapons.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/ObjectTypes/object_types.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/bunker.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/bureau.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/demo.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/dev.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/jungle.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/junkyard.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/lab.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/mines.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/nuclear.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/overworld.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/water.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Scripts/weapons.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/general/default_light.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/general/parallax.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/seaweed.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/shrub1.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/shrub2.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/simple_plant.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/tentacle.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/plants/vine.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/cord.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/dot_matrix_display.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/fan.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/lamp.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/lamp_back_ground_tiny.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/lamp_background.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/decoration/tech/large_chain.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/cabinet.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/destructible.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/drawer.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/empty_jar.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/lab_burner.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/lab_glassware.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/lab_microscope.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/lab_tube_rack.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/locker.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/mainframe.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/office_desk.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/sink.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/toilet.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/tv_all.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/tv_code.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/tv_info_news.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/tv_noise.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/tv_stock.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/urinal.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/destructible/vending_machine.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/humans/assault_rifle_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/humans/corpse.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/humans/flamethrower_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/humans/pistol_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/humans/unarmed_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/drone_seating.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/mech_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/mech_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/missile_tank.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/scout_drone.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/turret.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/enemies/robots/turret_flame.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/cocoon.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/door.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/elevator.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/elevator_left_closed.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/elevator_right_closed.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/floodgate_horizontal.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/floodgate_vertical.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/jammer.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/jammer_receiver.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/laser_down.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/laser_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/laser_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/laser_up.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/lever_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/lever_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/nuclear_core_dispenser.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/nuclear_generator.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/obstacle.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/palm_reader.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/palm_scanner.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/plain_door.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/portal.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/power_node.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/rivet_bottom.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/rivet_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/rivet_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/rivet_top.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/sequence_entrance.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/switch.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/trigger.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/turbine.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/flow/window.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/fluids/water.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/fog/clouds.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/fog/eternal_fog.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/fog/fog.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/fog/rain.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/interactions/examine.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/interactions/no_animation.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/interactions/open.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/interactions/pick_up.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/interactions/pull.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/monster/monster_3_nodes.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/progress/goal.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/progress/hive_checkpoint.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/progress/upgrade_container.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/system/chamber.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/system/marker.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/traps/sticky_bomb.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Templates/utils/nuclear_core.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Buttons.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Buttons.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Effects/Morph.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Goo.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Gradients/Radial.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Humans/MultichannelVariants.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/LevelTextures.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Lighting/Light.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/DLCRibbon.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/Logo.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/MenuColor.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/MenuDepth.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/SplashScreen.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Menu/SplashScreenLogos.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuJaw.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuJaw.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuJawTwitchMap.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuXmas.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuXmas.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/MenuXmasWindMap.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Monsters.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Monsters.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/Clouds.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/Fog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/HiveVeins.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/Rain.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/Snow.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Objects/UniformFog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CavesA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CavesB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CityA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CityANight.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CityB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CityBNight.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CityC.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/CloudsA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Computers.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Computers_1.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Computers_2.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Computers_3.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/ConiferForestA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Default.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/DunesA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/DunesB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/FogLayerA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/FogLayerB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/JungleA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/JunkyardA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/JunkyardB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/MilkyWay.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/MinesA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/PipesA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/PipesB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/PipesC.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Sea.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/Sun.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/SunsetA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/SunsetB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/TowersA.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Parallaxes/TowersB.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Particles.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Particles.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Postprocessing/CellTexture.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Postprocessing/Dither.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Postprocessing/EternalFog.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Postprocessing/LUT.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Sequences.sprites.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Sequences.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/System/LayerClear.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/UI/Element.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/Textures/Water.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/Content/TileSets/tiles-editor.png
.png
CARRION v1.0.5.617-PiviGames.blog/x32/Content/TileSets/tiles.json
CARRION v1.0.5.617-PiviGames.blog/x32/Content/TileSets/tiles.xnb
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Levels/xmas_final.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Levels/xmas_special.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Scripts/xmas_special.cgs
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/general/default_light.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/general/parallax.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/seaweed.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/shrub1.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/shrub2.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/simple_plant.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/tentacle.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/plants/vine.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/cord.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/dot_matrix_display.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/fan.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/lamp.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/lamp_back_ground_tiny.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/lamp_background.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/decoration/tech/large_chain.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/cabinet.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/destructible.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/drawer.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/empty_jar.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/lab_burner.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/lab_glassware.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/lab_microscope.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/lab_tube_rack.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/locker.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/mainframe.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/office_desk.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/sink.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/toilet.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/tv_all.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/tv_code.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/tv_info_news.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/tv_noise.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/tv_stock.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/urinal.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/destructible/vending_machine.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/humans/assault_rifle_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/humans/corpse.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/humans/flamethrower_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/humans/pistol_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/humans/unarmed_human.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/drone_seating.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/mech_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/mech_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/missile_tank.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/scout_drone.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/turret.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/enemies/robots/turret_flame.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/cocoon.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/door.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/elevator.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/elevator_left_closed.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/elevator_right_closed.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/floodgate_horizontal.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/floodgate_vertical.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/jammer.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/jammer_receiver.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/laser_down.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/laser_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/laser_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/laser_up.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/lever_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/lever_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/nuclear_core_dispenser.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/nuclear_generator.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/obstacle.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/palm_reader.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/palm_scanner.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/plain_door.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/portal.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/power_node.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/rivet_bottom.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/rivet_left.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/rivet_right.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/rivet_top.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/sequence_entrance.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/switch.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/trigger.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/turbine.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/flow/window.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/fluids/water.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/fog/clouds.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/fog/eternal_fog.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/fog/fog.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/fog/rain.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/interactions/examine.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/interactions/no_animation.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/interactions/open.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/interactions/pick_up.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/interactions/pull.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/monster/monster_3_nodes.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/progress/goal.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/progress/hive_checkpoint.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/progress/upgrade_container.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/system/chamber.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/system/marker.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/traps/instakill_grid.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/traps/sticky_bomb.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/Templates/utils/nuclear_core.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/TileSets/tiles-editor.png
.png
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/TileSets/tiles.json
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/logo.png
.png
CARRION v1.0.5.617-PiviGames.blog/x32/DLC/GTOY/settings.json
CARRION v1.0.5.617-PiviGames.blog/x32/EULA.txt
CARRION v1.0.5.617-PiviGames.blog/x32/FMODWrapper.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/FMODWrapper.pdb
CARRION v1.0.5.617-PiviGames.blog/x32/Galaxy.dll
.dll windows:6 windows x86 arch:x86

cf52c875cb6c9e7c9915a77699246a08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohl
bind
ntohs
WSACleanup
inet_addr
htons
closesocket
ioctlsocket
htonl
getsockopt
inet_ntoa
recvfrom
sendto
setsockopt
socket
gethostbyname
gethostname
__WSAFDIsSet
getpeername
WSASetLastError
WSAGetLastError
WSARecv
freeaddrinfo
WSASend
WSASocketW
WSAAddressToStringW
WSAStringToAddressW
WSAIoctl
shutdown
send
getaddrinfo
getsockname
select
recv
listen
connect
accept
WSAStartup

kernel32

MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetThreadPriority
Sleep
LocalFree
FormatMessageA
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
QueryPerformanceFrequency
DeviceIoControl
GetWindowsDirectoryW
GetProcAddress
CreateDirectoryExW
CopyFileW
MoveFileExW
AreFileApisANSI
FreeLibrary
LoadLibraryA
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
QueryPerformanceCounter
GetModuleHandleA
FlushConsoleInputBuffer
GlobalMemoryStatus
FindFirstFileA
GetSystemTime
GetFileSizeEx
CreateFileA
ExpandEnvironmentStringsA
GetSystemDirectoryA
InitializeCriticalSectionEx
GetTickCount64
SystemTimeToFileTime
CreateWaitableTimerA
GetSystemInfo
OpenEventA
SetConsoleTextAttribute
CreateEventA
QueryFullProcessImageNameA
OpenProcess
CreateProcessA
GetExitCodeProcess
SleepEx
VerifyVersionInfoA
WaitForMultipleObjects
TerminateThread
QueueUserAPC
SetWaitableTimer
GetQueuedCompletionStatus
CreateIoCompletionPort
VerSetConditionMask
OutputDebugStringA
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
GetModuleFileNameA
TlsFree
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
GetLastError
RtlCaptureStackBackTrace
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetFileTime
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
GetLocaleInfoW
SetConsoleMode
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
WaitForSingleObject
RaiseException
RtlUnwind
SetConsoleCtrlHandler
GetFullPathNameA
ReadFile
ExitThread
ResumeThread
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetACP
GetStdHandle
GetFileType
GetDriveTypeW
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
FlushFileBuffers
WriteFile
GetConsoleCP
GetProcessHeap
GetTimeZoneInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

GetDC
GetUserObjectInformationW
ReleaseDC
WaitForInputIdle
MessageBoxA
LoadStringW
LoadStringA
GetProcessWindowStation

bcrypt

BCryptGetProperty
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDecrypt
BCryptGenRandom
BCryptDestroySecret
BCryptSecretAgreement
BCryptDeriveKey
BCryptSignHash
BCryptVerifySignature
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptExportKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptDestroyKey

wininet

InternetGetConnectedState

crypt32

CryptQueryObject
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA

iphlpapi

IcmpCreateFile
IcmpSendEcho

gdi32

GetDIBits
CreateCompatibleBitmap
DeleteObject
GetObjectA
GetDeviceCaps

shell32

SHGetFolderPathW

advapi32

StartServiceA
CloseServiceHandle
ControlService
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CryptAcquireContextA
CryptReleaseContext
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam

mswsock

AcceptEx
GetAcceptExSockaddrs

Exports

Exports

?Apps@api@galaxy@@YAPAVIApps@12@XZ
?Chat@api@galaxy@@YAPAVIChat@12@XZ
?CustomNetworking@api@galaxy@@YAPAVICustomNetworking@12@XZ
?Friends@api@galaxy@@YAPAVIFriends@12@XZ
?GameServerListenerRegistrar@api@galaxy@@YAPAVIListenerRegistrar@12@XZ
?GameServerLogger@api@galaxy@@YAPAVILogger@12@XZ
?GameServerMatchmaking@api@galaxy@@YAPAVIMatchmaking@12@XZ
?GameServerNetworking@api@galaxy@@YAPAVINetworking@12@XZ
?GameServerTelemetry@api@galaxy@@YAPAVITelemetry@12@XZ
?GameServerUser@api@galaxy@@YAPAVIUser@12@XZ
?GameServerUtils@api@galaxy@@YAPAVIUtils@12@XZ
?GetError@api@galaxy@@YAPBVIError@12@XZ
?Init@api@galaxy@@YAXABUInitOptions@12@@Z
?InitGameServer@api@galaxy@@YAXABUInitOptions@12@@Z
?ListenerRegistrar@api@galaxy@@YAPAVIListenerRegistrar@12@XZ
?Logger@api@galaxy@@YAPAVILogger@12@XZ
?Matchmaking@api@galaxy@@YAPAVIMatchmaking@12@XZ
?Networking@api@galaxy@@YAPAVINetworking@12@XZ
?ProcessData@api@galaxy@@YAXXZ
?ProcessGameServerData@api@galaxy@@YAXXZ
?Shutdown@api@galaxy@@YAXXZ
?ShutdownGameServer@api@galaxy@@YAXXZ
?Stats@api@galaxy@@YAPAVIStats@12@XZ
?Storage@api@galaxy@@YAPAVIStorage@12@XZ
?Telemetry@api@galaxy@@YAPAVITelemetry@12@XZ
?User@api@galaxy@@YAPAVIUser@12@XZ
?Utils@api@galaxy@@YAPAVIUtils@12@XZ
load

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 346KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/GalaxyNative.dll
.dll windows:6 windows x86 arch:x86

b1d6cbfa5ae77d92567869b3c1541113

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

galaxy

?ListenerRegistrar@api@galaxy@@YAPAVIListenerRegistrar@12@XZ
?Stats@api@galaxy@@YAPAVIStats@12@XZ
?GetError@api@galaxy@@YAPBVIError@12@XZ
?Init@api@galaxy@@YAXABUInitOptions@12@@Z
?ProcessData@api@galaxy@@YAXXZ
?Apps@api@galaxy@@YAPAVIApps@12@XZ
?User@api@galaxy@@YAPAVIUser@12@XZ
?Shutdown@api@galaxy@@YAXXZ

vcruntime140

_except_handler4_common
memcpy
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
__CxxFrameHandler3
memset

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_narrow_environment
_seh_filter_dll
_cexit
_initterm_e
_initterm
_initialize_onexit_table
_configure_narrow_argv

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent

Exports

Exports

Galaxy_AreAchievementsRetrieved
Galaxy_ClearAchievement
Galaxy_GetAuthStatus
Galaxy_GetCurrentGameLanguage
Galaxy_GetError
Galaxy_GetUserID
Galaxy_Init
Galaxy_IsAchievementUnlocked
Galaxy_IsLoggedOn
Galaxy_ProcessData
Galaxy_RequestStatsAndAchievements
Galaxy_SetAchievement
Galaxy_Shutdown
Galaxy_SignIn
Galaxy_StoreStatsAndAchievements

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/KeraLua.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/LZ4.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/LZ4pn.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Licenses.txt
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.CSharp.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:23:bd:f5:62:43:4b:1b:58:31:b0:31:5b:36:08:b4:63:27:33:89:09:45:fa:b2:b5:b7:77:af:df:1f:08:65
Signer

Actual PE Digest

d1:23:bd:f5:62:43:4b:1b:58:31:b0:31:5b:36:08:b4:63:27:33:89:09:45:fa:b2:b5:b7:77:af:df:1f:08:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 666KB - Virtual size: 666KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.DiaSymReader.Native.x86.dll
.dll regsvr32 windows:6 windows x86 arch:x86

2750e561997e3d2f8e185972112eba29

Code Sign

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/10/2017, 22:57

Not After

02/01/2019, 22:57

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89
Signer

Actual PE Digest

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89

Digest Algorithm

sha256

PE Digest Matches

true

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36
Signer

Actual PE Digest

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FreeLibrary
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
MapViewOfFileEx
GetFileSizeEx
GetFullPathNameW
ExpandEnvironmentStringsW
DeviceIoControl
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetFileType
DeleteFileW
VirtualFree
VirtualAlloc
WideCharToMultiByte
SetFileAttributesW
GetFileAttributesW
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
UnmapViewOfFile
CloseHandle
MultiByteToWideChar
GetSystemInfo
DisableThreadLibraryCalls
GetTickCount
GetEnvironmentVariableW
LCMapStringW
FormatMessageW
LocalFree
RaiseException
LoadLibraryExW
GetProcAddress
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RtlUnwind
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LocalAlloc
GetCurrentThreadId
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW

ole32

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-crt-heap-l1-1-0

_calloc_base
_callnewh
_free_base
free
malloc
calloc

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-string-l1-1-0

wcsncmp
wcscpy_s
_wcsdup
wcscat_s
_wcsicmp
_wcsnicmp
strcat_s
_stricmp
strncpy_s
towlower
wcsncat_s
strcpy_s
strncmp
wcsncpy_s
_memicmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_errno
_crt_atexit
_cexit
abort
__doserrno
_execute_onexit_table
_initterm_e
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo
_seh_filter_dll
terminate

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle
_close
_chsize_s
__stdio_common_vsnwprintf_s
__stdio_common_vfprintf
_wfsopen
_wfopen_s
fread
fseek
fflush
__stdio_common_vswprintf
__acrt_iob_func
ftell
_wsopen_s
__stdio_common_vsscanf
_open_osfhandle
__stdio_common_vswprintf_s
_read
__stdio_common_vsprintf_s
_filelengthi64
fclose
_lseeki64
__stdio_common_vsnprintf_s
_write

api-ms-win-crt-convert-l1-1-0

atoi
wcstoul
atol
_wtoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64
_wfullpath
_wsplitpath_s
_wmakepath_s
_fullpath

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-crt-time-l1-1-0

_time32

Exports

Exports

CreateNGenPdbWriter
CreateSymReader
CreateSymWriter
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectInternal
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.VisualBasic.Core.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:6d:ff:f7:13:ed:4f:a4:d5:97:fd:53:10:85:31:33:30:0c:3b:bf:76:61:b5:8a:13:dc:03:9a:58:72:43:c5
Signer

Actual PE Digest

c5:6d:ff:f7:13:ed:4f:a4:d5:97:fd:53:10:85:31:33:30:0c:3b:bf:76:61:b5:8a:13:dc:03:9a:58:72:43:c5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.VisualBasic.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:e7:07:9a:1a:b2:b2:20:09:a5:2c:2d:e8:e0:4d:9e:6b:1d:e7:d6:c9:f3:4f:21:77:69:7e:8b:3f:3a:27:08
Signer

Actual PE Digest

93:e7:07:9a:1a:b2:b2:20:09:a5:2c:2d:e8:e0:4d:9e:6b:1d:e7:d6:c9:f3:4f:21:77:69:7e:8b:3f:3a:27:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.Win32.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:92:86:66:a8:d6:56:2a:e5:53:d1:19:d8:74:84:88:d5:f0:70:60:6a:d1:55:fe:47:fb:a6:47:0b:84:fb:ed
Signer

Actual PE Digest

56:92:86:66:a8:d6:56:2a:e5:53:d1:19:d8:74:84:88:d5:f0:70:60:6a:d1:55:fe:47:fb:a6:47:0b:84:fb:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/Microsoft.Win32.Registry.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:c6:bf:b6:8a:82:1f:7c:23:8d:44:84:28:89:2d:3c:1c:22:53:54:24:46:31:e5:82:8b:6a:cc:36:7c:d3:43
Signer

Actual PE Digest

10:c6:bf:b6:8a:82:1f:7c:23:8d:44:84:28:89:2d:3c:1c:22:53:54:24:46:31:e5:82:8b:6a:cc:36:7c:d3:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/MonoGame.Framework.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/PlatformAPI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/PlatformAPI.pdb
CARRION v1.0.5.617-PiviGames.blog/x32/SDL2.dll
.dll windows:6 windows x86 arch:x86

60d5319e65042bb9dcf49fca5b923880

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

winmm

waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveInUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveOutGetNumDevs
timeEndPeriod
waveInAddBuffer
waveInStart
waveInReset
timeGetTime
waveOutUnprepareHeader
timeBeginPeriod

imm32

ImmNotifyIME
ImmSetCompositionWindow
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetCandidateListW
ImmGetContext

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

CreateSemaphoreW
WideCharToMultiByte
WaitForSingleObjectEx
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
VerSetConditionMask
GetLastError
FormatMessageW
VerifyVersionInfoW
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryA
CreateFileW
GetFileSizeEx
ReleaseSemaphore
SetFilePointer
SetFilePointerEx
WriteFile
SetErrorMode
CreateDirectoryW
GetCurrentProcess
lstrcatW
lstrlenW
GetModuleHandleW
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
CreateEventA
LocalFree
CloseHandle
Process32First
Process32Next
GetSystemPowerStatus
ExitProcess
TerminateProcess
GetStdHandle
OutputDebugStringW
lstrlenA
AttachConsole
GetConsoleMode
WriteConsoleW
GetEnvironmentVariableA
SetEnvironmentVariableA
Sleep
VirtualAlloc
VirtualFree
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
GlobalUnlock
GlobalLock
GetTickCount
GetModuleFileNameW
CompareStringA
MulDiv
SetThreadExecutionState
WaitForSingleObject
CreateToolhelp32Snapshot
ReadFile

user32

CreateWindowExW
SetTimer
KillTimer
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
PeekMessageW
GetMessageExtraInfo
CallWindowProcW
GetClassInfoExW
IsWindowVisible
IsIconic
GetKeyState
GetAsyncKeyState
GetSystemMetrics
GetMenu
GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
WindowFromPoint
ClipCursor
IsRectEmpty
GetWindowLongW
LoadIconW
DestroyIcon
GetRawInputData
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
PostMessageW
UnregisterClassW
EndDialog
GetDlgItem
SetFocus
DrawTextW
GetDC
ReleaseDC
SetWindowLongW
SystemParametersInfoA
SystemParametersInfoW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
SetCursorPos
LoadCursorW
CreateIconIndirect
RegisterRawInputDevices
SetWindowRgn
TrackMouseEvent
SendMessageW
RegisterClassW
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
GetFocus
SetForegroundWindow
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetParent
CreateIconFromResource
PostThreadMessageW
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcW
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetDoubleClickTime
MessageBoxA
GetDesktopWindow
RegisterClassExW
DispatchMessageW
GetRawInputDeviceInfoA
GetMessageW
DialogBoxIndirectParamW
GetRawInputDeviceList
TranslateMessage

gdi32

CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
GetDIBits
DeleteDC
BitBlt
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateRectRgn
CombineRgn
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateBitmap
CreateDCW
GetTextMetricsW
GetTextExtentPoint32A
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ExtractIconExW
DragAcceptFiles
DragFinish
SHGetFolderPathW
DragQueryFileW

ole32

CoUninitialize
CoInitializeEx
PropVariantClear
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString

Exports

Exports

SDL_AddEventWatch
SDL_AddHintCallback
SDL_AddTimer
SDL_AllocFormat
SDL_AllocPalette
SDL_AllocRW
SDL_AtomicAdd
SDL_AtomicCAS
SDL_AtomicCASPtr
SDL_AtomicGet
SDL_AtomicGetPtr
SDL_AtomicLock
SDL_AtomicSet
SDL_AtomicSetPtr
SDL_AtomicTryLock
SDL_AtomicUnlock
SDL_AudioInit
SDL_AudioQuit
SDL_AudioStreamAvailable
SDL_AudioStreamClear
SDL_AudioStreamFlush
SDL_AudioStreamGet
SDL_AudioStreamPut
SDL_BuildAudioCVT
SDL_CalculateGammaRamp
SDL_CaptureMouse
SDL_ClearError
SDL_ClearHints
SDL_ClearQueuedAudio
SDL_CloseAudio
SDL_CloseAudioDevice
SDL_ComposeCustomBlendMode
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertPixels
SDL_ConvertSurface
SDL_ConvertSurfaceFormat
SDL_CreateColorCursor
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateRGBSurfaceWithFormat
SDL_CreateRGBSurfaceWithFormatFrom
SDL_CreateRenderer
SDL_CreateSemaphore
SDL_CreateShapedWindow
SDL_CreateSoftwareRenderer
SDL_CreateSystemCursor
SDL_CreateTexture
SDL_CreateTextureFromSurface
SDL_CreateThread
SDL_CreateThreadWithStackSize
SDL_CreateWindow
SDL_CreateWindowAndRenderer
SDL_CreateWindowFrom
SDL_DXGIGetOutputInfo
SDL_DYNAPI_entry
SDL_DelEventWatch
SDL_DelHintCallback
SDL_Delay
SDL_DequeueAudio
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroyRenderer
SDL_DestroySemaphore
SDL_DestroyTexture
SDL_DestroyWindow
SDL_DetachThread
SDL_Direct3D9GetAdapterIndex
SDL_DisableScreenSaver
SDL_DuplicateSurface
SDL_EnableScreenSaver
SDL_EnclosePoints
SDL_Error
SDL_EventState
SDL_FillRect
SDL_FillRects
SDL_FilterEvents
SDL_FlushEvent
SDL_FlushEvents
SDL_FreeAudioStream
SDL_FreeCursor
SDL_FreeFormat
SDL_FreePalette
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_GL_BindTexture
SDL_GL_CreateContext
SDL_GL_DeleteContext
SDL_GL_ExtensionSupported
SDL_GL_GetAttribute
SDL_GL_GetCurrentContext
SDL_GL_GetCurrentWindow
SDL_GL_GetDrawableSize
SDL_GL_GetProcAddress
SDL_GL_GetSwapInterval
SDL_GL_LoadLibrary
SDL_GL_MakeCurrent
SDL_GL_ResetAttributes
SDL_GL_SetAttribute
SDL_GL_SetSwapInterval
SDL_GL_SwapWindow
SDL_GL_UnbindTexture
SDL_GL_UnloadLibrary
SDL_GameControllerAddMapping
SDL_GameControllerAddMappingsFromRW
SDL_GameControllerClose
SDL_GameControllerEventState
SDL_GameControllerFromInstanceID
SDL_GameControllerFromPlayerIndex
SDL_GameControllerGetAttached
SDL_GameControllerGetAxis
SDL_GameControllerGetAxisFromString
SDL_GameControllerGetBindForAxis
SDL_GameControllerGetBindForButton
SDL_GameControllerGetButton
SDL_GameControllerGetButtonFromString
SDL_GameControllerGetJoystick
SDL_GameControllerGetPlayerIndex
SDL_GameControllerGetProduct
SDL_GameControllerGetProductVersion
SDL_GameControllerGetStringForAxis
SDL_GameControllerGetStringForButton
SDL_GameControllerGetType
SDL_GameControllerGetVendor
SDL_GameControllerMapping
SDL_GameControllerMappingForDeviceIndex
SDL_GameControllerMappingForGUID
SDL_GameControllerMappingForIndex
SDL_GameControllerName
SDL_GameControllerNameForIndex
SDL_GameControllerNumMappings
SDL_GameControllerOpen
SDL_GameControllerRumble
SDL_GameControllerSetPlayerIndex
SDL_GameControllerTypeForIndex
SDL_GameControllerUpdate
SDL_GetAssertionHandler
SDL_GetAssertionReport
SDL_GetAudioDeviceName
SDL_GetAudioDeviceStatus
SDL_GetAudioDriver
SDL_GetAudioStatus
SDL_GetBasePath
SDL_GetCPUCacheLineSize
SDL_GetCPUCount
SDL_GetClipRect
SDL_GetClipboardText
SDL_GetClosestDisplayMode
SDL_GetColorKey
SDL_GetCurrentAudioDriver
SDL_GetCurrentDisplayMode
SDL_GetCurrentVideoDriver
SDL_GetCursor
SDL_GetDefaultAssertionHandler
SDL_GetDefaultCursor
SDL_GetDesktopDisplayMode
SDL_GetDisplayBounds
SDL_GetDisplayDPI
SDL_GetDisplayMode
SDL_GetDisplayName
SDL_GetDisplayOrientation
SDL_GetDisplayUsableBounds
SDL_GetError
SDL_GetEventFilter
SDL_GetGlobalMouseState
SDL_GetGrabbedWindow
SDL_GetHint
SDL_GetHintBoolean
SDL_GetKeyFromName
SDL_GetKeyFromScancode
SDL_GetKeyName
SDL_GetKeyboardFocus
SDL_GetKeyboardState
SDL_GetMemoryFunctions
SDL_GetModState
SDL_GetMouseFocus
SDL_GetMouseState
SDL_GetNumAllocations
SDL_GetNumAudioDevices
SDL_GetNumAudioDrivers
SDL_GetNumDisplayModes
SDL_GetNumRenderDrivers
SDL_GetNumTouchDevices
SDL_GetNumTouchFingers
SDL_GetNumVideoDisplays
SDL_GetNumVideoDrivers
SDL_GetPerformanceCounter
SDL_GetPerformanceFrequency
SDL_GetPixelFormatName
SDL_GetPlatform
SDL_GetPowerInfo
SDL_GetPrefPath
SDL_GetQueuedAudioSize
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseMode
SDL_GetRelativeMouseState
SDL_GetRenderDrawBlendMode
SDL_GetRenderDrawColor
SDL_GetRenderDriverInfo
SDL_GetRenderTarget
SDL_GetRenderer
SDL_GetRendererInfo
SDL_GetRendererOutputSize
SDL_GetRevision
SDL_GetRevisionNumber
SDL_GetScancodeFromKey
SDL_GetScancodeFromName
SDL_GetScancodeName
SDL_GetShapedWindowMode
SDL_GetSurfaceAlphaMod
SDL_GetSurfaceBlendMode
SDL_GetSurfaceColorMod
SDL_GetSystemRAM
SDL_GetTextureAlphaMod
SDL_GetTextureBlendMode
SDL_GetTextureColorMod
SDL_GetTextureScaleMode
SDL_GetThreadID
SDL_GetThreadName
SDL_GetTicks
SDL_GetTouchDevice
SDL_GetTouchDeviceType
SDL_GetTouchFinger
SDL_GetVersion
SDL_GetVideoDriver
SDL_GetWindowBordersSize
SDL_GetWindowBrightness
SDL_GetWindowData
SDL_GetWindowDisplayIndex
SDL_GetWindowDisplayMode
SDL_GetWindowFlags
SDL_GetWindowFromID
SDL_GetWindowGammaRamp
SDL_GetWindowGrab
SDL_GetWindowID
SDL_GetWindowMaximumSize
SDL_GetWindowMinimumSize
SDL_GetWindowOpacity
SDL_GetWindowPixelFormat
SDL_GetWindowPosition
SDL_GetWindowSize
SDL_GetWindowSurface
SDL_GetWindowTitle
SDL_GetWindowWMInfo
SDL_GetYUVConversionMode
SDL_GetYUVConversionModeForResolution
SDL_HapticClose
SDL_HapticDestroyEffect
SDL_HapticEffectSupported
SDL_HapticGetEffectStatus
SDL_HapticIndex
SDL_HapticName
SDL_HapticNewEffect
SDL_HapticNumAxes
SDL_HapticNumEffects
SDL_HapticNumEffectsPlaying
SDL_HapticOpen
SDL_HapticOpenFromJoystick
SDL_HapticOpenFromMouse
SDL_HapticOpened
SDL_HapticPause
SDL_HapticQuery
SDL_HapticRumbleInit
SDL_HapticRumblePlay
SDL_HapticRumbleStop
SDL_HapticRumbleSupported
SDL_HapticRunEffect
SDL_HapticSetAutocenter
SDL_HapticSetGain
SDL_HapticStopAll
SDL_HapticStopEffect
SDL_HapticUnpause
SDL_HapticUpdateEffect
SDL_Has3DNow
SDL_HasARMSIMD
SDL_HasAVX
SDL_HasAVX2
SDL_HasAVX512F
SDL_HasAltiVec
SDL_HasClipboardText
SDL_HasColorKey
SDL_HasEvent
SDL_HasEvents
SDL_HasIntersection
SDL_HasMMX
SDL_HasNEON
SDL_HasRDTSC
SDL_HasSSE
SDL_HasSSE2
SDL_HasSSE3
SDL_HasSSE41
SDL_HasSSE42
SDL_HasScreenKeyboardSupport
SDL_HideWindow
SDL_Init
SDL_InitSubSystem
SDL_IntersectRect
SDL_IntersectRectAndLine
SDL_IsGameController
SDL_IsScreenKeyboardShown
SDL_IsScreenSaverEnabled
SDL_IsShapedWindow
SDL_IsTablet
SDL_IsTextInputActive
SDL_JoystickClose
SDL_JoystickCurrentPowerLevel
SDL_JoystickEventState
SDL_JoystickFromInstanceID
SDL_JoystickFromPlayerIndex
SDL_JoystickGetAttached
SDL_JoystickGetAxis
SDL_JoystickGetAxisInitialState
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetDeviceGUID
SDL_JoystickGetDeviceInstanceID
SDL_JoystickGetDevicePlayerIndex
SDL_JoystickGetDeviceProduct
SDL_JoystickGetDeviceProductVersion
SDL_JoystickGetDeviceType
SDL_JoystickGetDeviceVendor
SDL_JoystickGetGUID
SDL_JoystickGetGUIDFromString
SDL_JoystickGetGUIDString
SDL_JoystickGetHat
SDL_JoystickGetPlayerIndex
SDL_JoystickGetProduct
SDL_JoystickGetProductVersion
SDL_JoystickGetType
SDL_JoystickGetVendor
SDL_JoystickInstanceID
SDL_JoystickIsHaptic
SDL_JoystickName
SDL_JoystickNameForIndex
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickRumble
SDL_JoystickSetPlayerIndex
SDL_JoystickUpdate
SDL_LoadBMP_RW
SDL_LoadDollarTemplates
SDL_LoadFile
SDL_LoadFile_RW
SDL_LoadFunction
SDL_LoadObject
SDL_LoadWAV_RW
SDL_LockAudio
SDL_LockAudioDevice
SDL_LockJoysticks
SDL_LockMutex
SDL_LockSurface
SDL_LockTexture
SDL_LockTextureToSurface
SDL_Log
SDL_LogCritical
SDL_LogDebug
SDL_LogError
SDL_LogGetOutputFunction
SDL_LogGetPriority
SDL_LogInfo
SDL_LogMessage
SDL_LogMessageV
SDL_LogResetPriorities
SDL_LogSetAllPriority
SDL_LogSetOutputFunction
SDL_LogSetPriority
SDL_LogVerbose
SDL_LogWarn
SDL_LowerBlit
SDL_LowerBlitScaled
SDL_MapRGB
SDL_MapRGBA
SDL_MasksToPixelFormatEnum
SDL_MaximizeWindow
SDL_MemoryBarrierAcquireFunction
SDL_MemoryBarrierReleaseFunction
SDL_Metal_CreateView
SDL_Metal_DestroyView
SDL_MinimizeWindow
SDL_MixAudio
SDL_MixAudioFormat
SDL_MouseIsHaptic
SDL_NewAudioStream
SDL_NumHaptics
SDL_NumJoysticks
SDL_NumSensors
SDL_OnApplicationDidBecomeActive
SDL_OnApplicationDidEnterBackground
SDL_OnApplicationDidReceiveMemoryWarning
SDL_OnApplicationWillEnterForeground
SDL_OnApplicationWillResignActive
SDL_OnApplicationWillTerminate
SDL_OpenAudio
SDL_OpenAudioDevice
SDL_PauseAudio
SDL_PauseAudioDevice
SDL_PeepEvents
SDL_PixelFormatEnumToMasks
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_QueryTexture
SDL_QueueAudio
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromConstMem
SDL_RWFromFP
SDL_RWFromFile
SDL_RWFromMem
SDL_RWclose
SDL_RWread
SDL_RWseek
SDL_RWsize
SDL_RWtell
SDL_RWwrite
SDL_RaiseWindow
SDL_ReadBE16
SDL_ReadBE32
SDL_ReadBE64
SDL_ReadLE16
SDL_ReadLE32
SDL_ReadLE64
SDL_ReadU8
SDL_RecordGesture
SDL_RegisterApp
SDL_RegisterEvents
SDL_RemoveTimer
SDL_RenderClear
SDL_RenderCopy
SDL_RenderCopyEx
SDL_RenderCopyExF
SDL_RenderCopyF
SDL_RenderDrawLine
SDL_RenderDrawLineF
SDL_RenderDrawLines
SDL_RenderDrawLinesF
SDL_RenderDrawPoint
SDL_RenderDrawPointF
SDL_RenderDrawPoints
SDL_RenderDrawPointsF
SDL_RenderDrawRect
SDL_RenderDrawRectF
SDL_RenderDrawRects
SDL_RenderDrawRectsF
SDL_RenderFillRect
SDL_RenderFillRectF
SDL_RenderFillRects
SDL_RenderFillRectsF
SDL_RenderFlush
SDL_RenderGetClipRect
SDL_RenderGetD3D9Device
SDL_RenderGetIntegerScale
SDL_RenderGetLogicalSize
SDL_RenderGetMetalCommandEncoder
SDL_RenderGetMetalLayer
SDL_RenderGetScale
SDL_RenderGetViewport
SDL_RenderIsClipEnabled
SDL_RenderPresent
SDL_RenderReadPixels
SDL_RenderSetClipRect
SDL_RenderSetIntegerScale
SDL_RenderSetLogicalSize
SDL_RenderSetScale
SDL_RenderSetViewport
SDL_RenderTargetSupported
SDL_ReportAssertion
SDL_ResetAssertionReport
SDL_RestoreWindow
SDL_SIMDAlloc
SDL_SIMDFree
SDL_SIMDGetAlignment
SDL_SaveAllDollarTemplates
SDL_SaveBMP_RW
SDL_SaveDollarTemplate
SDL_SemPost
SDL_SemTryWait
SDL_SemValue
SDL_SemWait
SDL_SemWaitTimeout
SDL_SensorClose
SDL_SensorFromInstanceID
SDL_SensorGetData
SDL_SensorGetDeviceInstanceID
SDL_SensorGetDeviceName
SDL_SensorGetDeviceNonPortableType
SDL_SensorGetDeviceType
SDL_SensorGetInstanceID
SDL_SensorGetName

Sections

.text
Size: 719KB - Virtual size: 719KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/SOS_README.md
CARRION v1.0.5.617-PiviGames.blog/x32/SharedMonogameTypes.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/SharedMonogameTypes.pdb
CARRION v1.0.5.617-PiviGames.blog/x32/SharedTypes.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/SharedTypes.pdb
CARRION v1.0.5.617-PiviGames.blog/x32/StbImageSharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.AppContext.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:bc:40:8e:4c:e6:9f:15:5c:80:00:7e:73:55:1c:33:1b:b1:7d:35:96:82:10:6d:17:6e:11:a5:22:8e:f0:0e
Signer

Actual PE Digest

e1:bc:40:8e:4c:e6:9f:15:5c:80:00:7e:73:55:1c:33:1b:b1:7d:35:96:82:10:6d:17:6e:11:a5:22:8e:f0:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Buffers.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:ff:38:ec:de:a1:71:b7:e2:40:d5:4e:24:65:3f:5c:42:b2:34:a4:da:a8:92:9a:61:68:a0:7f:a5:27:84:31
Signer

Actual PE Digest

bc:ff:38:ec:de:a1:71:b7:e2:40:d5:4e:24:65:3f:5c:42:b2:34:a4:da:a8:92:9a:61:68:a0:7f:a5:27:84:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Collections.Concurrent.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:bd:87:2e:93:39:8b:b4:4b:af:58:c5:33:65:82:dc:22:06:6b:c9:78:77:d8:78:f7:a3:b1:d8:79:ea:dd:ce
Signer

Actual PE Digest

e1:bd:87:2e:93:39:8b:b4:4b:af:58:c5:33:65:82:dc:22:06:6b:c9:78:77:d8:78:f7:a3:b1:d8:79:ea:dd:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Collections.Immutable.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:e9:b4:5c:45:68:88:43:4b:8c:64:9d:35:1b:6b:07:ae:24:02:7f:9c:43:de:5a:5d:ec:56:e7:ff:e5:4b:8f
Signer

Actual PE Digest

bc:e9:b4:5c:45:68:88:43:4b:8c:64:9d:35:1b:6b:07:ae:24:02:7f:9c:43:de:5a:5d:ec:56:e7:ff:e5:4b:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 510KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Collections.NonGeneric.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:9e:75:11:d0:95:c8:2c:a9:16:94:b8:f7:d1:b0:4d:05:06:94:7e:e0:6f:ee:e5:95:53:52:cd:ca:eb:15:7a
Signer

Actual PE Digest

b7:9e:75:11:d0:95:c8:2c:a9:16:94:b8:f7:d1:b0:4d:05:06:94:7e:e0:6f:ee:e5:95:53:52:cd:ca:eb:15:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Collections.Specialized.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e6:1d:90:a5:0a:49:65:42:fd:74:d1:d0:42:ea:02:83:e0:7b:7b:8a:8a:d4:7a:9b:00:4c:7b:74:b8:91:d1:b7
Signer

Actual PE Digest

e6:1d:90:a5:0a:49:65:42:fd:74:d1:d0:42:ea:02:83:e0:7b:7b:8a:8a:d4:7a:9b:00:4c:7b:74:b8:91:d1:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Collections.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:88:e2:7b:5b:f2:ef:12:68:9b:3d:76:7f:f1:0d:b7:45:d4:13:ac:bf:e7:ec:72:a6:35:ea:2b:fc:f2:13:a2
Signer

Actual PE Digest

83:88:e2:7b:5b:f2:ef:12:68:9b:3d:76:7f:f1:0d:b7:45:d4:13:ac:bf:e7:ec:72:a6:35:ea:2b:fc:f2:13:a2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 261KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.Annotations.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:90:9a:50:9c:0d:b6:37:03:1d:85:c2:bf:62:23:85:4e:f7:d4:0a:70:14:80:e5:55:b8:2f:ef:a9:7e:38:d9
Signer

Actual PE Digest

ad:90:9a:50:9c:0d:b6:37:03:1d:85:c2:bf:62:23:85:4e:f7:d4:0a:70:14:80:e5:55:b8:2f:ef:a9:7e:38:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.DataAnnotations.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:bd:76:f2:9a:15:c8:54:bf:5d:f6:35:26:1d:a0:fa:70:7f:76:9d:22:9f:68:14:dd:0b:20:c8:76:4e:35:4c
Signer

Actual PE Digest

ab:bd:76:f2:9a:15:c8:54:bf:5d:f6:35:26:1d:a0:fa:70:7f:76:9d:22:9f:68:14:dd:0b:20:c8:76:4e:35:4c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.EventBasedAsync.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:fe:df:72:75:00:86:17:30:dd:e1:45:10:12:c5:c7:e3:ee:c5:66:cd:c0:ea:ec:fd:3f:8d:f1:83:a3:42:ea
Signer

Actual PE Digest

d0:fe:df:72:75:00:86:17:30:dd:e1:45:10:12:c5:c7:e3:ee:c5:66:cd:c0:ea:ec:fd:3f:8d:f1:83:a3:42:ea

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:0b:e7:3d:e5:22:e5:73:aa:29:2d:0e:f7:53:42:2d:25:af:b2:5f:a5:c6:df:d4:38:f5:a9:84:e4:c2:e5:ee
Signer

Actual PE Digest

cf:0b:e7:3d:e5:22:e5:73:aa:29:2d:0e:f7:53:42:2d:25:af:b2:5f:a5:c6:df:d4:38:f5:a9:84:e4:c2:e5:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.TypeConverter.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:a0:f3:ef:49:47:22:4f:6a:25:9d:d8:cb:14:55:05:50:2b:8a:2c:61:2c:aa:bf:93:7f:6b:68:4c:35:bf:58
Signer

Actual PE Digest

7d:a0:f3:ef:49:47:22:4f:6a:25:9d:d8:cb:14:55:05:50:2b:8a:2c:61:2c:aa:bf:93:7f:6b:68:4c:35:bf:58

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 570KB - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ComponentModel.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:f2:01:1d:dd:fe:ee:87:e7:c4:37:17:0a:d6:48:a6:5a:a5:d0:2a:d0:43:c8:63:8e:f5:f8:55:45:a6:df:b1
Signer

Actual PE Digest

d0:f2:01:1d:dd:fe:ee:87:e7:c4:37:17:0a:d6:48:a6:5a:a5:d0:2a:d0:43:c8:63:8e:f5:f8:55:45:a6:df:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Configuration.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:3a:ff:ba:cd:fc:c1:c2:63:c2:e7:bb:59:6e:69:96:d1:16:27:2f:5f:68:0c:6c:d8:bd:c1:5b:9f:45:43:a4
Signer

Actual PE Digest

93:3a:ff:ba:cd:fc:c1:c2:63:c2:e7:bb:59:6e:69:96:d1:16:27:2f:5f:68:0c:6c:d8:bd:c1:5b:9f:45:43:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Console.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:68:7c:51:05:6b:a9:13:4d:66:56:1e:38:fa:c1:ad:6f:02:ad:9b:25:78:04:f7:f5:e6:22:c7:76:87:13:12
Signer

Actual PE Digest

6b:68:7c:51:05:6b:a9:13:4d:66:56:1e:38:fa:c1:ad:6f:02:ad:9b:25:78:04:f7:f5:e6:22:c7:76:87:13:12

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Core.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:c3:de:97:5b:14:55:be:2a:89:8e:49:6f:9b:f5:68:cf:bc:33:ed:bf:9d:eb:8b:e9:dd:de:39:5c:50:be:76
Signer

Actual PE Digest

a3:c3:de:97:5b:14:55:be:2a:89:8e:49:6f:9b:f5:68:cf:bc:33:ed:bf:9d:eb:8b:e9:dd:de:39:5c:50:be:76

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Data.Common.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:c3:26:23:09:84:34:26:22:5a:c3:55:f9:a3:ae:10:a2:7e:5b:f2:17:8c:1f:1d:1c:0b:72:a4:30:88:e1:5d
Signer

Actual PE Digest

c2:c3:26:23:09:84:34:26:22:5a:c3:55:f9:a3:ae:10:a2:7e:5b:f2:17:8c:1f:1d:1c:0b:72:a4:30:88:e1:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Data.DataSetExtensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:e2:27:dd:b9:dc:d5:60:7b:49:54:31:be:ad:8a:ba:39:91:98:40:b1:46:41:be:7c:2c:ae:55:af:76:5c:24
Signer

Actual PE Digest

65:e2:27:dd:b9:dc:d5:60:7b:49:54:31:be:ad:8a:ba:39:91:98:40:b1:46:41:be:7c:2c:ae:55:af:76:5c:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Data.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:b5:b1:e8:1b:8b:57:ba:5b:d6:a4:4a:f6:ab:91:bc:aa:e9:0d:15:06:b0:ad:f2:6f:4e:c9:d0:27:44:5a:3e
Signer

Actual PE Digest

31:b5:b1:e8:1b:8b:57:ba:5b:d6:a4:4a:f6:ab:91:bc:aa:e9:0d:15:06:b0:ad:f2:6f:4e:c9:d0:27:44:5a:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.Contracts.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:cb:3b:a0:d4:d8:7b:5f:ff:07:c7:aa:46:d5:db:8b:18:3f:f0:fd:91:d7:fe:d4:9a:1d:e3:55:d9:36:94:bf
Signer

Actual PE Digest

50:cb:3b:a0:d4:d8:7b:5f:ff:07:c7:aa:46:d5:db:8b:18:3f:f0:fd:91:d7:fe:d4:9a:1d:e3:55:d9:36:94:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.Debug.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:12:32:6f:80:ea:43:86:7d:75:17:03:2c:ae:0b:66:19:1f:57:76:90:fc:a6:74:f2:dc:8d:6a:27:6e:f8:59
Signer

Actual PE Digest

37:12:32:6f:80:ea:43:86:7d:75:17:03:2c:ae:0b:66:19:1f:57:76:90:fc:a6:74:f2:dc:8d:6a:27:6e:f8:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.DiagnosticSource.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:f8:a0:54:b1:03:ae:e4:b9:b5:7f:ae:0c:8c:ab:d8:6d:ba:02:b3:e3:ac:36:69:8e:f5:05:eb:3e:0b:3c:c6
Signer

Actual PE Digest

2c:f8:a0:54:b1:03:ae:e4:b9:b5:7f:ae:0c:8c:ab:d8:6d:ba:02:b3:e3:ac:36:69:8e:f5:05:eb:3e:0b:3c:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.FileVersionInfo.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:90:ba:29:0a:22:c5:94:58:a5:e7:57:52:0d:5c:43:ce:ff:31:97:c1:ad:9f:28:38:11:03:5d:5a:16:08:07
Signer

Actual PE Digest

e1:90:ba:29:0a:22:c5:94:58:a5:e7:57:52:0d:5c:43:ce:ff:31:97:c1:ad:9f:28:38:11:03:5d:5a:16:08:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.Process.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:e7:3c:50:b1:b0:2a:90:71:32:fb:03:ff:7f:09:f7:63:53:34:19:35:85:76:f1:35:28:17:b0:0b:3e:69:31
Signer

Actual PE Digest

66:e7:3c:50:b1:b0:2a:90:71:32:fb:03:ff:7f:09:f7:63:53:34:19:35:85:76:f1:35:28:17:b0:0b:3e:69:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.StackTrace.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:59:9f:26:98:3d:48:2c:5b:69:25:94:62:2f:ff:68:b4:cb:60:cd:e8:6f:7d:5c:26:c7:99:18:f5:ab:35:f1
Signer

Actual PE Digest

37:59:9f:26:98:3d:48:2c:5b:69:25:94:62:2f:ff:68:b4:cb:60:cd:e8:6f:7d:5c:26:c7:99:18:f5:ab:35:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.TextWriterTraceListener.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:29:40:8b:df:c7:e2:aa:4b:63:e8:d4:d0:bc:fc:d9:28:db:df:9d:9d:cb:18:20:95:83:b4:4c:32:ad:de:30
Signer

Actual PE Digest

d5:29:40:8b:df:c7:e2:aa:4b:63:e8:d4:d0:bc:fc:d9:28:db:df:9d:9d:cb:18:20:95:83:b4:4c:32:ad:de:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.Tools.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:29:e8:54:da:7f:64:fb:b5:a5:ba:d0:db:4a:f4:d9:e0:47:a1:93:17:a6:00:f2:40:04:64:d9:e9:64:da:43
Signer

Actual PE Digest

ec:29:e8:54:da:7f:64:fb:b5:a5:ba:d0:db:4a:f4:d9:e0:47:a1:93:17:a6:00:f2:40:04:64:d9:e9:64:da:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.TraceSource.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:d9:5b:8b:54:4c:35:9b:50:81:f0:cc:7a:51:da:65:8d:90:fe:f6:22:19:4e:5b:a3:da:53:72:0d:6d:6d:be
Signer

Actual PE Digest

13:d9:5b:8b:54:4c:35:9b:50:81:f0:cc:7a:51:da:65:8d:90:fe:f6:22:19:4e:5b:a3:da:53:72:0d:6d:6d:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Diagnostics.Tracing.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:bb:82:3b:63:2d:a6:ce:9a:16:19:85:15:64:04:c2:7c:c3:5e:7e:bc:b6:de:b7:0f:c4:24:79:aa:65:1a:27
Signer

Actual PE Digest

32:bb:82:3b:63:2d:a6:ce:9a:16:19:85:15:64:04:c2:7c:c3:5e:7e:bc:b6:de:b7:0f:c4:24:79:aa:65:1a:27

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Drawing.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:62:0b:d1:25:5d:6c:53:79:42:8c:dd:fb:c4:ed:1c:64:2b:f5:24:2c:08:f5:aa:7a:38:7f:89:1b:f1:74:ea
Signer

Actual PE Digest

4e:62:0b:d1:25:5d:6c:53:79:42:8c:dd:fb:c4:ed:1c:64:2b:f5:24:2c:08:f5:aa:7a:38:7f:89:1b:f1:74:ea

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Drawing.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:61:63:76:fa:18:ec:46:10:60:ff:ac:f7:05:c9:56:06:9b:35:95:ab:6d:00:ca:d0:0d:6f:54:23:fe:80:1f
Signer

Actual PE Digest

8c:61:63:76:fa:18:ec:46:10:60:ff:ac:f7:05:c9:56:06:9b:35:95:ab:6d:00:ca:d0:0d:6f:54:23:fe:80:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Dynamic.Runtime.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:24:b7:2f:00:29:b2:f2:d7:a5:d3:a4:82:b2:1f:ce:6f:3d:84:e5:da:04:56:64:c0:5c:2f:2d:ce:68:d8:9e
Signer

Actual PE Digest

57:24:b7:2f:00:29:b2:f2:d7:a5:d3:a4:82:b2:1f:ce:6f:3d:84:e5:da:04:56:64:c0:5c:2f:2d:ce:68:d8:9e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Globalization.Calendars.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:77:54:9c:c8:75:d9:f9:c8:e1:00:ea:06:9a:2d:21:dd:4e:62:4a:57:f5:0d:05:d0:46:a8:37:0d:be:5f:bf
Signer

Actual PE Digest

d8:77:54:9c:c8:75:d9:f9:c8:e1:00:ea:06:9a:2d:21:dd:4e:62:4a:57:f5:0d:05:d0:46:a8:37:0d:be:5f:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Globalization.Extensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:64:65:53:e9:11:42:a1:ce:68:d7:1e:4d:f6:8b:c2:aa:17:6c:bb:7a:85:10:d7:4a:0f:a9:c0:46:65:a8:fb
Signer

Actual PE Digest

16:64:65:53:e9:11:42:a1:ce:68:d7:1e:4d:f6:8b:c2:aa:17:6c:bb:7a:85:10:d7:4a:0f:a9:c0:46:65:a8:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Globalization.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:a8:64:6c:4b:31:f9:3d:99:9d:59:43:49:1a:57:85:fe:71:33:c8:da:a3:a6:7f:28:67:55:6c:b1:da:79:57
Signer

Actual PE Digest

5b:a8:64:6c:4b:31:f9:3d:99:9d:59:43:49:1a:57:85:fe:71:33:c8:da:a3:a6:7f:28:67:55:6c:b1:da:79:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Compression.Brotli.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:9d:d5:2a:92:de:5b:12:3d:0e:be:47:de:cd:ad:66:09:7b:95:d6:1b:98:70:b7:97:0f:ed:7b:a6:54:02:93
Signer

Actual PE Digest

64:9d:d5:2a:92:de:5b:12:3d:0e:be:47:de:cd:ad:66:09:7b:95:d6:1b:98:70:b7:97:0f:ed:7b:a6:54:02:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Compression.FileSystem.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:ca:55:d6:d2:01:07:14:c1:06:6b:45:89:77:a1:52:a2:92:32:a8:e0:d7:11:52:19:5d:07:14:f6:24:ab:a4
Signer

Actual PE Digest

70:ca:55:d6:d2:01:07:14:c1:06:6b:45:89:77:a1:52:a2:92:32:a8:e0:d7:11:52:19:5d:07:14:f6:24:ab:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Compression.ZipFile.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:ca:eb:0d:e1:ce:6a:94:a9:d1:95:23:9d:12:21:1e:fa:dc:71:a2:8d:2c:4d:c5:9d:f2:d4:04:f7:e8:c8:29
Signer

Actual PE Digest

8d:ca:eb:0d:e1:ce:6a:94:a9:d1:95:23:9d:12:21:1e:fa:dc:71:a2:8d:2c:4d:c5:9d:f2:d4:04:f7:e8:c8:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Compression.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:07:9b:92:68:72:fe:1b:30:e1:91:70:ca:d8:3d:e4:a8:38:e1:52:a7:ed:e4:a6:50:75:97:b9:f4:c0:a1:b2
Signer

Actual PE Digest

54:07:9b:92:68:72:fe:1b:30:e1:91:70:ca:d8:3d:e4:a8:38:e1:52:a7:ed:e4:a6:50:75:97:b9:f4:c0:a1:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.FileSystem.AccessControl.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:09:0b:0b:d6:dc:28:2b:de:9a:9a:e3:a7:7b:b4:70:df:57:2b:45:d6:3a:1b:45:f8:b1:0d:df:81:b0:5b:d3
Signer

Actual PE Digest

92:09:0b:0b:d6:dc:28:2b:de:9a:9a:e3:a7:7b:b4:70:df:57:2b:45:d6:3a:1b:45:f8:b1:0d:df:81:b0:5b:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.FileSystem.DriveInfo.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:88:5e:b4:34:1e:1d:e2:6a:6c:0a:76:db:39:6b:64:2e:b7:c8:36:f1:24:cd:4d:47:89:1b:46:bc:6d:7e:53
Signer

Actual PE Digest

e5:88:5e:b4:34:1e:1d:e2:6a:6c:0a:76:db:39:6b:64:2e:b7:c8:36:f1:24:cd:4d:47:89:1b:46:bc:6d:7e:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.FileSystem.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:74:a3:bc:38:30:73:69:ba:a8:12:95:71:52:7c:d4:9d:98:1d:7f:f7:77:bf:ed:67:96:38:79:74:32:64:dd
Signer

Actual PE Digest

5f:74:a3:bc:38:30:73:69:ba:a8:12:95:71:52:7c:d4:9d:98:1d:7f:f7:77:bf:ed:67:96:38:79:74:32:64:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.FileSystem.Watcher.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:e0:28:ed:1a:a3:e8:8f:dd:4d:88:b3:f1:6f:8a:14:79:18:e7:a3:a1:b3:cf:45:bc:3b:a7:d6:35:4f:0c:42
Signer

Actual PE Digest

89:e0:28:ed:1a:a3:e8:8f:dd:4d:88:b3:f1:6f:8a:14:79:18:e7:a3:a1:b3:cf:45:bc:3b:a7:d6:35:4f:0c:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.FileSystem.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:b5:5b:91:21:0c:62:c7:66:a4:cc:2b:11:54:07:86:43:43:29:7d:ea:1a:36:3a:ef:9f:85:39:be:0b:62:80
Signer

Actual PE Digest

8d:b5:5b:91:21:0c:62:c7:66:a4:cc:2b:11:54:07:86:43:43:29:7d:ea:1a:36:3a:ef:9f:85:39:be:0b:62:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.IsolatedStorage.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dc:e9:69:01:e4:45:4f:00:25:d5:c0:06:3a:a7:60:7a:52:fd:79:3a:12:d3:42:1f:5b:8c:b1:f0:9b:a5:dd:88
Signer

Actual PE Digest

dc:e9:69:01:e4:45:4f:00:25:d5:c0:06:3a:a7:60:7a:52:fd:79:3a:12:d3:42:1f:5b:8c:b1:f0:9b:a5:dd:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.MemoryMappedFiles.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:b3:9d:cd:97:ce:c8:49:e9:17:26:7f:2a:59:8f:5e:0d:fd:6b:e0:fe:0f:79:02:57:bd:37:62:77:34:f2:f5
Signer

Actual PE Digest

67:b3:9d:cd:97:ce:c8:49:e9:17:26:7f:2a:59:8f:5e:0d:fd:6b:e0:fe:0f:79:02:57:bd:37:62:77:34:f2:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Pipes.AccessControl.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:db:2b:ee:a7:d3:05:59:4f:8a:48:0c:6b:e1:23:c4:35:50:c3:8c:20:8f:ad:4f:56:d8:9a:54:bc:99:81:f5
Signer

Actual PE Digest

80:db:2b:ee:a7:d3:05:59:4f:8a:48:0c:6b:e1:23:c4:35:50:c3:8c:20:8f:ad:4f:56:d8:9a:54:bc:99:81:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.Pipes.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:c1:76:cf:3b:41:46:0c:d9:de:9f:b6:b2:e7:5a:a0:f6:86:6f:42:76:0a:a6:02:27:09:34:48:be:a7:0e:2e
Signer

Actual PE Digest

2d:c1:76:cf:3b:41:46:0c:d9:de:9f:b6:b2:e7:5a:a0:f6:86:6f:42:76:0a:a6:02:27:09:34:48:be:a7:0e:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.UnmanagedMemoryStream.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:a2:7b:b7:30:1a:50:72:4d:66:6d:22:c5:5d:d7:f2:17:e7:19:70:ad:e5:e4:07:01:12:43:15:19:60:19:ed
Signer

Actual PE Digest

cd:a2:7b:b7:30:1a:50:72:4d:66:6d:22:c5:5d:d7:f2:17:e7:19:70:ad:e5:e4:07:01:12:43:15:19:60:19:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.IO.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:46:96:d9:68:03:f1:65:13:11:43:7a:65:58:49:ef:f6:e4:1f:71:87:43:f9:86:52:e0:5a:c0:df:03:5f:19
Signer

Actual PE Digest

1d:46:96:d9:68:03:f1:65:13:11:43:7a:65:58:49:ef:f6:e4:1f:71:87:43:f9:86:52:e0:5a:c0:df:03:5f:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Linq.Expressions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:a3:88:58:2e:4d:fc:1f:89:a2:66:6e:5a:08:0b:3d:4e:bb:c0:1e:13:dd:59:62:df:ae:89:32:df:40:29:f5
Signer

Actual PE Digest

c2:a3:88:58:2e:4d:fc:1f:89:a2:66:6e:5a:08:0b:3d:4e:bb:c0:1e:13:dd:59:62:df:ae:89:32:df:40:29:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Linq.Parallel.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:a1:12:60:00:3d:82:2e:a0:df:53:02:ec:3d:8f:70:df:29:86:f0:2f:3d:9d:f6:32:a9:d2:8f:2d:2f:8c:c7
Signer

Actual PE Digest

f3:a1:12:60:00:3d:82:2e:a0:df:53:02:ec:3d:8f:70:df:29:86:f0:2f:3d:9d:f6:32:a9:d2:8f:2d:2f:8c:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Linq.Queryable.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:84:03:d2:8d:98:5b:af:21:f5:e5:c0:18:1f:f3:c3:09:51:29:5d:53:40:02:e7:f1:8a:87:6f:cc:df:45:4b
Signer

Actual PE Digest

54:84:03:d2:8d:98:5b:af:21:f5:e5:c0:18:1f:f3:c3:09:51:29:5d:53:40:02:e7:f1:8a:87:6f:cc:df:45:4b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Linq.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:54:a6:f2:b6:1f:50:b5:51:ea:b7:52:8c:d7:9f:1d:41:2c:ce:19:a4:a0:8b:77:48:c9:a5:11:38:af:75:72
Signer

Actual PE Digest

73:54:a6:f2:b6:1f:50:b5:51:ea:b7:52:8c:d7:9f:1d:41:2c:ce:19:a4:a0:8b:77:48:c9:a5:11:38:af:75:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Memory.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:b7:bc:3b:33:13:8b:ab:1f:a6:44:5c:54:c8:c4:54:bd:b9:67:14:ca:c9:75:31:dd:36:d0:3a:df:13:64:b8
Signer

Actual PE Digest

8a:b7:bc:3b:33:13:8b:ab:1f:a6:44:5c:54:c8:c4:54:bd:b9:67:14:ca:c9:75:31:dd:36:d0:3a:df:13:64:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Http.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:77:42:13:31:36:49:c8:b1:25:dc:75:3d:9c:12:d1:43:a6:ea:9c:d2:aa:bd:fa:0c:53:40:bb:94:a5:92:51
Signer

Actual PE Digest

5f:77:42:13:31:36:49:c8:b1:25:dc:75:3d:9c:12:d1:43:a6:ea:9c:d2:aa:bd:fa:0c:53:40:bb:94:a5:92:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.HttpListener.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:06:23:8d:23:b8:2a:0f:5e:eb:84:dd:c3:ef:cb:7c:0b:10:49:99:d7:ab:d6:dc:be:7b:6c:50:1a:91:c3:52
Signer

Actual PE Digest

30:06:23:8d:23:b8:2a:0f:5e:eb:84:dd:c3:ef:cb:7c:0b:10:49:99:d7:ab:d6:dc:be:7b:6c:50:1a:91:c3:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 525KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Mail.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:ea:67:8e:4b:39:7d:af:1d:31:1b:4c:20:e2:b7:f5:67:71:86:7d:18:2d:18:9e:d5:8f:f2:89:a2:de:0d:75
Signer

Actual PE Digest

fb:ea:67:8e:4b:39:7d:af:1d:31:1b:4c:20:e2:b7:f5:67:71:86:7d:18:2d:18:9e:d5:8f:f2:89:a2:de:0d:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 438KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.NameResolution.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:c5:e6:1a:46:7d:a0:59:70:a1:6c:83:ce:ff:e3:71:40:46:d9:27:10:27:d2:8c:ad:5d:e0:29:48:96:17:29
Signer

Actual PE Digest

d0:c5:e6:1a:46:7d:a0:59:70:a1:6c:83:ce:ff:e3:71:40:46:d9:27:10:27:d2:8c:ad:5d:e0:29:48:96:17:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.NetworkInformation.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:1a:12:35:2c:36:cd:09:c8:44:c3:e1:77:41:3a:9a:04:cd:6e:34:d4:e7:5b:8d:2c:21:45:aa:7e:15:ee:d3
Signer

Actual PE Digest

30:1a:12:35:2c:36:cd:09:c8:44:c3:e1:77:41:3a:9a:04:cd:6e:34:d4:e7:5b:8d:2c:21:45:aa:7e:15:ee:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Ping.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:b2:83:00:32:76:ef:c1:22:a5:85:31:36:89:5b:32:e0:f8:68:8e:20:3d:55:48:49:85:c3:58:36:46:db:68
Signer

Actual PE Digest

9b:b2:83:00:32:76:ef:c1:22:a5:85:31:36:89:5b:32:e0:f8:68:8e:20:3d:55:48:49:85:c3:58:36:46:db:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:84:a3:62:11:e6:69:44:43:34:85:76:9c:80:1d:b1:c5:6a:82:8a:ca:c1:69:fb:6c:97:9b:4a:e1:6a:fd:a5
Signer

Actual PE Digest

9f:84:a3:62:11:e6:69:44:43:34:85:76:9c:80:1d:b1:c5:6a:82:8a:ca:c1:69:fb:6c:97:9b:4a:e1:6a:fd:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Requests.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:b3:8f:db:74:12:41:39:67:87:45:23:bd:32:97:61:19:9d:1f:70:cd:da:e8:90:95:b5:06:eb:50:cc:8c:a3
Signer

Actual PE Digest

a0:b3:8f:db:74:12:41:39:67:87:45:23:bd:32:97:61:19:9d:1f:70:cd:da:e8:90:95:b5:06:eb:50:cc:8c:a3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Security.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:8e:60:11:50:d3:25:26:19:5d:bc:55:08:c9:9b:69:9a:d2:91:0b:f6:74:be:50:9f:71:66:b6:7c:37:18:51
Signer

Actual PE Digest

1c:8e:60:11:50:d3:25:26:19:5d:bc:55:08:c9:9b:69:9a:d2:91:0b:f6:74:be:50:9f:71:66:b6:7c:37:18:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.ServicePoint.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:2a:de:f6:b3:45:4e:1b:8f:87:84:77:b1:4d:0b:f5:55:8b:7d:4a:a3:79:ca:a6:3b:2f:7e:8f:09:b9:33:25
Signer

Actual PE Digest

d4:2a:de:f6:b3:45:4e:1b:8f:87:84:77:b1:4d:0b:f5:55:8b:7d:4a:a3:79:ca:a6:3b:2f:7e:8f:09:b9:33:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.Sockets.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:a8:05:48:2f:9e:f7:60:5f:89:65:0e:fc:e2:88:a7:35:5f:12:11:26:cc:64:cd:53:8d:13:aa:ee:97:0e:c6
Signer

Actual PE Digest

01:a8:05:48:2f:9e:f7:60:5f:89:65:0e:fc:e2:88:a7:35:5f:12:11:26:cc:64:cd:53:8d:13:aa:ee:97:0e:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 435KB - Virtual size: 434KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.WebClient.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:30:51:de:ee:55:46:f1:d3:66:05:38:8c:12:0c:0a:a6:44:7d:3e:84:2a:04:d6:f4:4a:23:6b:17:a6:e2:ff
Signer

Actual PE Digest

2d:30:51:de:ee:55:46:f1:d3:66:05:38:8c:12:0c:0a:a6:44:7d:3e:84:2a:04:d6:f4:4a:23:6b:17:a6:e2:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.WebHeaderCollection.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:06:73:ad:33:f0:99:9d:04:a9:24:a9:19:dd:53:12:80:f6:8d:6e:5e:c9:15:07:b1:56:25:56:a6:ce:f8:23
Signer

Actual PE Digest

75:06:73:ad:33:f0:99:9d:04:a9:24:a9:19:dd:53:12:80:f6:8d:6e:5e:c9:15:07:b1:56:25:56:a6:ce:f8:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.WebProxy.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:41:91:41:27:69:05:6b:31:11:55:4a:33:a7:4a:f1:f2:d7:bb:7f:27:ec:48:c5:d6:ae:9d:f6:a1:c6:e7:91
Signer

Actual PE Digest

e5:41:91:41:27:69:05:6b:31:11:55:4a:33:a7:4a:f1:f2:d7:bb:7f:27:ec:48:c5:d6:ae:9d:f6:a1:c6:e7:91

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.WebSockets.Client.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:ab:af:59:da:bd:b8:ee:57:4a:c2:3d:d1:ea:a0:26:b6:4f:21:56:6b:26:52:e2:bf:75:66:78:c9:de:f2:70
Signer

Actual PE Digest

b3:ab:af:59:da:bd:b8:ee:57:4a:c2:3d:d1:ea:a0:26:b6:4f:21:56:6b:26:52:e2:bf:75:66:78:c9:de:f2:70

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.WebSockets.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:47:87:e0:11:35:6a:1e:18:3c:eb:2f:73:3e:18:f0:93:2d:cb:14:0f:0a:ad:80:22:86:5c:58:33:2d:2e:f7
Signer

Actual PE Digest

87:47:87:e0:11:35:6a:1e:18:3c:eb:2f:73:3e:18:f0:93:2d:cb:14:0f:0a:ad:80:22:86:5c:58:33:2d:2e:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Net.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:3e:87:21:ee:fc:f5:f3:c2:00:66:63:31:0f:d1:2a:2e:2c:7a:50:44:36:e5:44:da:d4:bb:59:20:34:11:7f
Signer

Actual PE Digest

ad:3e:87:21:ee:fc:f5:f3:c2:00:66:63:31:0f:d1:2a:2e:2c:7a:50:44:36:e5:44:da:d4:bb:59:20:34:11:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Numerics.Vectors.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:f5:b1:33:47:49:2a:8c:1a:15:af:69:b3:0c:0d:04:91:f3:fc:31:91:d2:7f:83:30:77:ce:1d:82:1a:06:ff
Signer

Actual PE Digest

7a:f5:b1:33:47:49:2a:8c:1a:15:af:69:b3:0c:0d:04:91:f3:fc:31:91:d2:7f:83:30:77:ce:1d:82:1a:06:ff

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Numerics.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dc:cc:cb:d3:40:89:91:d8:06:49:b4:7a:04:6e:ec:12:a4:f1:ee:9d:0a:73:f6:a2:aa:61:74:55:46:b8:ac:43
Signer

Actual PE Digest

dc:cc:cb:d3:40:89:91:d8:06:49:b4:7a:04:6e:ec:12:a4:f1:ee:9d:0a:73:f6:a2:aa:61:74:55:46:b8:ac:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ObjectModel.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:6a:72:5b:f9:8f:15:5a:36:48:e1:c0:77:38:6a:d9:f0:e3:87:ed:e2:4d:3c:28:2c:09:15:49:15:95:da:11
Signer

Actual PE Digest

d8:6a:72:5b:f9:8f:15:5a:36:48:e1:c0:77:38:6a:d9:f0:e3:87:ed:e2:4d:3c:28:2c:09:15:49:15:95:da:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Private.CoreLib.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:95:89:53:fd:41:53:dc:ba:7b:18:b8:97:b3:6e:46:22:5c:50:13:0b:0a:9e:4d:5a:d2:c7:7e:5c:0e:3b:a7
Signer

Actual PE Digest

60:95:89:53:fd:41:53:dc:ba:7b:18:b8:97:b3:6e:46:22:5c:50:13:0b:0a:9e:4d:5a:d2:c7:7e:5c:0e:3b:a7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Private.DataContractSerialization.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:41:9e:ca:b0:0b:18:b8:c0:b4:6d:19:9b:8a:ef:ba:47:21:44:1b:ab:dd:2d:96:f1:f1:e8:bf:df:40:6a:6b
Signer

Actual PE Digest

8b:41:9e:ca:b0:0b:18:b8:c0:b4:6d:19:9b:8a:ef:ba:47:21:44:1b:ab:dd:2d:96:f1:f1:e8:bf:df:40:6a:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Private.Uri.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:80:b9:ad:da:1d:70:9c:ec:b1:9b:2f:ce:8f:6c:2a:2f:bf:29:cb:82:f7:a2:29:7a:1d:77:35:06:4b:27:46
Signer

Actual PE Digest

50:80:b9:ad:da:1d:70:9c:ec:b1:9b:2f:ce:8f:6c:2a:2f:bf:29:cb:82:f7:a2:29:7a:1d:77:35:06:4b:27:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Private.Xml.Linq.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:95:ee:65:7b:b7:e0:2e:61:f3:e4:bb:da:60:a5:9c:e0:ec:2d:f8:be:f6:9f:84:98:30:f7:18:69:e8:fc:0d
Signer

Actual PE Digest

31:95:ee:65:7b:b7:e0:2e:61:f3:e4:bb:da:60:a5:9c:e0:ec:2d:f8:be:f6:9f:84:98:30:f7:18:69:e8:fc:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Private.Xml.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:94:15:3b:c1:68:6a:3a:3a:2b:59:24:2b:6e:47:8d:38:51:31:5b:3b:b2:2b:cf:f1:7f:31:64:33:bc:1c:00
Signer

Actual PE Digest

a6:94:15:3b:c1:68:6a:3a:3a:2b:59:24:2b:6e:47:8d:38:51:31:5b:3b:b2:2b:cf:f1:7f:31:64:33:bc:1c:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.DispatchProxy.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:fc:6f:64:38:06:c2:f0:0d:83:43:db:40:5b:83:6a:bf:73:dd:9b:39:35:54:81:ad:93:9c:13:13:50:64:5e
Signer

Actual PE Digest

23:fc:6f:64:38:06:c2:f0:0d:83:43:db:40:5b:83:6a:bf:73:dd:9b:39:35:54:81:ad:93:9c:13:13:50:64:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Emit.ILGeneration.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:93:06:2a:93:84:7b:30:c1:ac:7d:16:76:ee:67:c7:d9:a8:fc:a1:cc:96:d1:96:3e:b9:f9:40:15:d7:1c:da
Signer

Actual PE Digest

8f:93:06:2a:93:84:7b:30:c1:ac:7d:16:76:ee:67:c7:d9:a8:fc:a1:cc:96:d1:96:3e:b9:f9:40:15:d7:1c:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Emit.Lightweight.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:bb:59:ae:4b:dd:35:39:45:f7:bc:f6:e2:b0:1e:00:19:f0:36:76:f6:2d:ec:be:f4:9b:37:6b:e6:0b:22:43
Signer

Actual PE Digest

0d:bb:59:ae:4b:dd:35:39:45:f7:bc:f6:e2:b0:1e:00:19:f0:36:76:f6:2d:ec:be:f4:9b:37:6b:e6:0b:22:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Emit.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

18:28:1b:72:47:99:c5:37:48:9b:75:d3:08:d0:02:43:e3:90:43:ec:ff:ae:b9:47:6f:a5:e1:66:d2:33:c6:4f
Signer

Actual PE Digest

18:28:1b:72:47:99:c5:37:48:9b:75:d3:08:d0:02:43:e3:90:43:ec:ff:ae:b9:47:6f:a5:e1:66:d2:33:c6:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Extensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:4d:94:9b:d4:82:c3:24:c4:a5:6e:67:95:1e:a9:f1:9e:ad:1e:87:d3:41:ed:65:3f:54:65:a8:22:b7:59
Signer

Actual PE Digest

0a:a1:4d:94:9b:d4:82:c3:24:c4:a5:6e:67:95:1e:a9:f1:9e:ad:1e:87:d3:41:ed:65:3f:54:65:a8:22:b7:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Metadata.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:c9:44:60:ba:a2:bc:56:5f:c5:29:c6:0e:c8:ee:a0:4c:1d:33:2f:d5:30:35:b4:71:aa:e3:78:9f:43:4c:58
Signer

Actual PE Digest

c5:c9:44:60:ba:a2:bc:56:5f:c5:29:c6:0e:c8:ee:a0:4c:1d:33:2f:d5:30:35:b4:71:aa:e3:78:9f:43:4c:58

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d6:2b:d4:7c:68:e4:30:df:9e:53:4a:bd:9d:74:b4:81:0e:5d:7d:13:07:ab:3f:2f:a1:d9:78:cc:71:f6:47:87
Signer

Actual PE Digest

d6:2b:d4:7c:68:e4:30:df:9e:53:4a:bd:9d:74:b4:81:0e:5d:7d:13:07:ab:3f:2f:a1:d9:78:cc:71:f6:47:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.TypeExtensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:2f:5b:20:b8:a7:82:de:aa:d4:cf:1b:f3:15:2e:ae:9d:e8:33:77:90:9f:44:c1:d3:16:85:71:71:aa:21:28
Signer

Actual PE Digest

7c:2f:5b:20:b8:a7:82:de:aa:d4:cf:1b:f3:15:2e:ae:9d:e8:33:77:90:9f:44:c1:d3:16:85:71:71:aa:21:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Reflection.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:0a:ab:4e:79:c3:28:93:b0:40:39:79:81:88:55:84:15:e5:c3:41:2b:c8:6c:e9:2f:33:4d:5c:b0:ee:3d:29
Signer

Actual PE Digest

a7:0a:ab:4e:79:c3:28:93:b0:40:39:79:81:88:55:84:15:e5:c3:41:2b:c8:6c:e9:2f:33:4d:5c:b0:ee:3d:29

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Resources.Reader.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:a8:61:9d:1b:ba:a2:f9:09:fc:6b:eb:8d:19:1e:06:ef:23:9b:b9:09:6a:47:7e:cd:92:25:11:a0:de:0d:ec
Signer

Actual PE Digest

c2:a8:61:9d:1b:ba:a2:f9:09:fc:6b:eb:8d:19:1e:06:ef:23:9b:b9:09:6a:47:7e:cd:92:25:11:a0:de:0d:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Resources.ResourceManager.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:56:05:6c:69:54:62:7e:59:5a:fa:13:8e:b2:95:05:0b:8c:42:92:f9:cf:25:a3:0b:55:b0:6f:33:8f:7a:b7
Signer

Actual PE Digest

16:56:05:6c:69:54:62:7e:59:5a:fa:13:8e:b2:95:05:0b:8c:42:92:f9:cf:25:a3:0b:55:b0:6f:33:8f:7a:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Resources.Writer.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:36:8e:85:9e:cc:c3:9d:bf:92:d0:d4:81:b7:4f:a8:c1:28:21:a8:b8:af:a3:5a:c9:72:1b:f5:6b:b4:e7:34
Signer

Actual PE Digest

4d:36:8e:85:9e:cc:c3:9d:bf:92:d0:d4:81:b7:4f:a8:c1:28:21:a8:b8:af:a3:5a:c9:72:1b:f5:6b:b4:e7:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.CompilerServices.Unsafe.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:c4:e5:5a:0d:6c:92:01:79:70:cd:3f:d9:74:fa:fa:f1:7e:09:73:95:bd:d0:79:a0:02:d2:44:68:81:d3:eb
Signer

Actual PE Digest

28:c4:e5:5a:0d:6c:92:01:79:70:cd:3f:d9:74:fa:fa:f1:7e:09:73:95:bd:d0:79:a0:02:d2:44:68:81:d3:eb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.CompilerServices.VisualC.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:72:41:c0:4e:8f:4c:97:6c:6a:7c:b7:4e:ae:0c:36:de:10:05:ec:79:2e:06:89:1e:02:69:74:ec:e5:14:f2
Signer

Actual PE Digest

42:72:41:c0:4e:8f:4c:97:6c:6a:7c:b7:4e:ae:0c:36:de:10:05:ec:79:2e:06:89:1e:02:69:74:ec:e5:14:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Extensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:f0:2a:95:d6:f1:b6:d4:5f:fd:ce:d7:ce:3e:b7:39:41:5e:6d:88:4d:46:84:28:b8:eb:80:c6:ed:8d:fa:0a
Signer

Actual PE Digest

9a:f0:2a:95:d6:f1:b6:d4:5f:fd:ce:d7:ce:3e:b7:39:41:5e:6d:88:4d:46:84:28:b8:eb:80:c6:ed:8d:fa:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Handles.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:e1:3b:cb:29:70:81:7d:77:81:70:a2:6a:6b:2c:ad:5c:be:e5:28:5d:53:43:0c:ea:22:6e:e1:bf:65:c2:f5
Signer

Actual PE Digest

3d:e1:3b:cb:29:70:81:7d:77:81:70:a2:6a:6b:2c:ad:5c:be:e5:28:5d:53:43:0c:ea:22:6e:e1:bf:65:c2:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.InteropServices.RuntimeInformation.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:e7:3a:ff:62:78:72:b5:c8:73:7a:9c:0c:7f:c6:43:90:69:4f:a9:51:f9:71:d2:2b:33:9a:7b:d4:3f:0f:a5
Signer

Actual PE Digest

51:e7:3a:ff:62:78:72:b5:c8:73:7a:9c:0c:7f:c6:43:90:69:4f:a9:51:f9:71:d2:2b:33:9a:7b:d4:3f:0f:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.InteropServices.WindowsRuntime.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:07:bf:fe:24:6d:44:c6:18:30:23:84:40:ff:3c:89:d0:48:0d:a3:da:0c:d7:26:75:46:74:60:c0:61:0e:ec
Signer

Actual PE Digest

4b:07:bf:fe:24:6d:44:c6:18:30:23:84:40:ff:3c:89:d0:48:0d:a3:da:0c:d7:26:75:46:74:60:c0:61:0e:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.InteropServices.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:de:0f:f8:28:f7:35:85:de:28:33:65:3c:a0:12:40:5b:a5:d4:ad:b2:63:43:a3:cf:c5:4c:17:a8:50:ac:d7
Signer

Actual PE Digest

e0:de:0f:f8:28:f7:35:85:de:28:33:65:3c:a0:12:40:5b:a5:d4:ad:b2:63:43:a3:cf:c5:4c:17:a8:50:ac:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Intrinsics.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:14:04:0a:1f:d5:17:1b:ee:4c:b8:1b:71:a5:e5:1c:4e:7d:fe:3e:77:62:18:ab:b0:be:d7:4e:a0:58:4a:00
Signer

Actual PE Digest

02:14:04:0a:1f:d5:17:1b:ee:4c:b8:1b:71:a5:e5:1c:4e:7d:fe:3e:77:62:18:ab:b0:be:d7:4e:a0:58:4a:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Loader.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:1e:f8:fe:75:5e:0e:e2:76:ea:27:80:e8:57:da:71:f9:92:74:e1:d5:cf:6e:ed:a9:ff:c2:22:12:49:4a:a0
Signer

Actual PE Digest

75:1e:f8:fe:75:5e:0e:e2:76:ea:27:80:e8:57:da:71:f9:92:74:e1:d5:cf:6e:ed:a9:ff:c2:22:12:49:4a:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Numerics.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:31:ca:87:de:9c:fb:a9:4d:5c:24:af:aa:4a:66:6e:84:47:b0:e2:36:bc:91:4d:14:91:fc:e4:be:42:87:49
Signer

Actual PE Digest

c0:31:ca:87:de:9c:fb:a9:4d:5c:24:af:aa:4a:66:6e:84:47:b0:e2:36:bc:91:4d:14:91:fc:e4:be:42:87:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Serialization.Formatters.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:15:4d:d7:87:ef:29:43:6f:ca:18:26:ae:44:b3:d3:d8:64:5b:76:23:79:ea:2d:97:c1:f3:21:87:f3:ed:b4
Signer

Actual PE Digest

ad:15:4d:d7:87:ef:29:43:6f:ca:18:26:ae:44:b3:d3:d8:64:5b:76:23:79:ea:2d:97:c1:f3:21:87:f3:ed:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Serialization.Json.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:aa:3b:c4:ef:2f:71:38:98:40:be:a3:72:05:7a:b3:f6:c0:98:ee:a5:c9:97:d4:67:e4:48:15:ad:92:ba:df
Signer

Actual PE Digest

30:aa:3b:c4:ef:2f:71:38:98:40:be:a3:72:05:7a:b3:f6:c0:98:ee:a5:c9:97:d4:67:e4:48:15:ad:92:ba:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Serialization.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:be:76:db:99:65:d0:f6:25:9d:32:af:77:2e:95:fd:57:95:8a:27:cd:17:f1:c2:86:f3:d3:e7:0d:4f:e5:33
Signer

Actual PE Digest

8f:be:76:db:99:65:d0:f6:25:9d:32:af:77:2e:95:fd:57:95:8a:27:cd:17:f1:c2:86:f3:d3:e7:0d:4f:e5:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Serialization.Xml.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:75:de:23:2c:6a:81:b6:b4:c6:73:52:d8:ba:61:9c:6b:08:76:38:26:33:16:d7:b3:ca:2d:cc:28:a8:a6:a1
Signer

Actual PE Digest

44:75:de:23:2c:6a:81:b6:b4:c6:73:52:d8:ba:61:9c:6b:08:76:38:26:33:16:d7:b3:ca:2d:cc:28:a8:a6:a1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.Serialization.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:41:8d:86:1e:68:7d:b5:61:a9:71:7a:c6:28:08:a3:c9:62:b8:ee:d8:85:c8:a6:26:be:6d:6b:30:64:f5:ec
Signer

Actual PE Digest

d0:41:8d:86:1e:68:7d:b5:61:a9:71:7a:c6:28:08:a3:c9:62:b8:ee:d8:85:c8:a6:26:be:6d:6b:30:64:f5:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.WindowsRuntime.UI.Xaml.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:3e:7c:29:14:c0:75:ae:18:86:c2:7f:c0:d9:a0:8a:03:58:c6:b7:fd:7e:8e:01:09:25:4c:a5:6f:f4:21:ea
Signer

Actual PE Digest

90:3e:7c:29:14:c0:75:ae:18:86:c2:7f:c0:d9:a0:8a:03:58:c6:b7:fd:7e:8e:01:09:25:4c:a5:6f:f4:21:ea

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.WindowsRuntime.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:b7:05:dc:8a:bb:6e:56:18:da:be:52:94:b6:49:6c:2a:aa:7e:53:ac:37:91:f0:97:fa:3d:b6:56:cb:e7:01
Signer

Actual PE Digest

f0:b7:05:dc:8a:bb:6e:56:18:da:be:52:94:b6:49:6c:2a:aa:7e:53:ac:37:91:f0:97:fa:3d:b6:56:cb:e7:01

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Runtime.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:76:cd:40:8c:56:4e:97:92:b8:f8:13:f3:35:f0:3d:bf:60:f7:8d:45:6a:da:79:2a:89:cc:4b:12:1e:d9:ab
Signer

Actual PE Digest

be:76:cd:40:8c:56:4e:97:92:b8:f8:13:f3:35:f0:3d:bf:60:f7:8d:45:6a:da:79:2a:89:cc:4b:12:1e:d9:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.AccessControl.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:eb:8e:43:5b:e1:da:9d:85:f6:bd:c4:19:ff:0e:b6:57:43:56:44:eb:5c:3e:12:2d:10:f5:21:d5:f6:c3:61
Signer

Actual PE Digest

08:eb:8e:43:5b:e1:da:9d:85:f6:bd:c4:19:ff:0e:b6:57:43:56:44:eb:5c:3e:12:2d:10:f5:21:d5:f6:c3:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Claims.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a2:4b:f5:e9:8e:cd:4d:b4:aa:89:42:c9:58:a4:1d:d5:19:28:a6:a5:56:75:8d:f8:69:23:99:02:84:94:bf
Signer

Actual PE Digest

13:a2:4b:f5:e9:8e:cd:4d:b4:aa:89:42:c9:58:a4:1d:d5:19:28:a6:a5:56:75:8d:f8:69:23:99:02:84:94:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.Algorithms.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:9b:d8:ef:f7:51:93:3c:e5:98:9e:92:82:35:33:b1:f6:23:dd:1e:06:dc:51:c7:91:a0:5c:54:69:8b:b8:57
Signer

Actual PE Digest

4b:9b:d8:ef:f7:51:93:3c:e5:98:9e:92:82:35:33:b1:f6:23:dd:1e:06:dc:51:c7:91:a0:5c:54:69:8b:b8:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 533KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.Cng.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:a6:d1:6e:52:52:a6:c0:6e:85:14:5c:e1:0f:af:df:b6:6b:17:0a:c8:3d:ce:21:c5:6b:89:39:27:83:ad:40
Signer

Actual PE Digest

3c:a6:d1:6e:52:52:a6:c0:6e:85:14:5c:e1:0f:af:df:b6:6b:17:0a:c8:3d:ce:21:c5:6b:89:39:27:83:ad:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 337KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.Csp.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:7a:20:39:dc:2a:da:a5:58:ae:35:5b:de:36:e5:ca:ea:85:f2:96:c9:97:25:fe:50:01:fe:c4:d2:5b:18:45
Signer

Actual PE Digest

ad:7a:20:39:dc:2a:da:a5:58:ae:35:5b:de:36:e5:ca:ea:85:f2:96:c9:97:25:fe:50:01:fe:c4:d2:5b:18:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.Encoding.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:e9:02:4b:5b:a6:42:4d:7a:0e:29:03:30:2f:23:55:98:e8:43:73:0c:00:b2:34:30:29:0b:83:91:4b:88:55
Signer

Actual PE Digest

02:e9:02:4b:5b:a6:42:4d:7a:0e:29:03:30:2f:23:55:98:e8:43:73:0c:00:b2:34:30:29:0b:83:91:4b:88:55

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.OpenSsl.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:82:de:42:a4:73:01:f5:f0:cc:47:46:20:3c:d8:4b:6c:1a:8c:82:32:6d:79:19:87:80:c0:9f:aa:cd:5f:ee
Signer

Actual PE Digest

1c:82:de:42:a4:73:01:f5:f0:cc:47:46:20:3c:d8:4b:6c:1a:8c:82:32:6d:79:19:87:80:c0:9f:aa:cd:5f:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.Primitives.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:34:28:7f:58:b8:9a:b5:93:dc:f1:ba:d9:c0:61:62:43:ff:f8:81:ab:5b:32:fc:22:12:d6:70:c0:8b:4b:c9
Signer

Actual PE Digest

ac:34:28:7f:58:b8:9a:b5:93:dc:f1:ba:d9:c0:61:62:43:ff:f8:81:ab:5b:32:fc:22:12:d6:70:c0:8b:4b:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Cryptography.X509Certificates.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ca:a6:d0:f0:2f:08:16:4e:33:57:1e:f3:f3:a7:98:6d:53:13:44:c0:38:e6:3c:29:32:8a:de:ee:56:c5:16:77
Signer

Actual PE Digest

ca:a6:d0:f0:2f:08:16:4e:33:57:1e:f3:f3:a7:98:6d:53:13:44:c0:38:e6:3c:29:32:8a:de:ee:56:c5:16:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Principal.Windows.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:63:3f:ef:1d:5f:f1:31:76:df:32:f6:5e:1f:15:81:d7:ce:39:67:4b:16:4b:1a:13:ca:00:be:70:aa:6b:34
Signer

Actual PE Digest

37:63:3f:ef:1d:5f:f1:31:76:df:32:f6:5e:1f:15:81:d7:ce:39:67:4b:16:4b:1a:13:ca:00:be:70:aa:6b:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.Principal.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:9b:13:e6:8b:71:e7:17:a1:32:10:9c:6c:d3:f6:52:25:e0:01:c1:62:d7:10:32:f7:af:bb:8c:4e:c7:c7:9c
Signer

Actual PE Digest

d0:9b:13:e6:8b:71:e7:17:a1:32:10:9c:6c:d3:f6:52:25:e0:01:c1:62:d7:10:32:f7:af:bb:8c:4e:c7:c7:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.SecureString.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:6b:e7:c7:58:79:90:9a:65:83:aa:eb:16:98:a0:2b:ec:73:b5:92:0d:85:bd:20:53:2d:e4:f0:d9:56:d0:19
Signer

Actual PE Digest

05:6b:e7:c7:58:79:90:9a:65:83:aa:eb:16:98:a0:2b:ec:73:b5:92:0d:85:bd:20:53:2d:e4:f0:d9:56:d0:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Security.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:33:7a:15:ca:3f:95:50:30:29:1c:40:39:e5:62:24:c7:86:db:b6:79:7f:34:3e:23:90:83:d4:cd:83:26:4f
Signer

Actual PE Digest

2e:33:7a:15:ca:3f:95:50:30:29:1c:40:39:e5:62:24:c7:86:db:b6:79:7f:34:3e:23:90:83:d4:cd:83:26:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ServiceModel.Web.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:99:cf:08:fb:93:f2:eb:a4:9e:5b:34:03:c9:61:bc:02:b6:c0:a9:47:bd:69:69:a3:e0:34:ad:44:0a:c5:c9
Signer

Actual PE Digest

e0:99:cf:08:fb:93:f2:eb:a4:9e:5b:34:03:c9:61:bc:02:b6:c0:a9:47:bd:69:69:a3:e0:34:ad:44:0a:c5:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ServiceProcess.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:81:4a:3a:95:c3:de:d8:b9:06:46:ec:31:fa:0f:0e:1b:86:83:a9:de:fc:1d:2b:de:1a:9d:2e:d4:56:b5:8d
Signer

Actual PE Digest

d3:81:4a:3a:95:c3:de:d8:b9:06:46:ec:31:fa:0f:0e:1b:86:83:a9:de:fc:1d:2b:de:1a:9d:2e:d4:56:b5:8d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.Encoding.CodePages.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:fb:4c:13:64:b3:6e:5c:f8:65:49:da:44:a9:c9:0b:8c:a6:17:fc:a4:10:f7:c2:95:84:00:a3:f2:95:01:8f
Signer

Actual PE Digest

cc:fb:4c:13:64:b3:6e:5c:f8:65:49:da:44:a9:c9:0b:8c:a6:17:fc:a4:10:f7:c2:95:84:00:a3:f2:95:01:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.Encoding.Extensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:09:6d:06:62:a2:80:eb:41:b7:0d:94:7f:91:2a:ba:36:be:c2:60:67:d5:09:a1:81:26:cb:48:f1:ed:36:05
Signer

Actual PE Digest

0e:09:6d:06:62:a2:80:eb:41:b7:0d:94:7f:91:2a:ba:36:be:c2:60:67:d5:09:a1:81:26:cb:48:f1:ed:36:05

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.Encoding.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

22:98:bd:83:c0:a5:05:a6:a5:c3:f2:27:bd:03:d9:5a:02:37:40:e2:2d:80:58:97:56:0e:71:b0:6e:c8:20:13
Signer

Actual PE Digest

22:98:bd:83:c0:a5:05:a6:a5:c3:f2:27:bd:03:d9:5a:02:37:40:e2:2d:80:58:97:56:0e:71:b0:6e:c8:20:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.Encodings.Web.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:78:d6:95:6c:f0:ad:75:ca:1b:be:27:a0:4f:01:16:c5:0c:32:c6:58:5b:f6:1e:9b:50:75:ba:63:26:71:8c
Signer

Actual PE Digest

5b:78:d6:95:6c:f0:ad:75:ca:1b:be:27:a0:4f:01:16:c5:0c:32:c6:58:5b:f6:1e:9b:50:75:ba:63:26:71:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.Json.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:8f:c6:72:54:cc:3e:80:71:cd:70:0e:fe:0f:13:e1:00:d8:01:d5:a6:d9:26:2d:4b:a5:59:f0:41:ed:09:4f
Signer

Actual PE Digest

d7:8f:c6:72:54:cc:3e:80:71:cd:70:0e:fe:0f:13:e1:00:d8:01:d5:a6:d9:26:2d:4b:a5:59:f0:41:ed:09:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Text.RegularExpressions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:41:ef:2c:e4:82:7c:a6:c7:e0:88:40:75:33:2a:ab:b7:d4:c3:93:b2:fd:1a:fb:21:9c:c1:4f:60:3e:b2:4d
Signer

Actual PE Digest

ab:41:ef:2c:e4:82:7c:a6:c7:e0:88:40:75:33:2a:ab:b7:d4:c3:93:b2:fd:1a:fb:21:9c:c1:4f:60:3e:b2:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Channels.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:a3:bf:a0:9a:d8:96:a3:34:01:26:de:9a:df:cb:c5:07:3a:9a:4d:f0:d6:0a:35:a5:88:1a:8b:84:85:2d:73
Signer

Actual PE Digest

00:a3:bf:a0:9a:d8:96:a3:34:01:26:de:9a:df:cb:c5:07:3a:9a:4d:f0:d6:0a:35:a5:88:1a:8b:84:85:2d:73

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Overlapped.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:5d:8e:15:33:93:89:91:22:a5:b7:24:b3:5f:80:16:0d:cf:89:bf:50:c6:c6:0f:f3:61:78:5f:7b:86:86:d7
Signer

Actual PE Digest

c4:5d:8e:15:33:93:89:91:22:a5:b7:24:b3:5f:80:16:0d:cf:89:bf:50:c6:c6:0f:f3:61:78:5f:7b:86:86:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Tasks.Dataflow.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:b9:4f:75:79:e9:c0:11:d1:cb:2a:2c:b8:3b:ed:fa:01:0a:17:d4:a5:8e:f1:7a:d6:58:00:53:52:a3:b9:10
Signer

Actual PE Digest

54:b9:4f:75:79:e9:c0:11:d1:cb:2a:2c:b8:3b:ed:fa:01:0a:17:d4:a5:8e:f1:7a:d6:58:00:53:52:a3:b9:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Tasks.Extensions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:37:4c:98:61:03:16:db:f8:cf:8a:99:eb:3d:f7:84:69:25:80:2a:b9:98:62:ea:ac:75:5f:cd:8f:a7:f0:15
Signer

Actual PE Digest

fd:37:4c:98:61:03:16:db:f8:cf:8a:99:eb:3d:f7:84:69:25:80:2a:b9:98:62:ea:ac:75:5f:cd:8f:a7:f0:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Tasks.Parallel.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:4f:40:f1:0e:22:2b:b8:7e:b5:58:75:5f:3d:f0:7c:dd:f3:86:e0:d5:f9:c0:dc:bc:82:88:06:1f:8b:ff:68
Signer

Actual PE Digest

1e:4f:40:f1:0e:22:2b:b8:7e:b5:58:75:5f:3d:f0:7c:dd:f3:86:e0:d5:f9:c0:dc:bc:82:88:06:1f:8b:ff:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Tasks.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:12:6c:b8:8a:da:da:a5:07:d9:30:13:56:92:98:ed:67:d3:32:a1:22:24:38:96:4d:36:91:dc:03:5c:d7:19
Signer

Actual PE Digest

e8:12:6c:b8:8a:da:da:a5:07:d9:30:13:56:92:98:ed:67:d3:32:a1:22:24:38:96:4d:36:91:dc:03:5c:d7:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Thread.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:77:24:0b:41:e0:b9:b5:ff:26:fd:aa:7f:01:99:26:de:0a:47:00:85:8b:23:99:6d:53:84:74:01:ce:00:68
Signer

Actual PE Digest

2b:77:24:0b:41:e0:b9:b5:ff:26:fd:aa:7f:01:99:26:de:0a:47:00:85:8b:23:99:6d:53:84:74:01:ce:00:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.ThreadPool.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:8e:a0:80:fe:96:2b:4d:a7:0e:55:30:0f:b5:48:a9:52:86:33:f4:e6:cc:04:01:43:58:0d:c0:58:18:f3:93
Signer

Actual PE Digest

df:8e:a0:80:fe:96:2b:4d:a7:0e:55:30:0f:b5:48:a9:52:86:33:f4:e6:cc:04:01:43:58:0d:c0:58:18:f3:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.Timer.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:76:d6:5f:2b:53:bb:4f:20:25:30:c9:54:26:f4:61:87:f3:a0:65:49:50:4f:fa:57:fe:77:94:2e:a6:1b:4b
Signer

Actual PE Digest

80:76:d6:5f:2b:53:bb:4f:20:25:30:c9:54:26:f4:61:87:f3:a0:65:49:50:4f:fa:57:fe:77:94:2e:a6:1b:4b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Threading.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:10:04:03:6b:12:88:91:18:80:e8:3d:4a:8f:76:88:c7:dd:b9:8d:a0:fb:56:8e:cf:88:65:ca:e5:2d:d2:fe
Signer

Actual PE Digest

14:10:04:03:6b:12:88:91:18:80:e8:3d:4a:8f:76:88:c7:dd:b9:8d:a0:fb:56:8e:cf:88:65:ca:e5:2d:d2:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Transactions.Local.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:94:56:e0:58:00:9b:c6:94:c3:67:4e:34:1c:3d:bd:58:2b:fb:9f:17:48:61:03:b2:49:48:d3:c9:28:7a:10
Signer

Actual PE Digest

60:94:56:e0:58:00:9b:c6:94:c3:67:4e:34:1c:3d:bd:58:2b:fb:9f:17:48:61:03:b2:49:48:d3:c9:28:7a:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Transactions.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:63:f8:e3:e0:d4:6b:f1:a6:4e:9e:2b:f5:89:c0:41:a4:21:1e:3e:d1:a3:40:fd:76:56:3c:35:ad:b8:b9:47
Signer

Actual PE Digest

d8:63:f8:e3:e0:d4:6b:f1:a6:4e:9e:2b:f5:89:c0:41:a4:21:1e:3e:d1:a3:40:fd:76:56:3c:35:ad:b8:b9:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.ValueTuple.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e9:63:cd:7c:cc:b1:b2:a3:41:0e:3f:ae:3e:80:bd:e9:cf:17:59:cc:a7:82:73:d5:fe:46:b4:c5:a8:22:76:2b
Signer

Actual PE Digest

e9:63:cd:7c:cc:b1:b2:a3:41:0e:3f:ae:3e:80:bd:e9:cf:17:59:cc:a7:82:73:d5:fe:46:b4:c5:a8:22:76:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Web.HttpUtility.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:d1:b7:0b:b0:0e:3f:18:cd:08:04:38:c5:a9:c6:60:99:6f:47:f6:f3:32:4d:20:8a:62:dd:94:80:b1:50:f4
Signer

Actual PE Digest

76:d1:b7:0b:b0:0e:3f:18:cd:08:04:38:c5:a9:c6:60:99:6f:47:f6:f3:32:4d:20:8a:62:dd:94:80:b1:50:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Web.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:55:72:bc:cf:6b:7c:d5:99:14:09:bc:f5:61:ab:49:76:39:69:23:f6:d6:68:9d:fd:ab:16:c4:17:cb:80:46
Signer

Actual PE Digest

06:55:72:bc:cf:6b:7c:d5:99:14:09:bc:f5:61:ab:49:76:39:69:23:f6:d6:68:9d:fd:ab:16:c4:17:cb:80:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Windows.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:14:76:98:0a:3c:67:42:70:d8:1b:19:b8:2d:de:a3:3f:2c:d2:af:7b:0f:3c:00:46:f6:42:a4:0f:2a:ee:f7
Signer

Actual PE Digest

f1:14:76:98:0a:3c:67:42:70:d8:1b:19:b8:2d:de:a3:3f:2c:d2:af:7b:0f:3c:00:46:f6:42:a4:0f:2a:ee:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.Linq.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:6a:6f:b1:51:eb:7c:13:7f:7d:93:15:98:85:b3:c4:f1:f4:13:cf:86:39:20:8c:dd:91:f2:6a:f3:9e:79:27
Signer

Actual PE Digest

11:6a:6f:b1:51:eb:7c:13:7f:7d:93:15:98:85:b3:c4:f1:f4:13:cf:86:39:20:8c:dd:91:f2:6a:f3:9e:79:27

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.ReaderWriter.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:59:69:16:3f:b6:ee:15:cc:37:6f:d2:66:86:ac:36:92:00:6f:f7:82:13:8e:8e:3a:61:30:45:12:d9:8f:23
Signer

Actual PE Digest

9e:59:69:16:3f:b6:ee:15:cc:37:6f:d2:66:86:ac:36:92:00:6f:f7:82:13:8e:8e:3a:61:30:45:12:d9:8f:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.Serialization.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c9:72:94:22:2b:71:85:92:5e:07:d8:ae:81:66:ab:9c:42:96:aa:f3:f4:a1:fb:5b:0f:24:4e:24:94:07:6a:c0
Signer

Actual PE Digest

c9:72:94:22:2b:71:85:92:5e:07:d8:ae:81:66:ab:9c:42:96:aa:f3:f4:a1:fb:5b:0f:24:4e:24:94:07:6a:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.XDocument.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:e0:4e:89:5f:66:5d:8f:fc:dc:2d:88:e7:59:4c:78:1c:ac:4f:d1:86:ef:98:7b:96:43:d8:13:a0:52:01:6c
Signer

Actual PE Digest

fb:e0:4e:89:5f:66:5d:8f:fc:dc:2d:88:e7:59:4c:78:1c:ac:4f:d1:86:ef:98:7b:96:43:d8:13:a0:52:01:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.XPath.XDocument.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:50:09:11:19:df:7c:41:85:45:aa:94:a2:55:ee:b9:1b:e9:81:32:e0:e8:e1:07:9f:1a:43:95:34:75:b8:cb
Signer

Actual PE Digest

4c:50:09:11:19:df:7c:41:85:45:aa:94:a2:55:ee:b9:1b:e9:81:32:e0:e8:e1:07:9f:1a:43:95:34:75:b8:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.XPath.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:f0:a1:65:7a:e3:c3:c9:bb:1b:dd:65:48:c5:7e:f8:ae:8e:44:a2:fd:0a:71:5b:9b:22:d1:8e:15:21:3f:7a
Signer

Actual PE Digest

d4:f0:a1:65:7a:e3:c3:c9:bb:1b:dd:65:48:c5:7e:f8:ae:8e:44:a2:fd:0a:71:5b:9b:22:d1:8e:15:21:3f:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.XmlDocument.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:df:fa:62:d5:5f:8a:bc:36:eb:46:48:79:e3:64:72:bf:e7:44:e5:7f:d9:f0:08:0b:cf:78:3b:1d:c5:2d:6d
Signer

Actual PE Digest

07:df:fa:62:d5:5f:8a:bc:36:eb:46:48:79:e3:64:72:bf:e7:44:e5:7f:d9:f0:08:0b:cf:78:3b:1d:c5:2d:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.XmlSerializer.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:f8:01:a2:f6:2f:8c:ef:3b:63:5b:c4:fd:71:c8:5e:0f:11:ec:a4:f0:93:5d:2f:1e:83:04:dd:24:8d:fe:5b
Signer

Actual PE Digest

74:f8:01:a2:f6:2f:8c:ef:3b:63:5b:c4:fd:71:c8:5e:0f:11:ec:a4:f0:93:5d:2f:1e:83:04:dd:24:8d:fe:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.Xml.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:05:4f:a0:0a:34:99:8e:dc:6d:b8:c6:73:76:fd:38:07:0d:df:9d:68:a3:eb:56:61:f0:43:7e:19:23:fc:d1
Signer

Actual PE Digest

f6:05:4f:a0:0a:34:99:8e:dc:6d:b8:c6:73:76:fd:38:07:0d:df:9d:68:a3:eb:56:61:f0:43:7e:19:23:fc:d1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/System.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:02:12:01:81:d0:59:54:a1:6d:28:ee:ac:9e:54:3c:71:62:2a:eb:2d:4e:49:fb:66:fc:72:e7:e0:7a:40:d6
Signer

Actual PE Digest

a5:02:12:01:81:d0:59:54:a1:6d:28:ee:ac:9e:54:3c:71:62:2a:eb:2d:4e:49:fb:66:fc:72:e7:e0:7a:40:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/UGCToolkit.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 471KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/WindowsBase.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:23:ab:20:72:d9:a1:1d:20:63:a8:87:75:8a:87:33:e1:60:17:62:65:33:c9:bd:db:e9:91:3f:ae:af:79:ba
Signer

Actual PE Digest

c5:23:ab:20:72:d9:a1:1d:20:63:a8:87:75:8a:87:33:e1:60:17:62:65:33:c9:bd:db:e9:91:3f:ae:af:79:ba

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-console-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:01:8f:1a:1e:e5:e3:d8:12:34:d0:63:8c:e3:c0:73:5e:2c:98:83:9a:54:39:85:48:6f:ed:ce:f5:13:0b:2e
Signer

Actual PE Digest

78:01:8f:1a:1e:e5:e3:d8:12:34:d0:63:8c:e3:c0:73:5e:2c:98:83:9a:54:39:85:48:6f:ed:ce:f5:13:0b:2e

Digest Algorithm

sha256

PE Digest Matches

true

1f:1a:e3:ca:4c:2a:c2:0d:00:a4:8c:51:18:6b:d2:53:27:5d:be:bb
Signer

Actual PE Digest

1f:1a:e3:ca:4c:2a:c2:0d:00:a4:8c:51:18:6b:d2:53:27:5d:be:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

AllocConsole
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
WriteConsoleW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-datetime-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:2c:95:94:4c:b1:1b:99:46:db:28:c1:f2:10:db:14:7b:5d:6a:8b:30:76:fc:f3:a3:cc:f0:15:b0:ba:a6:2f
Signer

Actual PE Digest

af:2c:95:94:4c:b1:1b:99:46:db:28:c1:f2:10:db:14:7b:5d:6a:8b:30:76:fc:f3:a3:cc:f0:15:b0:ba:a6:2f

Digest Algorithm

sha256

PE Digest Matches

true

1c:49:85:91:05:43:17:cb:f1:63:7f:31:a2:21:c8:d3:38:1c:0d:59
Signer

Actual PE Digest

1c:49:85:91:05:43:17:cb:f1:63:7f:31:a2:21:c8:d3:38:1c:0d:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetDateFormatA
GetDateFormatW
GetTimeFormatA
GetTimeFormatW

Sections

.text
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-debug-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:92:28:8a:ca:d5:86:28:22:34:3d:dc:71:26:1f:9d:a6:2d:8a:4f:4c:5c:6f:29:5a:3e:64:d1:ad:e3:1b:51
Signer

Actual PE Digest

e7:92:28:8a:ca:d5:86:28:22:34:3d:dc:71:26:1f:9d:a6:2d:8a:4f:4c:5c:6f:29:5a:3e:64:d1:ad:e3:1b:51

Digest Algorithm

sha256

PE Digest Matches

true

6f:d7:34:01:66:da:08:66:42:62:d4:44:cd:4d:29:4c:c7:3b:16:68
Signer

Actual PE Digest

6f:d7:34:01:66:da:08:66:42:62:d4:44:cd:4d:29:4c:c7:3b:16:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW

Sections

.text
Size: 1024B - Virtual size: 539B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-errorhandling-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:bd:7c:32:14:8c:fe:34:06:44:f9:bb:b2:e3:0b:5f:a3:a0:72:57:55:36:7c:38:4e:ec:57:3e:06:0a:70:ca
Signer

Actual PE Digest

b3:bd:7c:32:14:8c:fe:34:06:44:f9:bb:b2:e3:0b:5f:a3:a0:72:57:55:36:7c:38:4e:ec:57:3e:06:0a:70:ca

Digest Algorithm

sha256

PE Digest Matches

true

9b:f6:ae:be:57:bd:40:80:95:1a:31:a9:b5:23:73:64:80:3d:61:7c
Signer

Actual PE Digest

9b:f6:ae:be:57:bd:40:80:95:1a:31:a9:b5:23:73:64:80:3d:61:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetErrorMode
GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

Sections

.text
Size: 1024B - Virtual size: 710B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-file-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:c4:35:21:a2:04:3b:c9:c5:7f:4d:4b:6c:da:d0:38:aa:75:92:91:c1:c5:66:86:8f:32:c8:78:79:05:e4:74
Signer

Actual PE Digest

00:c4:35:21:a2:04:3b:c9:c5:7f:4d:4b:6c:da:d0:38:aa:75:92:91:c1:c5:66:86:8f:32:c8:78:79:05:e4:74

Digest Algorithm

sha256

PE Digest Matches

true

6d:7c:e4:74:3d:15:aa:58:38:90:db:48:88:42:62:88:c5:8a:8a:8e
Signer

Actual PE Digest

6d:7c:e4:74:3d:15:aa:58:38:90:db:48:88:42:62:88:c5:8a:8a:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CompareFileTime
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DefineDosDeviceW
DeleteFileA
DeleteFileW
DeleteVolumeMountPointW
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLogicalDriveStringsW
GetLogicalDrives
GetLongPathNameA
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-file-l1-2-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:8c:97:81:85:48:aa:1d:d4:f2:e3:3e:90:c1:c6:db:8f:cb:ab:59:89:3c:de:f2:e9:8e:7e:b7:37:31:4c:2d
Signer

Actual PE Digest

9d:8c:97:81:85:48:aa:1d:d4:f2:e3:3e:90:c1:c6:db:8f:cb:ab:59:89:3c:de:f2:e9:8e:7e:b7:37:31:4c:2d

Digest Algorithm

sha256

PE Digest Matches

true

c7:5a:78:70:ff:34:aa:28:49:4d:2c:57:ae:ad:99:8b:9a:85:88:74
Signer

Actual PE Digest

c7:5a:78:70:ff:34:aa:28:49:4d:2c:57:ae:ad:99:8b:9a:85:88:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateFile2
GetTempPathW
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

Sections

.text
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-file-l2-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:ce:c2:e0:6e:f8:7f:0a:cf:3a:5b:44:ba:ed:d5:c2:a1:a7:dd:90:87:4e:3e:15:a0:56:c5:06:b1:c7:85:cc
Signer

Actual PE Digest

7e:ce:c2:e0:6e:f8:7f:0a:cf:3a:5b:44:ba:ed:d5:c2:a1:a7:dd:90:87:4e:3e:15:a0:56:c5:06:b1:c7:85:cc

Digest Algorithm

sha256

PE Digest Matches

true

78:3a:91:1b:dd:8f:2c:2f:d3:a3:7d:86:9c:dd:87:9c:03:05:b4:b4
Signer

Actual PE Digest

78:3a:91:1b:dd:8f:2c:2f:d3:a3:7d:86:9c:dd:87:9c:03:05:b4:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CopyFile2
CopyFileExW
CreateDirectoryExW
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
MoveFileExW
MoveFileWithProgressW
ReOpenFile
ReadDirectoryChangesW
ReplaceFileW

Sections

.text
Size: 1024B - Virtual size: 893B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-handle-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:29:82:a9:07:32:c9:dd:95:e1:2d:ac:d6:88:12:65:ad:a0:ed:14:92:66:ef:2a:89:ad:c4:c7:fc:e2:c4:7b
Signer

Actual PE Digest

b3:29:82:a9:07:32:c9:dd:95:e1:2d:ac:d6:88:12:65:ad:a0:ed:14:92:66:ef:2a:89:ad:c4:c7:fc:e2:c4:7b

Digest Algorithm

sha256

PE Digest Matches

true

3f:32:f2:4a:32:77:c7:b4:c2:76:97:8f:6b:5c:71:99:fe:4e:c2:0e
Signer

Actual PE Digest

3f:32:f2:4a:32:77:c7:b4:c2:76:97:8f:6b:5c:71:99:fe:4e:c2:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CloseHandle
CompareObjectHandles
DuplicateHandle
GetHandleInformation
SetHandleInformation

Sections

.text
Size: 1024B - Virtual size: 607B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-heap-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:fd:cd:0d:02:b1:73:f7:b5:2d:8f:6a:60:f9:7e:2b:7b:8b:52:af:9a:68:ed:d3:51:2e:5a:ab:37:70:1d:f5
Signer

Actual PE Digest

0a:fd:cd:0d:02:b1:73:f7:b5:2d:8f:6a:60:f9:7e:2b:7b:8b:52:af:9a:68:ed:d3:51:2e:5a:ab:37:70:1d:f5

Digest Algorithm

sha256

PE Digest Matches

true

47:78:05:72:78:49:45:96:58:01:fb:ef:6b:52:d2:51:0b:ee:77:b8
Signer

Actual PE Digest

47:78:05:72:78:49:45:96:58:01:fb:ef:6b:52:d2:51:0b:ee:77:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetProcessHeap
GetProcessHeaps
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapSize
HeapSummary
HeapUnlock
HeapValidate
HeapWalk

Sections

.text
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-interlocked-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:ba:ca:fd:b1:e3:f6:6e:41:1d:89:2b:d7:34:51:5c:30:ee:5f:90:5e:49:24:67:2e:ba:88:36:5c:1f:63:55
Signer

Actual PE Digest

43:ba:ca:fd:b1:e3:f6:6e:41:1d:89:2b:d7:34:51:5c:30:ee:5f:90:5e:49:24:67:2e:ba:88:36:5c:1f:63:55

Digest Algorithm

sha256

PE Digest Matches

true

7d:aa:52:4d:98:7c:0a:aa:11:33:5e:75:9f:40:7b:a8:bf:cd:77:cb
Signer

Actual PE Digest

7d:aa:52:4d:98:7c:0a:aa:11:33:5e:75:9f:40:7b:a8:bf:cd:77:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

InitializeSListHead
InterlockedCompareExchange
InterlockedCompareExchange64
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedFlushSList
InterlockedIncrement
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-libraryloader-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:67:8f:9d:8b:64:26:b6:50:45:14:4d:a8:58:14:21:d7:75:1d:4d:bf:90:46:16:10:01:cd:8f:aa:b0:1f:f7
Signer

Actual PE Digest

b7:67:8f:9d:8b:64:26:b6:50:45:14:4d:a8:58:14:21:d7:75:1d:4d:bf:90:46:16:10:01:cd:8f:aa:b0:1f:f7

Digest Algorithm

sha256

PE Digest Matches

true

8b:9a:c0:f8:b6:9e:4a:89:bd:33:82:f4:99:5f:54:27:0d:38:0c:62
Signer

Actual PE Digest

8b:9a:c0:f8:b6:9e:4a:89:bd:33:82:f4:99:5f:54:27:0d:38:0c:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

AddDllDirectory
DisableThreadLibraryCalls
FindResourceExW
FindStringOrdinal
FreeLibrary
FreeLibraryAndExitThread
FreeResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
LoadResource
LoadStringA
LoadStringW
LockResource
RemoveDllDirectory
SetDefaultDllDirectories
SizeofResource

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-localization-l1-2-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:fd:93:90:2f:62:5a:8c:a9:17:2f:38:d4:53:83:78:49:3d:28:7e:b0:0a:13:5d:81:27:49:1e:b9:b1:32:7c
Signer

Actual PE Digest

cd:fd:93:90:2f:62:5a:8c:a9:17:2f:38:d4:53:83:78:49:3d:28:7e:b0:0a:13:5d:81:27:49:1e:b9:b1:32:7c

Digest Algorithm

sha256

PE Digest Matches

true

b5:c8:23:76:1e:eb:6a:89:52:d9:4d:5c:c3:0f:e6:f4:1e:ae:05:15
Signer

Actual PE Digest

b5:c8:23:76:1e:eb:6a:89:52:d9:4d:5c:c3:0f:e6:f4:1e:ae:05:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ConvertDefaultLocale
EnumSystemGeoID
EnumSystemLocalesA
EnumSystemLocalesW
FindNLSString
FindNLSStringEx
FormatMessageA
FormatMessageW
GetACP
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetCalendarInfoW
GetFileMUIInfo
GetFileMUIPath
GetGeoInfoW
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetNLSVersion
GetNLSVersionEx
GetOEMCP
GetProcessPreferredUILanguages
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemPreferredUILanguages
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadUILanguage
GetUILanguageInfo
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetUserGeoID
GetUserPreferredUILanguages
IdnToAscii
IdnToUnicode
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
IsValidNLSVersion
LCMapStringA
LCMapStringEx
LCMapStringW
LocaleNameToLCID
ResolveLocaleName
SetCalendarInfoW
SetLocaleInfoW
SetProcessPreferredUILanguages
SetThreadLocale
SetThreadPreferredUILanguages
SetThreadUILanguage
SetUserGeoID
VerLanguageNameA
VerLanguageNameW

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-memory-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:4f:5f:ec:c3:70:6b:7a:33:e3:79:1e:12:71:74:34:cc:ae:40:40:69:68:37:bd:70:72:ef:23:dd:3c:42:93
Signer

Actual PE Digest

64:4f:5f:ec:c3:70:6b:7a:33:e3:79:1e:12:71:74:34:cc:ae:40:40:69:68:37:bd:70:72:ef:23:dd:3c:42:93

Digest Algorithm

sha256

PE Digest Matches

true

a2:3c:79:d1:08:d2:8d:fa:b7:08:c5:8a:92:d2:bf:a3:fd:67:ba:e4
Signer

Actual PE Digest

a2:3c:79:d1:08:d2:8d:fa:b7:08:c5:8a:92:d2:bf:a3:fd:67:ba:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateFileMappingW
FlushViewOfFile
MapViewOfFile
MapViewOfFileEx
OpenFileMappingW
ReadProcessMemory
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WriteProcessMemory

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-namedpipe-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/10/2017, 22:57

Not After

02/01/2019, 22:57

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:ae:39:00:e6:ae:18:b5:f8:c4:39:3b:d7:95:df:b2:08:60:73:9f:ba:1f:88:80:da:eb:c3:6b:43:4f:06:74
Signer

Actual PE Digest

23:ae:39:00:e6:ae:18:b5:f8:c4:39:3b:d7:95:df:b2:08:60:73:9f:ba:1f:88:80:da:eb:c3:6b:43:4f:06:74

Digest Algorithm

sha256

PE Digest Matches

true

34:5d:e5:e5:a8:b7:2e:25:0c:f3:dc:e6:42:b3:13:ba:db:54:fb:35
Signer

Actual PE Digest

34:5d:e5:e5:a8:b7:2e:25:0c:f3:dc:e6:42:b3:13:ba:db:54:fb:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ConnectNamedPipe
CreateNamedPipeW
CreatePipe
DisconnectNamedPipe
GetNamedPipeClientComputerNameW
ImpersonateNamedPipeClient
PeekNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW

Sections

.text
Size: 1024B - Virtual size: 913B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-processenvironment-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:79:ef:1d:94:3a:28:42:c9:3d:20:bb:e8:62:53:50:8f:8f:79:1e:fe:80:80:e2:9a:b9:88:3c:28:4f:51:02
Signer

Actual PE Digest

5f:79:ef:1d:94:3a:28:42:c9:3d:20:bb:e8:62:53:50:8f:8f:79:1e:fe:80:80:e2:9a:b9:88:3c:28:4f:51:02

Digest Algorithm

sha256

PE Digest Matches

true

d1:6e:99:7e:0a:cf:c6:7b:4b:69:75:5d:08:cf:69:e1:7e:f2:43:83
Signer

Actual PE Digest

d1:6e:99:7e:0a:cf:c6:7b:4b:69:75:5d:08:cf:69:e1:7e:f2:43:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStdHandle
SearchPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetStdHandleEx

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-processthreads-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:da:90:4d:d6:ce:cf:1c:30:ab:54:fb:28:86:0f:ae:c8:fb:3a:e8:be:53:f0:42:94:4e:9d:9e:c3:14:19:3c
Signer

Actual PE Digest

2f:da:90:4d:d6:ce:cf:1c:30:ab:54:fb:28:86:0f:ae:c8:fb:3a:e8:be:53:f0:42:94:4e:9d:9e:c3:14:19:3c

Digest Algorithm

sha256

PE Digest Matches

true

38:89:85:fc:bf:3f:6e:91:48:3f:d5:20:49:5b:3a:bf:21:d5:7a:52
Signer

Actual PE Digest

38:89:85:fc:bf:3f:6e:91:48:3f:d5:20:49:5b:3a:bf:21:d5:7a:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CreateProcessA
CreateProcessAsUserW
CreateProcessW
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
DeleteProcThreadAttributeList
ExitProcess
ExitThread
FlushProcessWriteBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetPriorityClass
GetProcessId
GetProcessIdOfThread
GetProcessTimes
GetProcessVersion
GetStartupInfoW
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
InitializeProcThreadAttributeList
OpenProcessToken
OpenThread
OpenThreadToken
ProcessIdToSessionId
QueryProcessAffinityUpdateMode
QueueUserAPC
ResumeThread
SetPriorityClass
SetProcessAffinityUpdateMode
SetProcessShutdownParameters
SetThreadPriority
SetThreadPriorityBoost
SetThreadStackGuarantee
SetThreadToken
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UpdateProcThreadAttribute

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-processthreads-l1-1-1.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:2c:25:6c:9d:a9:0a:3c:ab:98:f6:67:6b:55:d8:f3:82:39:31:90:c8:62:16:44:1b:23:f6:43:77:30:f5:a1
Signer

Actual PE Digest

56:2c:25:6c:9d:a9:0a:3c:ab:98:f6:67:6b:55:d8:f3:82:39:31:90:c8:62:16:44:1b:23:f6:43:77:30:f5:a1

Digest Algorithm

sha256

PE Digest Matches

true

9d:ea:4a:07:4e:a9:ca:3c:27:4a:3c:c3:43:34:1d:c5:26:39:e6:49
Signer

Actual PE Digest

9d:ea:4a:07:4e:a9:ca:3c:27:4a:3c:c3:43:34:1d:c5:26:39:e6:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

FlushInstructionCache
GetCurrentProcessorNumber
GetCurrentProcessorNumberEx
GetCurrentThreadStackLimits
GetProcessHandleCount
GetProcessMitigationPolicy
GetThreadContext
GetThreadIdealProcessorEx
GetThreadTimes
IsProcessorFeaturePresent
OpenProcess
SetProcessMitigationPolicy
SetThreadContext
SetThreadIdealProcessorEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-profile-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:ce:a9:d1:a1:79:ef:9a:99:f7:17:f2:06:55:64:c8:8f:ec:83:c2:33:b7:11:fd:d7:89:95:b7:c3:64:af:d4
Signer

Actual PE Digest

36:ce:a9:d1:a1:79:ef:9a:99:f7:17:f2:06:55:64:c8:8f:ec:83:c2:33:b7:11:fd:d7:89:95:b7:c3:64:af:d4

Digest Algorithm

sha256

PE Digest Matches

true

5b:3c:1a:8b:f2:0a:e4:63:15:a2:1b:3b:00:54:09:c5:f7:f2:c7:f4
Signer

Actual PE Digest

5b:3c:1a:8b:f2:0a:e4:63:15:a2:1b:3b:00:54:09:c5:f7:f2:c7:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

QueryPerformanceCounter
QueryPerformanceFrequency

Sections

.text
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-rtlsupport-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:c8:c2:cf:b8:4e:cc:05:89:3b:a3:4b:50:a0:d6:81:27:c9:48:9f:1b:e2:46:4e:ca:91:0f:15:07:88:12:06
Signer

Actual PE Digest

c8:c8:c2:cf:b8:4e:cc:05:89:3b:a3:4b:50:a0:d6:81:27:c9:48:9f:1b:e2:46:4e:ca:91:0f:15:07:88:12:06

Digest Algorithm

sha256

PE Digest Matches

true

f0:77:4d:4d:1f:01:e9:6b:f2:cf:96:cf:a9:2d:b3:7f:c2:d7:4d:2a
Signer

Actual PE Digest

f0:77:4d:4d:1f:01:e9:6b:f2:cf:96:cf:a9:2d:b3:7f:c2:d7:4d:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

RtlCaptureContext
RtlCaptureStackBackTrace
RtlUnwind

Sections

.text
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-string-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:c3:94:fb:5b:b7:25:2a:1e:07:11:83:b1:63:0a:93:cc:29:8e:7b:16:e6:21:e1:e2:0d:e5:85:04:85:a2:cd
Signer

Actual PE Digest

d0:c3:94:fb:5b:b7:25:2a:1e:07:11:83:b1:63:0a:93:cc:29:8e:7b:16:e6:21:e1:e2:0d:e5:85:04:85:a2:cd

Digest Algorithm

sha256

PE Digest Matches

true

41:45:7d:08:bb:e9:93:df:35:44:b8:20:69:8f:04:66:14:95:d9:6b
Signer

Actual PE Digest

41:45:7d:08:bb:e9:93:df:35:44:b8:20:69:8f:04:66:14:95:d9:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CompareStringEx
CompareStringOrdinal
CompareStringW
FoldStringW
GetStringTypeExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

Sections

.text
Size: 1024B - Virtual size: 754B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-synch-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:f5:22:84:1c:25:3f:6c:9d:51:6e:b5:80:cd:e5:1a:60:57:f9:de:69:2f:d3:fd:b6:5a:1e:bc:e7:e9:6a:50
Signer

Actual PE Digest

2d:f5:22:84:1c:25:3f:6c:9d:51:6e:b5:80:cd:e5:1a:60:57:f9:de:69:2f:d3:fd:b6:5a:1e:bc:e7:e9:6a:50

Digest Algorithm

sha256

PE Digest Matches

true

63:bb:37:03:dc:c2:3a:ff:fe:88:77:de:4e:57:ce:7d:4a:c8:33:11
Signer

Actual PE Digest

63:bb:37:03:dc:c2:3a:ff:fe:88:77:de:4e:57:ce:7d:4a:c8:33:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

AcquireSRWLockExclusive
AcquireSRWLockShared
CancelWaitableTimer
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateSemaphoreExW
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetCriticalSectionSpinCount
SetEvent
SetWaitableTimer
SetWaitableTimerEx
SleepEx
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-synch-l1-2-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:fb:31:6b:fb:ab:16:71:db:ab:01:04:73:51:ce:7c:46:23:ad:cb:9d:bf:e4:9e:e2:11:22:a4:b8:cd:93:58
Signer

Actual PE Digest

4b:fb:31:6b:fb:ab:16:71:db:ab:01:04:73:51:ce:7c:46:23:ad:cb:9d:bf:e4:9e:e2:11:22:a4:b8:cd:93:58

Digest Algorithm

sha256

PE Digest Matches

true

99:f4:e2:aa:40:53:a0:1a:eb:76:a7:89:ae:04:44:c4:3b:71:68:2d
Signer

Actual PE Digest

99:f4:e2:aa:40:53:a0:1a:eb:76:a7:89:ae:04:44:c4:3b:71:68:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DeleteSynchronizationBarrier
EnterSynchronizationBarrier
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitOnceInitialize
InitializeConditionVariable
InitializeSynchronizationBarrier
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WaitOnAddress
WakeAllConditionVariable
WakeByAddressAll
WakeByAddressSingle
WakeConditionVariable

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-sysinfo-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:a9:6b:9b:b3:a9:d7:19:ee:c9:3f:19:48:7a:55:62:fb:69:71:c5:3d:91:fe:e6:d4:67:aa:69:01:70:77:c4
Signer

Actual PE Digest

57:a9:6b:9b:b3:a9:d7:19:ee:c9:3f:19:48:7a:55:62:fb:69:71:c5:3d:91:fe:e6:d4:67:aa:69:01:70:77:c4

Digest Algorithm

sha256

PE Digest Matches

true

b5:77:64:1a:5b:2d:70:49:d9:5e:e4:17:a8:f7:98:8b:a7:f5:8f:4f
Signer

Actual PE Digest

b5:77:64:1a:5b:2d:70:49:d9:5e:e4:17:a8:f7:98:8b:a7:f5:8f:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetComputerNameExA
GetComputerNameExW
GetLocalTime
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetTickCount
GetTickCount64
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalMemoryStatusEx
SetLocalTime

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-timezone-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:35:00:8b:0e:3d:24:43:61:28:fd:99:c1:81:a4:d4:aa:2e:82:99:d2:67:27:49:7b:f9:79:99:cd:de:26:d7
Signer

Actual PE Digest

67:35:00:8b:0e:3d:24:43:61:28:fd:99:c1:81:a4:d4:aa:2e:82:99:d2:67:27:49:7b:f9:79:99:cd:de:26:d7

Digest Algorithm

sha256

PE Digest Matches

true

78:03:56:c4:15:66:e4:ee:ed:d9:e5:a4:bc:02:16:44:28:25:a2:71
Signer

Actual PE Digest

78:03:56:c4:15:66:e4:ee:ed:d9:e5:a4:bc:02:16:44:28:25:a2:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

EnumDynamicTimeZoneInformation
FileTimeToSystemTime
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetTimeZoneInformation
GetTimeZoneInformationForYear
SetDynamicTimeZoneInformation
SetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
SystemTimeToTzSpecificLocalTimeEx
TzSpecificLocalTimeToSystemTime
TzSpecificLocalTimeToSystemTimeEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-core-util-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:0e:b7:5a:65:1e:9b:bd:09:fc:95:29:0e:83:9d:65:3f:5b:c2:37:d0:70:54:23:9e:f3:bf:dc:2c:10:83:29
Signer

Actual PE Digest

d0:0e:b7:5a:65:1e:9b:bd:09:fc:95:29:0e:83:9d:65:3f:5b:c2:37:d0:70:54:23:9e:f3:bf:dc:2c:10:83:29

Digest Algorithm

sha256

PE Digest Matches

true

d0:8c:e9:f5:b1:5d:d9:eb:91:51:f9:0f:2c:c4:17:15:04:51:4c:d0
Signer

Actual PE Digest

d0:8c:e9:f5:b1:5d:d9:eb:91:51:f9:0f:2c:c4:17:15:04:51:4c:d0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

Beep
DecodePointer
DecodeSystemPointer
EncodePointer
EncodeSystemPointer

Sections

.text
Size: 1024B - Virtual size: 553B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-conio-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:98:8a:0f:b5:85:21:2a:4c:7f:b0:c7:bf:07:42:35:a0:48:87:da:d8:a1:02:2e:39:5b:45:ef:79:1d:3e:43
Signer

Actual PE Digest

e0:98:8a:0f:b5:85:21:2a:4c:7f:b0:c7:bf:07:42:35:a0:48:87:da:d8:a1:02:2e:39:5b:45:ef:79:1d:3e:43

Digest Algorithm

sha256

PE Digest Matches

true

dc:7f:be:ee:70:52:ba:ad:5c:69:dd:8c:b2:8a:2d:b4:3b:72:12:af
Signer

Actual PE Digest

dc:7f:be:ee:70:52:ba:ad:5c:69:dd:8c:b2:8a:2d:b4:3b:72:12:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
_cgets
_cgets_s
_cgetws
_cgetws_s
_cputs
_cputws
_getch
_getch_nolock
_getche
_getche_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_putch
_putch_nolock
_putwch
_putwch_nolock
_ungetch
_ungetch_nolock
_ungetwch
_ungetwch_nolock

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-convert-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:a7:76:c4:c6:f5:cd:7a:4c:9e:0f:01:75:35:55:73:32:a5:1f:21:95:96:82:5e:96:32:9c:59:13:5a:8f:1a
Signer

Actual PE Digest

8d:a7:76:c4:c6:f5:cd:7a:4c:9e:0f:01:75:35:55:73:32:a5:1f:21:95:96:82:5e:96:32:9c:59:13:5a:8f:1a

Digest Algorithm

sha256

PE Digest Matches

true

49:f8:c7:c9:dc:a2:e5:42:6d:03:6f:5d:76:82:cf:72:ff:d2:8e:e5
Signer

Actual PE Digest

49:f8:c7:c9:dc:a2:e5:42:6d:03:6f:5d:76:82:cf:72:ff:d2:8e:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__toascii
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_ecvt
_ecvt_s
_fcvt
_fcvt_s
_gcvt
_gcvt_s
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_ltoa
_ltoa_s
_ltow
_ltow_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wctomb_l
_wctomb_s_l
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
atof
atoi
atol
atoll
btowc
c16rtomb
c32rtomb
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
strtod
strtof
strtoimax
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcrtomb_s
wcsrtombs
wcsrtombs_s
wcstod
wcstof
wcstoimax
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wctob
wctomb
wctomb_s
wctrans

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-environment-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:c1:a4:2b:1d:91:ea:be:3a:d3:3f:5c:90:ea:09:b4:05:5f:5a:c5:92:7f:1d:e5:82:9c:8b:3a:b3:ce:5d:39
Signer

Actual PE Digest

28:c1:a4:2b:1d:91:ea:be:3a:d3:3f:5c:90:ea:09:b4:05:5f:5a:c5:92:7f:1d:e5:82:9c:8b:3a:b3:ce:5d:39

Digest Algorithm

sha256

PE Digest Matches

true

e3:ab:0a:72:3e:e1:d0:34:5f:22:81:e5:aa:fb:a5:b4:12:e6:93:d5
Signer

Actual PE Digest

e3:ab:0a:72:3e:e1:d0:34:5f:22:81:e5:aa:fb:a5:b4:12:e6:93:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__p__environ
__p__wenviron
_dupenv_s
_putenv
_putenv_s
_searchenv
_searchenv_s
_wdupenv_s
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wputenv
_wputenv_s
_wsearchenv
_wsearchenv_s
getenv
getenv_s

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-filesystem-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:bb:d0:ab:a0:f5:83:f3:48:6d:e9:4a:b5:28:2f:6e:35:8d:ce:a2:e8:b8:f0:f1:17:80:78:f5:a8:86:a9:cb
Signer

Actual PE Digest

4f:bb:d0:ab:a0:f5:83:f3:48:6d:e9:4a:b5:28:2f:6e:35:8d:ce:a2:e8:b8:f0:f1:17:80:78:f5:a8:86:a9:cb

Digest Algorithm

sha256

PE Digest Matches

true

01:38:64:ee:29:b6:ac:ca:90:af:a5:85:c6:5f:83:b9:16:59:07:50
Signer

Actual PE Digest

01:38:64:ee:29:b6:ac:ca:90:af:a5:85:c6:5f:83:b9:16:59:07:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_access
_access_s
_chdir
_chdrive
_chmod
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_fullpath
_getdiskfree
_getdrive
_getdrives
_lock_file
_makepath
_makepath_s
_mkdir
_rmdir
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_umask
_umask_s
_unlink
_unlock_file
_waccess
_waccess_s
_wchdir
_wchmod
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfullpath
_wmakepath
_wmakepath_s
_wmkdir
_wremove
_wrename
_wrmdir
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wunlink
remove
rename

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-heap-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:ef:42:8b:ca:b7:de:34:29:47:8c:f4:03:4c:b1:bf:45:5b:d9:0f:5f:8a:e9:30:47:eb:83:ac:dc:59:a2:d4
Signer

Actual PE Digest

47:ef:42:8b:ca:b7:de:34:29:47:8c:f4:03:4c:b1:bf:45:5b:d9:0f:5f:8a:e9:30:47:eb:83:ac:dc:59:a2:d4

Digest Algorithm

sha256

PE Digest Matches

true

df:a8:71:5e:de:27:0f:ab:bc:5f:46:c2:d2:b8:8b:bb:64:45:ce:00
Signer

Actual PE Digest

df:a8:71:5e:de:27:0f:ab:bc:5f:46:c2:d2:b8:8b:bb:64:45:ce:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_callnewh
_calloc_base
_expand
_free_base
_get_heap_handle
_heapchk
_heapmin
_heapwalk
_malloc_base
_msize
_query_new_handler
_query_new_mode
_realloc_base
_recalloc
_set_new_mode
calloc
free
malloc
realloc

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-locale-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:9e:7c:72:02:bd:96:0b:21:f1:d5:4b:83:e8:0a:83:ee:1b:ad:36:75:78:a1:cc:50:6e:70:b5:77:2e:5c:b7
Signer

Actual PE Digest

c4:9e:7c:72:02:bd:96:0b:21:f1:d5:4b:83:e8:0a:83:ee:1b:ad:36:75:78:a1:cc:50:6e:70:b5:77:2e:5c:b7

Digest Algorithm

sha256

PE Digest Matches

true

55:40:1f:9c:58:bd:a7:92:7e:cc:54:e0:c5:0c:36:47:a3:91:9a:14
Signer

Actual PE Digest

55:40:1f:9c:58:bd:a7:92:7e:cc:54:e0:c5:0c:36:47:a3:91:9a:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__initialize_lconv_for_unsigned_char
__pctype_func
__pwctype_func
_configthreadlocale
_create_locale
_free_locale
_get_current_locale
_getmbcp
_lock_locales
_setmbcp
_unlock_locales
_wcreate_locale
_wsetlocale
localeconv
setlocale

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-math-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:81:a9:e2:bf:77:48:ad:a2:83:51:23:75:b7:75:be:1d:a6:6a:78:f5:17:6a:b4:45:b0:03:89:ec:c9:a8:d2
Signer

Actual PE Digest

b4:81:a9:e2:bf:77:48:ad:a2:83:51:23:75:b7:75:be:1d:a6:6a:78:f5:17:6a:b4:45:b0:03:89:ec:c9:a8:d2

Digest Algorithm

sha256

PE Digest Matches

true

4a:5d:3e:6b:77:5b:7a:3e:d6:e5:62:4f:2e:9f:4c:b0:f8:3f:d1:b5
Signer

Actual PE Digest

4a:5d:3e:6b:77:5b:7a:3e:d6:e5:62:4f:2e:9f:4c:b0:f8:3f:d1:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_FCbuild
_FCmulcc
_FCmulcr
_LCbuild
_LCmulcc
_LCmulcr
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__setusermatherr
_cabs
_chgsign
_chgsignf
_copysign
_copysignf
_d_int
_dclass
_dexp
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_except1
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_finite
_fpclass
_ftol
_hypot
_hypotf
_isnan
_j0
_j1
_jn
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_logb
_nextafter
_scalb
_set_SSE2_enable
_y0
_y1
_yn
acos
acosh
acoshf
acoshl
asin
asinh
asinhf
asinhl
atan
atan2
atanh
atanhf
atanhl
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosh
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
erf
erfc
erfcf
erfcl
erff
erfl
exp
exp2
exp2f
exp2l
expm1
expm1f
expm1l
fabs
fdim
fdimf
fdiml
floor
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
frexp
hypot
ilogb
ilogbf
ilogbl
ldexp
lgamma
lgammaf
lgammal
llrint
llrintf
llrintl
llround
llroundf
llroundl
log
log10
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
lrint
lrintf
lrintl
lround
lroundf
lroundl
modf
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
pow
powf
remainder
remainderf
remainderl
remquo
remquof
remquol
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
sin
sinh
sqrt
tan
tanh
tgamma
tgammaf
tgammal
trunc
truncf
truncl

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-multibyte-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:52:c0:6f:2f:9c:98:18:86:30:8a:4f:cc:7b:47:bb:64:84:85:b0:d0:fd:f3:bd:51:04:4b:16:74:d1:82:67
Signer

Actual PE Digest

d8:52:c0:6f:2f:9c:98:18:86:30:8a:4f:cc:7b:47:bb:64:84:85:b0:d0:fd:f3:bd:51:04:4b:16:74:d1:82:67

Digest Algorithm

sha256

PE Digest Matches

true

c7:51:bf:93:d9:26:4a:9c:a3:a1:6e:e4:b6:51:e0:90:12:1b:56:07
Signer

Actual PE Digest

c7:51:bf:93:d9:26:4a:9c:a3:a1:6e:e4:b6:51:e0:90:12:1b:56:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__p__mbcasemap
__p__mbctype
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-private-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:e8:a5:1f:4e:4f:ea:b3:1a:b1:27:a3:ba:d9:af:1d:b5:79:ea:1e:70:b1:d5:0d:86:a6:69:9b:bd:b7:68:77
Signer

Actual PE Digest

17:e8:a5:1f:4e:4f:ea:b3:1a:b1:27:a3:ba:d9:af:1d:b5:79:ea:1e:70:b1:d5:0d:86:a6:69:9b:bd:b7:68:77

Digest Algorithm

sha256

PE Digest Matches

true

24:d4:41:f4:86:c6:03:42:bf:9f:07:10:9c:5d:60:bb:45:58:ff:72
Signer

Actual PE Digest

24:d4:41:f4:86:c6:03:42:bf:9f:07:10:9c:5d:60:bb:45:58:ff:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__intrinsic_abnormal_termination
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_o__CIacos
_o__CIasin
_o__CIatan
_o__CIatan2
_o__CIcos
_o__CIcosh
_o__CIexp
_o__CIfmod
_o__CIlog
_o__CIlog10
_o__CIpow
_o__CIsin
_o__CIsinh
_o__CIsqrt
_o__CItan
_o__CItanh
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__Wcsftime
_o____lc_codepage_func
_o____lc_collate_cp_func
_o____lc_locale_name_func
_o____mb_cur_max_func
_o___acrt_iob_func
_o___conio_common_vcprintf
_o___conio_common_vcprintf_p
_o___conio_common_vcprintf_s
_o___conio_common_vcscanf
_o___conio_common_vcwprintf
_o___conio_common_vcwprintf_p
_o___conio_common_vcwprintf_s
_o___conio_common_vcwscanf
_o___daylight
_o___dstbias
_o___fpe_flt_rounds
_o___libm_sse2_acos
_o___libm_sse2_acosf
_o___libm_sse2_asin
_o___libm_sse2_asinf
_o___libm_sse2_atan
_o___libm_sse2_atan2
_o___libm_sse2_atanf
_o___libm_sse2_cos
_o___libm_sse2_cosf
_o___libm_sse2_exp
_o___libm_sse2_expf
_o___libm_sse2_log
_o___libm_sse2_log10
_o___libm_sse2_log10f
_o___libm_sse2_logf
_o___libm_sse2_pow
_o___libm_sse2_powf
_o___libm_sse2_sin
_o___libm_sse2_sinf
_o___libm_sse2_tan
_o___libm_sse2_tanf
_o___p___argc
_o___p___argv
_o___p___wargv
_o___p__acmdln
_o___p__commode
_o___p__environ
_o___p__fmode
_o___p__mbcasemap
_o___p__mbctype
_o___p__pgmptr
_o___p__wcmdln
_o___p__wenviron
_o___p__wpgmptr
_o___pctype_func
_o___pwctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___std_type_info_name
_o___stdio_common_vfprintf
_o___stdio_common_vfprintf_p
_o___stdio_common_vfprintf_s
_o___stdio_common_vfscanf
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_p
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfwscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsprintf_p
_o___stdio_common_vsprintf_s
_o___stdio_common_vsscanf
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o___timezone
_o___tzname
_o___wcserror
_o__access
_o__access_s
_o__aligned_free
_o__aligned_malloc
_o__aligned_msize
_o__aligned_offset_malloc
_o__aligned_offset_realloc
_o__aligned_offset_recalloc
_o__aligned_realloc
_o__aligned_recalloc
_o__atodbl
_o__atodbl_l
_o__atof_l
_o__atoflt
_o__atoflt_l
_o__atoi64
_o__atoi64_l
_o__atoi_l
_o__atol_l
_o__atoldbl
_o__atoldbl_l
_o__atoll_l
_o__beep
_o__beginthread
_o__beginthreadex
_o__cabs
_o__callnewh
_o__calloc_base
_o__cexit
_o__cgets
_o__cgets_s
_o__cgetws
_o__cgetws_s
_o__chdir
_o__chdrive
_o__chmod
_o__chsize
_o__chsize_s
_o__close
_o__commit
_o__configthreadlocale
_o__configure_narrow_argv
_o__configure_wide_argv
_o__controlfp_s
_o__cputs
_o__cputws
_o__creat
_o__create_locale
_o__crt_atexit
_o__ctime32_s
_o__ctime64_s
_o__cwait
_o__d_int
_o__dclass
_o__difftime32
_o__difftime64
_o__dlog
_o__dnorm
_o__dpcomp
_o__dpoly
_o__dscale
_o__dsign
_o__dsin
_o__dtest
_o__dunscale
_o__dup
_o__dup2
_o__dupenv_s
_o__ecvt
_o__ecvt_s
_o__endthread
_o__endthreadex
_o__eof
_o__errno
_o__except1
_o__execute_onexit_table
_o__execv
_o__execve
_o__execvp
_o__execvpe
_o__exit
_o__expand
_o__fclose_nolock
_o__fcloseall
_o__fcvt
_o__fcvt_s
_o__fd_int
_o__fdclass
_o__fdexp
_o__fdlog
_o__fdopen
_o__fdpcomp
_o__fdpoly
_o__fdscale
_o__fdsign
_o__fdsin
_o__fflush_nolock
_o__fgetc_nolock
_o__fgetchar
_o__fgetwc_nolock
_o__fgetwchar
_o__filelength
_o__filelengthi64
_o__fileno
_o__findclose
_o__findfirst32
_o__findfirst32i64
_o__findfirst64
_o__findfirst64i32
_o__findnext32
_o__findnext32i64
_o__findnext64
_o__findnext64i32
_o__flushall
_o__fpclass
_o__fputc_nolock
_o__fputchar
_o__fputwc_nolock
_o__fputwchar
_o__fread_nolock
_o__fread_nolock_s
_o__free_base
_o__free_locale
_o__fseek_nolock
_o__fseeki64
_o__fseeki64_nolock
_o__fsopen
_o__fstat32
_o__fstat32i64
_o__fstat64
_o__fstat64i32
_o__ftell_nolock
_o__ftelli64
_o__ftelli64_nolock
_o__ftime32
_o__ftime32_s
_o__ftime64
_o__ftime64_s
_o__fullpath
_o__futime32
_o__futime64
_o__fwrite_nolock
_o__gcvt
_o__gcvt_s
_o__get_daylight
_o__get_doserrno
_o__get_dstbias
_o__get_errno
_o__get_fmode
_o__get_heap_handle
_o__get_initial_narrow_environment
_o__get_initial_wide_environment
_o__get_invalid_parameter_handler
_o__get_narrow_winmain_command_line
_o__get_osfhandle
_o__get_pgmptr
_o__get_stream_buffer_pointers
_o__get_terminate
_o__get_thread_local_invalid_parameter_handler
_o__get_timezone
_o__get_tzname
_o__get_wide_winmain_command_line
_o__get_wpgmptr
_o__getc_nolock
_o__getch
_o__getch_nolock
_o__getche
_o__getche_nolock
_o__getcwd
_o__getdcwd
_o__getdiskfree
_o__getdllprocaddr
_o__getdrive
_o__getdrives
_o__getmbcp
_o__getsystime
_o__getw
_o__getwc_nolock
_o__getwch
_o__getwch_nolock
_o__getwche
_o__getwche_nolock
_o__getws
_o__getws_s
_o__gmtime32
_o__gmtime32_s
_o__gmtime64
_o__gmtime64_s
_o__heapchk
_o__heapmin
_o__hypot
_o__hypotf
_o__i64toa
_o__i64toa_s
_o__i64tow
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__isctype
_o__isctype_l
_o__isleadbyte_l
_o__ismbbalnum
_o__ismbbalnum_l
_o__ismbbalpha
_o__ismbbalpha_l
_o__ismbbblank
_o__ismbbblank_l
_o__ismbbgraph
_o__ismbbgraph_l
_o__ismbbkalnum
_o__ismbbkalnum_l
_o__ismbbkana
_o__ismbbkana_l
_o__ismbbkprint
_o__ismbbkprint_l
_o__ismbbkpunct
_o__ismbbkpunct_l
_o__ismbblead
_o__ismbblead_l
_o__ismbbprint
_o__ismbbprint_l
_o__ismbbpunct
_o__ismbbpunct_l
_o__ismbbtrail
_o__ismbbtrail_l
_o__ismbcalnum
_o__ismbcalnum_l
_o__ismbcalpha
_o__ismbcalpha_l
_o__ismbcblank
_o__ismbcblank_l
_o__ismbcdigit
_o__ismbcdigit_l
_o__ismbcgraph
_o__ismbcgraph_l
_o__ismbchira
_o__ismbchira_l
_o__ismbckata
_o__ismbckata_l
_o__ismbcl0
_o__ismbcl0_l
_o__ismbcl1
_o__ismbcl1_l
_o__ismbcl2
_o__ismbcl2_l
_o__ismbclegal
_o__ismbclegal_l
_o__ismbclower
_o__ismbclower_l
_o__ismbcprint
_o__ismbcprint_l
_o__ismbcpunct
_o__ismbcpunct_l
_o__ismbcspace
_o__ismbcspace_l
_o__ismbcsymbol
_o__ismbcsymbol_l
_o__ismbcupper
_o__ismbcupper_l
_o__ismbslead
_o__ismbslead_l
_o__ismbstrail
_o__ismbstrail_l
_o__iswctype_l
_o__itoa
_o__itoa_s
_o__itow
_o__itow_s
_o__j0
_o__j1
_o__jn
_o__kbhit
_o__ld_int
_o__ldclass
_o__ldexp
_o__ldlog
_o__ldpcomp
_o__ldpoly
_o__ldscale
_o__ldsign
_o__ldsin
_o__ldtest
_o__ldunscale
_o__lfind
_o__lfind_s
_o__libm_sse2_acos_precise
_o__libm_sse2_asin_precise
_o__libm_sse2_atan_precise
_o__libm_sse2_cos_precise
_o__libm_sse2_exp_precise
_o__libm_sse2_log10_precise
_o__libm_sse2_log_precise
_o__libm_sse2_pow_precise
_o__libm_sse2_sin_precise
_o__libm_sse2_sqrt_precise
_o__libm_sse2_tan_precise
_o__loaddll
_o__localtime32
_o__localtime32_s
_o__localtime64
_o__localtime64_s
_o__lock_file
_o__locking
_o__logb
_o__lsearch
_o__lsearch_s
_o__lseek
_o__lseeki64
_o__ltoa
_o__ltoa_s
_o__ltow
_o__ltow_s
_o__makepath
_o__makepath_s
_o__malloc_base
_o__mbbtombc
_o__mbbtombc_l
_o__mbbtype
_o__mbbtype_l
_o__mbccpy
_o__mbccpy_l
_o__mbccpy_s
_o__mbccpy_s_l
_o__mbcjistojms
_o__mbcjistojms_l
_o__mbcjmstojis
_o__mbcjmstojis_l
_o__mbclen
_o__mbclen_l
_o__mbctohira
_o__mbctohira_l
_o__mbctokata
_o__mbctokata_l
_o__mbctolower
_o__mbctolower_l
_o__mbctombb
_o__mbctombb_l

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-process-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:69:7b:ab:9a:ae:0c:c5:99:03:98:6e:77:1c:b4:69:99:f6:4e:22:88:ec:f0:57:6c:07:86:4a:90:1a:41:98
Signer

Actual PE Digest

69:69:7b:ab:9a:ae:0c:c5:99:03:98:6e:77:1c:b4:69:99:f6:4e:22:88:ec:f0:57:6c:07:86:4a:90:1a:41:98

Digest Algorithm

sha256

PE Digest Matches

true

3c:c9:27:de:6e:c2:16:2c:63:ea:3d:66:f4:ba:30:5f:e8:f5:3b:24
Signer

Actual PE Digest

3c:c9:27:de:6e:c2:16:2c:63:ea:3d:66:f4:ba:30:5f:e8:f5:3b:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_beep
_cwait
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_loaddll
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_unloaddll
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-runtime-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:da:f7:91:ec:8c:d6:bc:9c:d3:ca:0b:d3:34:13:64:97:35:9e:df:bf:b6:c0:ad:59:ce:3e:f1:fe:f3:42:e8
Signer

Actual PE Digest

0d:da:f7:91:ec:8c:d6:bc:9c:d3:ca:0b:d3:34:13:64:97:35:9e:df:bf:b6:c0:ad:59:ce:3e:f1:fe:f3:42:e8

Digest Algorithm

sha256

PE Digest Matches

true

38:d0:bb:ce:4f:3b:91:fe:01:52:6f:59:bb:69:68:62:c4:4a:78:c4
Signer

Actual PE Digest

38:d0:bb:ce:4f:3b:91:fe:01:52:6f:59:bb:69:68:62:c4:4a:78:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_Exit
__control87_2
__doserrno
__fpe_flt_rounds
__fpecode
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__pgmptr
__p__wcmdln
__p__wpgmptr
__pxcptinfoptrs
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__wcserror
__wcserror_s
_assert
_beginthread
_beginthreadex
_c_exit
_cexit
_clearfp
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_endthread
_endthreadex
_errno
_execute_onexit_table
_exit
_fpieee_flt
_fpreset
_get_doserrno
_get_errno
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_pgmptr
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_wide_winmain_command_line
_get_wpgmptr
_getdllprocaddr
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_query_app_type
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_seh_filter_dll
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_invalid_parameter_handler
_set_new_handler
_set_thread_local_invalid_parameter_handler
_seterrormode
_sleep
_statusfp
_statusfp2
_strerror
_strerror_s
_wassert
_wcserror
_wcserror_s
_wperror
_wsystem
abort
exit
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
fesetenv
fesetexceptflag
fesetround
fetestexcept
perror
quick_exit
raise
set_terminate
signal
strerror
strerror_s
system
terminate

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-stdio-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:6a:c5:48:de:6e:e8:ec:f5:6d:b2:e4:7d:c8:0f:e8:50:a7:f5:6b:6e:95:33:49:2d:a2:ba:7c:d7:ae:f3:0f
Signer

Actual PE Digest

06:6a:c5:48:de:6e:e8:ec:f5:6d:b2:e4:7d:c8:0f:e8:50:a7:f5:6b:6e:95:33:49:2d:a2:ba:7c:d7:ae:f3:0f

Digest Algorithm

sha256

PE Digest Matches

true

cd:d6:f2:d2:ca:df:e3:a6:28:86:42:e0:c0:2c:cc:ac:55:18:39:38
Signer

Actual PE Digest

cd:d6:f2:d2:ca:df:e3:a6:28:86:42:e0:c0:2c:cc:ac:55:18:39:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_chsize
_chsize_s
_close
_commit
_creat
_dup
_dup2
_eof
_fclose_nolock
_fcloseall
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_flushall
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_ftell_nolock
_ftelli64
_ftelli64_nolock
_fwrite_nolock
_get_fmode
_get_osfhandle
_get_printf_count_output
_get_stream_buffer_pointers
_getc_nolock
_getcwd
_getdcwd
_getmaxstdio
_getw
_getwc_nolock
_getws
_getws_s
_isatty
_kbhit
_locking
_lseek
_lseeki64
_mktemp
_mktemp_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_putc_nolock
_putw
_putwc_nolock
_putws
_read
_rmtmp
_set_fmode
_set_printf_count_output
_setmaxstdio
_setmode
_sopen
_sopen_dispatch
_sopen_s
_tell
_telli64
_tempnam
_ungetc_nolock
_ungetwc_nolock
_wcreat
_wfdopen
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wmktemp
_wmktemp_s
_wopen
_wpopen
_write
_wsopen
_wsopen_dispatch
_wsopen_s
_wtempnam
_wtmpnam
_wtmpnam_s
clearerr
clearerr_s
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
freopen
freopen_s
fseek
fsetpos
ftell
fwrite
getc
getchar
gets
gets_s
getwc
getwchar
putc
putchar
puts
putwc
putwchar
rewind
setbuf
setvbuf
tmpfile
tmpfile_s
tmpnam
tmpnam_s
ungetc
ungetwc

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-string-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:f7:b2:a8:7c:0d:32:af:2c:96:ea:a5:fe:83:44:27:53:a1:05:26:3b:78:e6:6e:92:ce:a4:2c:39:01:4b:09
Signer

Actual PE Digest

4a:f7:b2:a8:7c:0d:32:af:2c:96:ea:a5:fe:83:44:27:53:a1:05:26:3b:78:e6:6e:92:ce:a4:2c:39:01:4b:09

Digest Algorithm

sha256

PE Digest Matches

true

15:fc:7d:e6:b7:e4:21:f5:f7:05:fb:44:ff:49:64:30:bf:80:c9:40
Signer

Actual PE Digest

15:fc:7d:e6:b7:e4:21:f5:f7:05:fb:44:ff:49:64:30:bf:80:c9:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__strncnt
__wcsncnt
_isalnum_l
_isalpha_l
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_memccpy
_memicmp
_memicmp_l
_strcoll_l
_strdup
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_wcscoll_l
_wcsdup
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctype
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
mblen
mbrlen
memcpy_s
memmove_s
memset
strcat
strcat_s
strcmp
strcoll
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towctrans
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsspn
wcstok
wcstok_s
wcsxfrm
wctype
wmemcpy_s
wmemmove_s

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-time-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:78:0a:48:f4:90:dc:4c:3c:d4:1c:48:df:dc:fe:5d:ff:e8:28:d6:07:53:5e:c7:ef:a4:6d:6f:ed:cb:95:44
Signer

Actual PE Digest

b3:78:0a:48:f4:90:dc:4c:3c:d4:1c:48:df:dc:fe:5d:ff:e8:28:d6:07:53:5e:c7:ef:a4:6d:6f:ed:cb:95:44

Digest Algorithm

sha256

PE Digest Matches

true

a2:ab:93:be:71:e1:28:d5:c7:c0:87:3a:24:66:31:da:b0:d7:78:b3
Signer

Actual PE Digest

a2:ab:93:be:71:e1:28:d5:c7:c0:87:3a:24:66:31:da:b0:d7:78:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_Getdays
_Getmonths
_Gettnames
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__daylight
__dstbias
__timezone
__tzname
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_difftime32
_difftime64
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_futime32
_futime64
_get_daylight
_get_dstbias
_get_timezone
_get_tzname
_getsystime
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_mkgmtime32
_mkgmtime64
_mktime32
_mktime64
_setsystime
_strdate
_strdate_s
_strftime_l
_strtime
_strtime_s
_time32
_time64
_timespec32_get
_timespec64_get
_tzset
_utime32
_utime64
_wasctime
_wasctime_s
_wcsftime_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wutime32
_wutime64
asctime
asctime_s
clock
strftime
wcsftime

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/api-ms-win-crt-utility-l1-1-0.dll
.dll windows:10 windows x86 arch:x86

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:29:f2:b0:ff:a2:cf:91:b1:6c:4e:69:19:d2:b2:7d:bb:36:1d:90:42:5c:d9:2e:5f:9b:17:27:0c:99:8b:ca
Signer

Actual PE Digest

11:29:f2:b0:ff:a2:cf:91:b1:6c:4e:69:19:d2:b2:7d:bb:36:1d:90:42:5c:d9:2e:5f:9b:17:27:0c:99:8b:ca

Digest Algorithm

sha256

PE Digest Matches

true

f9:85:fe:cd:4a:c1:4c:f2:60:3c:23:21:01:f5:0d:02:73:c7:f3:f1
Signer

Actual PE Digest

f9:85:fe:cd:4a:c1:4c:f2:60:3c:23:21:01:f5:0d:02:73:c7:f3:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_abs64
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_lfind
_lfind_s
_lrotl
_lrotr
_lsearch
_lsearch_s
_rotl
_rotl64
_rotr
_rotr64
_swab
abs
bsearch
bsearch_s
div
imaxabs
imaxdiv
labs
ldiv
llabs
lldiv
qsort
qsort_s
rand
rand_s
srand

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/clrcompression.dll
.dll windows:6 windows x86 arch:x86

1dc31de28c38c94cf081a786f0ef0ce1

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:fb:cb:1b:59:1d:8a:7e:55:dc:97:18:c0:cf:3b:41:ce:bf:aa:03:cb:eb:6a:c5:8a:54:09:60:ef:98:7a:92
Signer

Actual PE Digest

bc:fb:cb:1b:59:1d:8a:7e:55:dc:97:18:c0:cf:3b:41:ce:bf:aa:03:cb:eb:6a:c5:8a:54:09:60:ef:98:7a:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-math-l1-1-0

log2
_except1

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_cexit
_configure_narrow_argv
exit
_initialize_narrow_environment
_seh_filter_dll
terminate
_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

wcsncmp

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/clretwrc.dll
.dll windows:6 windows x86 arch:x86

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:4e:af:ac:ca:dc:f4:0a:cd:3b:80:3f:d2:70:17:fc:ba:fe:02:35:35:3b:52:24:3c:0a:f5:d5:c2:d7:06:38
Signer

Actual PE Digest

61:4e:af:ac:ca:dc:f4:0a:cd:3b:80:3f:d2:70:17:fc:ba:fe:02:35:35:3b:52:24:3c:0a:f5:d5:c2:d7:06:38

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/clrjit.dll
.dll windows:6 windows x86 arch:x86

a0aa19c8566cbd21b4879ca7daf0d648

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:1d:27:de:bc:d9:50:7c:26:4c:59:e3:d7:68:d6:4f:87:56:1c:92:ed:73:c9:8e:8b:19:3a:7c:08:12:0f:76
Signer

Actual PE Digest

17:1d:27:de:bc:d9:50:7c:26:4c:59:e3:d7:68:d6:4f:87:56:1c:92:ed:73:c9:8e:8b:19:3a:7c:08:12:0f:76

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsFree
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetACP
MultiByteToWideChar
FormatMessageW
LocalFree
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
GetCurrentProcess
TlsGetValue
GetFullPathNameW
LoadLibraryExW
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetLastError
GetCurrentThread
QueryThreadCycleTime
HeapFree
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
QueryPerformanceFrequency
WideCharToMultiByte
OutputDebugStringA
DebugBreak
RaiseException
DisableThreadLibraryCalls

oleaut32

SetErrorInfo

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise
_fdopen
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
floor
_except1
_isnan
_CIfmod
_finite
_copysign

api-ms-win-crt-stdio-l1-1-0

_setmode
_fileno
_dup
__acrt_iob_func
setvbuf
_wfopen
fseek
fclose
__stdio_common_vsnwprintf_s
ftell
__stdio_common_vfprintf
__stdio_common_vsnprintf_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_errno
_cexit
terminate
_initterm_e
abort
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncpy_s
wcscpy_s
strcpy_s
strcat_s
strncmp
wcsncmp

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc

Exports

Exports

getJit
jitStartup

Sections

.text
Size: 949KB - Virtual size: 949KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/coreclr.dll
.dll windows:6 windows x86 arch:x86

4eb21b8edb3393667c593adecc22a5f2

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:a9:2d:f7:92:ad:d0:d7:7e:b8:1b:49:11:eb:24:0b:11:6f:5b:57:c1:b3:48:6b:6b:3b:c0:ad:71:c4:dd:59
Signer

Actual PE Digest

e3:a9:2d:f7:92:ad:d0:d7:7e:b8:1b:49:11:eb:24:0b:11:6f:5b:57:c1:b3:48:6b:6b:3b:c0:ad:71:c4:dd:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsDBCSLeadByte
WideCharToMultiByte
FormatMessageW
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
FreeLibrary
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
RaiseFailFastException
CloseHandle
GetSystemInfo
VirtualAllocExNuma
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
SetThreadGroupAffinity
GetSystemTimes
GetProcessAffinityMask
GetCurrentProcess
SwitchToThread
FlushInstructionCache
GetCurrentThread
VerSetConditionMask
VerifyVersionInfoW
TerminateProcess
IsWow64Process
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
CreateProcessW
GetCPInfo
WaitForSingleObject
CreateFileMappingW
GetFileSize
GlobalMemoryStatusEx
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateSemaphoreExW
OpenProcess
GetModuleHandleW
GetTickCount
SetConsoleCtrlHandler
CreateThread
GetTickCount64
GetLocaleInfoEx
GetUserDefaultLocaleName
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SleepEx
GetThreadContext
SuspendThread
ResumeThread
SetThreadContext
Sleep
FlushProcessWriteBuffers
QueryPerformanceFrequency
QueryPerformanceCounter
GetACP
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
TlsSetValue
TlsAlloc
SignalObjectAndWait
SetThreadStackGuarantee
ResetEvent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExW
SetFilePointer
ReadFile
GetCommandLineW
GetProcessTimes
WriteFile
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
GetStdHandle
GetConsoleOutputCP
GetLogicalProcessorInformation
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMemoryResourceNotification
GetActiveProcessorGroupCount
GetActiveProcessorCount
InitializeSListHead
InterlockedFlushSList
ExitProcess
TlsGetValue
RtlUnwind
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcessorNumber
ReadProcessMemory
OutputDebugStringA
SetEnvironmentVariableW
GetCurrentProcessorNumberEx
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetLargePageMinimum
VirtualUnlock
ResetWriteWatch
GetWriteWatch
SetThreadAffinityMask
IsProcessInJob
QueryInformationJobObject
GetSystemTime
MapViewOfFile
FlushFileBuffers
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
EncodePointer
TlsFree
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesExW
GetFileAttributesW
LCMapStringEx
LoadLibraryW
OpenEventW
ExitThread
HeapReAlloc
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
CreateFileW
LoadLibraryExW
SetLastError
LoadLibraryExA
MultiByteToWideChar
DuplicateHandle
GetLastError

advapi32

SetKernelObjectSecurity
AdjustTokenPrivileges
LookupPrivilegeValueW
EventRegister
EventWrite
RegEnumValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoCreateGuid
CreateStreamOnHGlobal
CoGetClassObject
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoGetContextToken
CoGetObjectContext
StringFromGUID2
CoReleaseMarshalData
CLSIDFromProgID
IIDFromString
CoTaskMemFree
CoInitializeEx
CoRegisterInitializeSpy
CoUninitialize
CoRevokeInitializeSpy
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoWaitForMultipleHandles

oleaut32

VariantInit
SysAllocStringByteLen
SysStringByteLen
SetErrorInfo
LoadRegTypeLi
SysAllocString
GetErrorInfo
SysFreeString
SysStringLen
SysAllocStringLen
QueryPathOfRegTypeLi
LoadTypeLibEx
SafeArrayGetVartype
VariantChangeType
VariantChangeTypeEx
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetLBound
VariantClear
CreateErrorInfo
VarCyFromDec
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
SafeArraySetRecordInfo
SafeArrayAllocData
SafeArrayGetElemsize
SafeArrayGetRecordInfo

user32

LoadStringW

shlwapi

PathFindFileNameW

bcrypt

BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

api-ms-win-crt-string-l1-1-0

strcat_s
strcmp
strlen
strcpy_s
strnlen
_strnicmp
strncpy_s
wcsncpy_s
_wcsicmp
isalpha
wcsncmp
isdigit
strncmp
towlower
wcscat_s
wcsnlen
_stricmp
iswspace
strncat_s
wcsncat_s
iswascii
iswupper
wcsncpy
wcscpy_s
_strdup
towupper

api-ms-win-crt-stdio-l1-1-0

_flushall
_putws
__stdio_common_vswprintf_s
__stdio_common_vfwprintf
__stdio_common_vswscanf
__stdio_common_vsprintf_s
_wfopen
fputs
fclose
_wfopen_s
fflush
__acrt_iob_func
__stdio_common_vsnwprintf_s
fopen
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_errno
_configure_narrow_argv
_initterm_e
_initterm
_crt_atexit
_cexit
terminate
_invalid_parameter_noinfo
abort
_controlfp_s
_execute_onexit_table
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

atoi
_wtoi
atol
strtoul
_wcstoui64
wcstoul
_ltow_s
_itow_s

api-ms-win-crt-utility-l1-1-0

bsearch
ldiv
qsort

api-ms-win-crt-math-l1-1-0

_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_except1
_CItanh
__libm_sse2_acos
__libm_sse2_asin
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
ceil
floor
__libm_sse2_atan
_libm_sse2_acos_precise
__libm_sse2_sin
__libm_sse2_pow
_CIsinh
_CIfmod
_CIatan2
_CIcosh
_libm_sse2_sin_precise
asinh
__libm_sse2_atan2
cbrt
ilogb
acosh
scalbn
fma
atanh
log2
log2f
scalbnf
acoshf
cbrtf
__libm_sse2_cos
atanhf
modf
_copysign
ilogbf
fmaf
asinhf
_isnan
__libm_sse2_exp
__libm_sse2_log
__libm_sse2_tan
__libm_sse2_log10

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wmakepath_s

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc

Exports

Exports

CLRJitAttachState
GetCLRRuntimeHost
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CLR_UEF
Size: 512B - Virtual size: 65B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 645KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/dbgshim.dll
.dll windows:6 windows x86 arch:x86

00f465c788682fb5c56632d6cd17ef2f

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:46:76:c1:4b:30:1a:ac:68:71:58:e5:7e:de:c5:02:05:78:1a:0f:98:62:c2:2c:f9:a7:93:a0:07:a5:97:11
Signer

Actual PE Digest

65:46:76:c1:4b:30:1a:ac:68:71:58:e5:7e:de:c5:02:05:78:1a:0f:98:62:c2:2c:f9:a7:93:a0:07:a5:97:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
RaiseException
GetACP
LCMapStringEx
MultiByteToWideChar
IsDBCSLeadByte
FormatMessageW
LocalFree
SetLastError
LoadLibraryExW
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
GetSystemTimeAsFileTime
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetProcessHeap
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetSystemInfo
TerminateProcess
IsDebuggerPresent
EncodePointer
InterlockedFlushSList
LoadLibraryW
MapViewOfFile
CreateFileMappingW
K32EnumProcessModules
FreeLibrary
CreateProcessW
GetCurrentProcessId
ReadProcessMemory
GetFileSize
GetProcAddress
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
ProcessIdToSessionId
CreateEventW
OpenProcess
DuplicateHandle
UnmapViewOfFile
ResumeThread
OpenEventW
GetCurrentThreadId
WaitForSingleObject
K32GetModuleFileNameExW
WaitForSingleObjectEx
GetCurrentProcess
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount

user32

LoadStringW

advapi32

CopySid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorSacl
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid

ole32

CoTaskMemFree

oleaut32

SetErrorInfo

version

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcscat_s
strncmp
wcsncmp
strcpy_s
wcsncpy_s
wcscpy_s
_stricmp

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
abort
_errno
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRCreateInstance
CloseCLREnumeration
CloseResumeHandle
CreateDebuggingInterfaceFromVersion
CreateDebuggingInterfaceFromVersion2
CreateDebuggingInterfaceFromVersionEx
CreateProcessForLaunch
CreateVersionStringFromModule
EnumerateCLRs
GetStartupNotificationEvent
RegisterForRuntimeStartup
RegisterForRuntimeStartupEx
ResumeProcess
UnregisterForRuntimeStartup

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/fmod.dll
.dll windows:6 windows x86 arch:x86

4bb7d7f37196db747cfeb96785868a51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

htons
accept
htonl
getsockopt
ioctlsocket
connect
closesocket
bind
listen
freeaddrinfo
getaddrinfo
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
send
select
recv

winmm

waveOutGetPosition
waveOutReset
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetDevCapsW
timeGetTime
waveOutWrite
waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs

msacm32

acmStreamOpen
acmStreamSize
acmStreamConvert
acmStreamPrepareHeader
acmStreamUnprepareHeader
acmFormatSuggest

kernel32

LCMapStringW
CompareStringW
ReadConsoleW
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
SetEnvironmentVariableA
SetFilePointerEx
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
HeapSize
GetStringTypeW
GetProcessHeap
GetConsoleMode
GetConsoleCP
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
AreFileApisANSI
GetModuleHandleW
WaitForSingleObject
CloseHandle
CreateEventA
InterlockedIncrement
InterlockedDecrement
GetProcAddress
LoadLibraryA
FreeLibrary
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
Sleep
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetStartupInfoW
TlsFree
GetTimeZoneInformation
SetEndOfFile
ExitProcess
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
HeapReAlloc
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
RaiseException

user32

GetDesktopWindow

advapi32

RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

ole32

CoInitializeEx
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoUninitialize
CLSIDFromString
CoTaskMemFree
PropVariantClear

Exports

Exports

?addCallback@AsyncThread@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@H@Z@Z
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?addFadePoint@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_KM@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@_NPAPAVDSPConnection@2@@Z
?addInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAPAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?addPolygon@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@MM_NHPBUFMOD_VECTOR@@PAH@Z
?addSyncPoint@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIPBDPAPAUFMOD_SYNCPOINT@@@Z
?attachChannelGroupToPort@System@FMOD@@QAG?AW4FMOD_RESULT@@I_KPAVChannelGroup@2@_N@Z
?attachFileSystem@System@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PBDPAIPAPAXPAX@ZP6G?AW43@33@ZP6G?AW43@33I13@ZP6G?AW43@3I3@Z@Z
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?createClientProfile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_DSP_DESCRIPTION@@PAPAVDSP@2@@Z
?createDSPByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAPAVDSP@2@@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?createDiskFile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAUFMOD_CREATESOUNDEXINFO@@PAPAVFile@2@PA_N@Z
?createGeometry@System@FMOD@@QAG?AW4FMOD_RESULT@@HHPAPAVGeometry@2@@Z
?createMemoryFile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVFile@2@@Z
?createReverb3D@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVReverb3D@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createSoundGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVSoundGroup@2@@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?deleteSyncPoint@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_SYNCPOINT@@@Z
?detachChannelGroupFromPort@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?disconnectAll@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?disconnectFrom@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAVDSPConnection@2@@Z
?get3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@00@Z
?get3DAttributes@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@PAM1@Z
?get3DConeOrientation@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@@Z
?get3DConeSettings@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM00@Z
?get3DConeSettings@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM00@Z
?get3DCustomRolloff@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAUFMOD_VECTOR@@PAH@Z
?get3DCustomRolloff@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAUFMOD_VECTOR@@PAH@Z
?get3DDistanceFilter@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_NPAM1@Z
?get3DDopplerLevel@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?get3DLevel@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?get3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAUFMOD_VECTOR@@000@Z
?get3DMinMaxDistance@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM0@Z
?get3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM0@Z
?get3DNumListeners@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?get3DOcclusion@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM0@Z
?get3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM00@Z
?get3DSpread@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getActive@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getActive@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getActive@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getAdvancedSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_ADVANCEDSETTINGS@@@Z
?getAsyncThread@AsyncThread@FMOD@@SG?AW4FMOD_RESULT@@PAVSystemI@2@HPAPAV12@@Z
?getAudibility@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?getChannel@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?getChannel@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?getChannelFormat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAIPAHPAW4FMOD_SPEAKERMODE@@@Z
?getChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getCurrentSound@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSound@2@@Z
?getDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVDSP@2@@Z
?getDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@PAIPAH@Z
?getDSPClock@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_K0@Z
?getDSPIndex@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAH@Z
?getDSPInfoByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAPBUFMOD_DSP_DESCRIPTION@@@Z
?getDataParameterIndex@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAH@Z
?getDefaultMixMatrix@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@0PAMH@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?getDelay@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_K0PA_N@Z
?getDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2@Z
?getFadePoints@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAIPA_KPAM@Z
?getFileUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PA_J00@Z
?getFormat@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_SOUND_TYPE@@PAW4FMOD_SOUND_FORMAT@@PAH2@Z
?getFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getGeometryOcclusion@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0PAM1@Z
?getGeometrySettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getGlobals@FMOD@@YGXPAPAVGlobal@1@@Z
?getGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getIdle@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getIndex@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PADPAIPAH22@Z
?getInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@PAPAVDSPConnection@2@@Z
?getInput@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVDSP@2@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getLoopCount@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getLoopPoints@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII0I@Z
?getLoopPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII0I@Z
?getLowPassGain@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?getMasterSoundGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSoundGroup@2@@Z
?getMaxAudible@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getMaxAudibleBehavior@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_SOUNDGROUP_BEHAVIOR@@@Z
?getMaxPolygons@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N0@Z
?getMeteringInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_DSP_METERING_INFO@@0@Z
?getMix@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getMixMatrix@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH1H@Z
?getMixMatrix@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH1H@Z
?getMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getMusicChannelVolume@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAM@Z
?getMusicNumChannels@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getMusicSpeed@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getMuteFadeSpeed@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getName@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PADH@Z
?getName@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PADH@Z
?getName@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PADH@Z
?getNestedPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@IHPAI@Z
?getNetworkProxy@System@FMOD@@QAG?AW4FMOD_RESULT@@PADH@Z
?getNetworkTimeout@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumChannels@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumDSPs@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumGroups@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumInputs@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumNestedPlugins@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAH@Z
?getNumOutputs@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumParameters@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumPlaying@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumPlugins@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@PAH@Z
?getNumPolygons@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumSounds@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumSubSounds@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumSyncPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getNumTags@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?getOutput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@PAPAVDSPConnection@2@@Z
?getOutput@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVDSP@2@@Z
?getOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OUTPUTTYPE@@@Z
?getOutputByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getOutputChannelFormat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@PAIPAHPAW44@@Z
?getOutputHandle@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getParameterBool@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPA_NPADH@Z
?getParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAXPAIPADH@Z
?getParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAMPADH@Z
?getParameterInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAUFMOD_DSP_PARAMETER_DESC@@@Z
?getParameterInt@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAHPADH@Z
?getParentGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAPAV12@@Z
?getPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getPitch@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getPluginHandle@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@HPAI@Z
?getPluginInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAW4FMOD_PLUGINTYPE@@PADHPAI@Z
?getPolygonAttributes@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@HPAM0PA_N@Z
?getPolygonNumVertices@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@HPAH@Z
?getPolygonVertex@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@HHPAUFMOD_VECTOR@@@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getPosition@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@@Z
?getPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getProperties@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_REVERB_PROPERTIES@@@Z
?getRecordDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2PAI@Z
?getRecordNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getRecordPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAI@Z
?getReverbProperties@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAM@Z
?getReverbProperties@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAUFMOD_REVERB_PROPERTIES@@@Z
?getRotation@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@0@Z
?getScale@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@@Z
?getSoftwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAW4FMOD_SPEAKERMODE@@0@Z
?getSound@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVSound@2@@Z
?getSoundGroup@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSoundGroup@2@@Z
?getSoundRAM@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH00@Z
?getSpeakerModeChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@PAH@Z
?getSpeakerPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PAM1PA_N@Z
?getStreamBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI0@Z
?getSubSound@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getSubSoundParent@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAV12@@Z
?getSyncPoint@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAUFMOD_SYNCPOINT@@@Z
?getSyncPointInfo@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_SYNCPOINT@@PADHPAII@Z
?getSystemObject@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?getSystemObject@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?getSystemObject@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?getSystemObject@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?getTag@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PBDHPAUFMOD_TAG@@@Z
?getType@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_DSP_TYPE@@@Z
?getType@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_DSPCONNECTION_TYPE@@@Z
?getUserData@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@GeometryI@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getUserDataInternal@SoundI@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getVolume@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?getVolumeRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getWetDryMix@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAM00@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?isPlaying@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?isRecording@System@FMOD@@QAG?AW4FMOD_RESULT@@HPA_N@Z
?isVirtual@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?loadGeometry@System@FMOD@@QAG?AW4FMOD_RESULT@@PBXHPAPAVGeometry@2@@Z
?loadPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAII@Z
?lock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIPAPAX0PAI1@Z
?lockDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?mixerResume@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?mixerSuspend@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?playDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?readData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAXIPAI@Z
?recordStart@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAVSound@2@_N@Z
?recordStop@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?registerCodec@System@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_CODEC_DESCRIPTION@@PAII@Z
?registerDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_DSP_DESCRIPTION@@PAI@Z
?registerOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_OUTPUT_DESCRIPTION@@PAI@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?removeCallback@AsyncThread@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@H@Z@Z
?removeDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@@Z
?removeFadePoints@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_K0@Z
?reset@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?save@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAXPAH@Z
?seekData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?set3DAttributes@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@MM@Z
?set3DConeOrientation@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@@Z
?set3DConeSettings@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?set3DConeSettings@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?set3DCustomRolloff@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@H@Z
?set3DCustomRolloff@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@H@Z
?set3DDistanceFilter@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_NMM@Z
?set3DDopplerLevel@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DLevel@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?set3DMinMaxDistance@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?set3DNumListeners@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?set3DOcclusion@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?set3DRolloffCallback@System@FMOD@@QAG?AW4FMOD_RESULT@@P6GMPAUFMOD_CHANNELCONTROL@@M@Z@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?set3DSpread@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setActive@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setActive@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setActive@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setAdvancedSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_ADVANCEDSETTINGS@@@Z
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setCallback@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_CHANNELCONTROL@@W4FMOD_CHANNELCONTROL_TYPE@@W4FMOD_CHANNELCONTROL_CALLBACK_TYPE@@PAX3@Z@Z
?setCallback@System@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_SYSTEM@@IPAX11@ZI@Z
?setChannelFormat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@@Z
?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?setDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@IH@Z
?setDSPIndex@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@H@Z
?setDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MH@Z
?setDelay@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_K0_N@Z
?setDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setFadePointRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_KM@Z
?setFileSystem@System@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PBDPAIPAPAXPAX@ZP6G?AW43@33@ZP6G?AW43@33I13@ZP6G?AW43@3I3@ZP6G?AW43@PAUFMOD_ASYNCREADINFO@@3@Z9H@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setGeometrySettings@System@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setLoopCount@Sound@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setLoopPoints@Channel@FMOD@@QAG?AW4FMOD_RESULT@@IIII@Z
?setLoopPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIII@Z
?setLowPassGain@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMaxAudible@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setMaxAudibleBehavior@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SOUNDGROUP_BEHAVIOR@@@Z
?setMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?setMix@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMixLevelsInput@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAMH@Z
?setMixLevelsOutput@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MMMMMMMM@Z
?setMixMatrix@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAMHHH@Z
?setMixMatrix@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAMHHH@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setMusicChannelVolume@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setMusicSpeed@Sound@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setMuteFadeSpeed@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setNetworkProxy@System@FMOD@@QAG?AW4FMOD_RESULT@@PBD@Z
?setNetworkTimeout@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?setOutputByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setPan@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setParameterBool@DSP@FMOD@@QAG?AW4FMOD_RESULT@@H_N@Z
?setParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAXI@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setParameterInt@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HH@Z
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setPitch@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setPluginPath@System@FMOD@@QAG?AW4FMOD_RESULT@@PBD@Z
?setPolygonAttributes@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@HMM_N@Z
?setPolygonVertex@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@HHPBUFMOD_VECTOR@@@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setPosition@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@@Z
?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setProperties@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_REVERB_PROPERTIES@@@Z
?setReverbProperties@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setReverbProperties@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_REVERB_PROPERTIES@@@Z
?setRotation@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?setScale@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@@Z
?setSoftwareChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?setSoundGroup@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAVSoundGroup@2@@Z
?setSpeakerPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@MM_N@Z
?setStreamBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?setUserData@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@GeometryI@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@Reverb3D@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@System@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserDataInternal@SoundI@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setVolume@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setVolumeRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setWetDryMix@DSP@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?showConfigDialog@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAX_N@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?stop@SoundGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unloadPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?unlock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAX0II@Z
?unlockDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?validate@ChannelI@FMOD@@SG?AW4FMOD_RESULT@@PAVChannel@2@PAPAV12@PAVSystemLockScope@2@@Z
?validate@DSPI@FMOD@@SG?AW4FMOD_RESULT@@PAVDSP@2@PAPAV12@PAVSystemLockScope@2@@Z
?validate@SystemI@FMOD@@SG?AW4FMOD_RESULT@@PAVSystem@2@PAPAV12@PAVSystemLockScope@2@@Z
?wakeupThread@AsyncThread@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_ChannelGroup_AddDSP
FMOD_ChannelGroup_AddFadePoint
FMOD_ChannelGroup_AddGroup
FMOD_ChannelGroup_Get3DAttributes
FMOD_ChannelGroup_Get3DConeOrientation
FMOD_ChannelGroup_Get3DConeSettings
FMOD_ChannelGroup_Get3DCustomRolloff
FMOD_ChannelGroup_Get3DDistanceFilter
FMOD_ChannelGroup_Get3DDopplerLevel
FMOD_ChannelGroup_Get3DLevel
FMOD_ChannelGroup_Get3DMinMaxDistance
FMOD_ChannelGroup_Get3DOcclusion
FMOD_ChannelGroup_Get3DSpread
FMOD_ChannelGroup_GetAudibility
FMOD_ChannelGroup_GetChannel
FMOD_ChannelGroup_GetDSP
FMOD_ChannelGroup_GetDSPClock
FMOD_ChannelGroup_GetDSPIndex
FMOD_ChannelGroup_GetDelay
FMOD_ChannelGroup_GetFadePoints
FMOD_ChannelGroup_GetGroup
FMOD_ChannelGroup_GetLowPassGain
FMOD_ChannelGroup_GetMixMatrix
FMOD_ChannelGroup_GetMode
FMOD_ChannelGroup_GetMute
FMOD_ChannelGroup_GetName
FMOD_ChannelGroup_GetNumChannels
FMOD_ChannelGroup_GetNumDSPs
FMOD_ChannelGroup_GetNumGroups
FMOD_ChannelGroup_GetParentGroup
FMOD_ChannelGroup_GetPaused
FMOD_ChannelGroup_GetPitch
FMOD_ChannelGroup_GetReverbProperties
FMOD_ChannelGroup_GetSystemObject
FMOD_ChannelGroup_GetUserData
FMOD_ChannelGroup_GetVolume
FMOD_ChannelGroup_GetVolumeRamp
FMOD_ChannelGroup_IsPlaying
FMOD_ChannelGroup_Release
FMOD_ChannelGroup_RemoveDSP
FMOD_ChannelGroup_RemoveFadePoints
FMOD_ChannelGroup_Set3DAttributes
FMOD_ChannelGroup_Set3DConeOrientation
FMOD_ChannelGroup_Set3DConeSettings
FMOD_ChannelGroup_Set3DCustomRolloff
FMOD_ChannelGroup_Set3DDistanceFilter
FMOD_ChannelGroup_Set3DDopplerLevel
FMOD_ChannelGroup_Set3DLevel
FMOD_ChannelGroup_Set3DMinMaxDistance
FMOD_ChannelGroup_Set3DOcclusion
FMOD_ChannelGroup_Set3DSpread
FMOD_ChannelGroup_SetCallback
FMOD_ChannelGroup_SetDSPIndex
FMOD_ChannelGroup_SetDelay
FMOD_ChannelGroup_SetFadePointRamp
FMOD_ChannelGroup_SetLowPassGain
FMOD_ChannelGroup_SetMixLevelsInput
FMOD_ChannelGroup_SetMixLevelsOutput
FMOD_ChannelGroup_SetMixMatrix
FMOD_ChannelGroup_SetMode
FMOD_ChannelGroup_SetMute
FMOD_ChannelGroup_SetPan
FMOD_ChannelGroup_SetPaused
FMOD_ChannelGroup_SetPitch
FMOD_ChannelGroup_SetReverbProperties
FMOD_ChannelGroup_SetUserData
FMOD_ChannelGroup_SetVolume
FMOD_ChannelGroup_SetVolumeRamp
FMOD_ChannelGroup_Stop
FMOD_Channel_AddDSP
FMOD_Channel_AddFadePoint
FMOD_Channel_Get3DAttributes
FMOD_Channel_Get3DConeOrientation
FMOD_Channel_Get3DConeSettings
FMOD_Channel_Get3DCustomRolloff
FMOD_Channel_Get3DDistanceFilter
FMOD_Channel_Get3DDopplerLevel
FMOD_Channel_Get3DLevel
FMOD_Channel_Get3DMinMaxDistance
FMOD_Channel_Get3DOcclusion
FMOD_Channel_Get3DSpread
FMOD_Channel_GetAudibility
FMOD_Channel_GetChannelGroup
FMOD_Channel_GetCurrentSound
FMOD_Channel_GetDSP
FMOD_Channel_GetDSPClock
FMOD_Channel_GetDSPIndex
FMOD_Channel_GetDelay
FMOD_Channel_GetFadePoints
FMOD_Channel_GetFrequency
FMOD_Channel_GetIndex
FMOD_Channel_GetLoopCount
FMOD_Channel_GetLoopPoints
FMOD_Channel_GetLowPassGain
FMOD_Channel_GetMixMatrix
FMOD_Channel_GetMode
FMOD_Channel_GetMute
FMOD_Channel_GetNumDSPs
FMOD_Channel_GetPaused
FMOD_Channel_GetPitch
FMOD_Channel_GetPosition
FMOD_Channel_GetPriority
FMOD_Channel_GetReverbProperties
FMOD_Channel_GetSystemObject
FMOD_Channel_GetUserData
FMOD_Channel_GetVolume
FMOD_Channel_GetVolumeRamp
FMOD_Channel_IsPlaying
FMOD_Channel_IsVirtual
FMOD_Channel_RemoveDSP
FMOD_Channel_RemoveFadePoints
FMOD_Channel_Set3DAttributes
FMOD_Channel_Set3DConeOrientation
FMOD_Channel_Set3DConeSettings
FMOD_Channel_Set3DCustomRolloff
FMOD_Channel_Set3DDistanceFilter
FMOD_Channel_Set3DDopplerLevel
FMOD_Channel_Set3DLevel
FMOD_Channel_Set3DMinMaxDistance
FMOD_Channel_Set3DOcclusion
FMOD_Channel_Set3DSpread
FMOD_Channel_SetCallback
FMOD_Channel_SetChannelGroup
FMOD_Channel_SetDSPIndex
FMOD_Channel_SetDelay
FMOD_Channel_SetFadePointRamp
FMOD_Channel_SetFrequency
FMOD_Channel_SetLoopCount
FMOD_Channel_SetLoopPoints
FMOD_Channel_SetLowPassGain
FMOD_Channel_SetMixLevelsInput
FMOD_Channel_SetMixLevelsOutput
FMOD_Channel_SetMixMatrix
FMOD_Channel_SetMode
FMOD_Channel_SetMute
FMOD_Channel_SetPan
FMOD_Channel_SetPaused
FMOD_Channel_SetPitch
FMOD_Channel_SetPosition
FMOD_Channel_SetPriority
FMOD_Channel_SetReverbProperties
FMOD_Channel_SetUserData
FMOD_Channel_SetVolume
FMOD_Channel_SetVolumeRamp
FMOD_Channel_Stop
FMOD_DSPConnection_GetInput
FMOD_DSPConnection_GetMix
FMOD_DSPConnection_GetMixMatrix
FMOD_DSPConnection_GetOutput
FMOD_DSPConnection_GetType
FMOD_DSPConnection_GetUserData
FMOD_DSPConnection_SetMix
FMOD_DSPConnection_SetMixMatrix
FMOD_DSPConnection_SetUserData
FMOD_DSP_AddInput
FMOD_DSP_DisconnectAll
FMOD_DSP_DisconnectFrom
FMOD_DSP_GetActive
FMOD_DSP_GetBypass
FMOD_DSP_GetChannelFormat
FMOD_DSP_GetDataParameterIndex
FMOD_DSP_GetIdle
FMOD_DSP_GetInfo
FMOD_DSP_GetInput
FMOD_DSP_GetMeteringEnabled
FMOD_DSP_GetMeteringInfo
FMOD_DSP_GetNumInputs
FMOD_DSP_GetNumOutputs
FMOD_DSP_GetNumParameters
FMOD_DSP_GetOutput
FMOD_DSP_GetOutputChannelFormat
FMOD_DSP_GetParameterBool

Sections

.text
Size: 1.1MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/fmodstudio.dll
.dll windows:6 windows x86 arch:x86

1c2d20afc06dd759e8ffde64f11cda02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

kernel32

SetEndOfFile
DecodePointer
HeapFree
RaiseException
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
GetFileType
ReadConsoleW
GetProcAddress
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
WriteFile
ReadFile
FlushFileBuffers
CloseHandle
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
RtlUnwind
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedIncrement
SetLastError
AreFileApisANSI
GetModuleHandleExW
ExitProcess
InterlockedDecrement
GetProcessHeap
IsDebuggerPresent
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
GetCommandLineA
LoadLibraryExW
ExitThread
CreateThread
HeapReAlloc
HeapAlloc
EncodePointer

ole32

CoInitializeEx
CoUninitialize

fmod

?getParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAXPAIPADH@Z
?getType@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_DSP_TYPE@@@Z
?validate@DSPI@FMOD@@SG?AW4FMOD_RESULT@@PAVDSP@2@PAPAV12@PAVSystemLockScope@2@@Z
?setVolumeRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setReverbProperties@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?setDelay@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_K0_N@Z
?getDelay@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_K0PA_N@Z
?addFadePoint@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_KM@Z
?setFadePointRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_KM@Z
?removeFadePoints@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_K0@Z
?setPriority@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getNumGroups@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getParentGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAPAV12@@Z
?getNumChannels@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getChannel@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?getAdvancedSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_ADVANCEDSETTINGS@@@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?playDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MH@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?getSubSound@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getLoopPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII0I@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getGlobals@FMOD@@YGXPAPAVGlobal@1@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createMemoryFile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVFile@2@@Z
?createDiskFile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAUFMOD_CREATESOUNDEXINFO@@PAPAVFile@2@PA_N@Z
?getAudibility@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?validate@ChannelI@FMOD@@SG?AW4FMOD_RESULT@@PAVChannel@2@PAPAV12@PAVSystemLockScope@2@@Z
?set3DNumListeners@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?isVirtual@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?createDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_DSP_DESCRIPTION@@PAPAVDSP@2@@Z
?getUserData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?getDefaultMixMatrix@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@0PAMH@Z
?getFormat@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_SOUND_TYPE@@PAW4FMOD_SOUND_FORMAT@@PAH2@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?isPlaying@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setMixMatrix@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAMHHH@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?getParameterInt@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAHPADH@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getCurrentSound@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSound@2@@Z
?setMixMatrix@DSPConnection@FMOD@@QAG?AW4FMOD_RESULT@@PAMHHH@Z
?getVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getSystemObject@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?createClientProfile@SystemI@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?validate@SystemI@FMOD@@SG?AW4FMOD_RESULT@@PAVSystem@2@PAPAV12@PAVSystemLockScope@2@@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?getFileUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PA_J00@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?getSpeakerModeChannels@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@PAH@Z
?get3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAUFMOD_VECTOR@@000@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?registerDSP@System@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_DSP_DESCRIPTION@@PAI@Z
?createDSPByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAPAVDSP@2@@Z
?unloadPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getDSPBufferSize@System@FMOD@@QAG?AW4FMOD_RESULT@@PAIPAH@Z
?getSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAW4FMOD_SPEAKERMODE@@0@Z
?getOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OUTPUTTYPE@@@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_System_Create
FMOD_Memory_GetStats
?getMeteringInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_DSP_METERING_INFO@@0@Z
?setParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAXI@Z
?setParameterBool@DSP@FMOD@@QAG?AW4FMOD_RESULT@@H_N@Z
?setParameterInt@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HH@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?getPluginHandle@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@HPAI@Z
?getNumPlugins@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_PLUGINTYPE@@PAH@Z
?getInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PADPAIPAH22@Z
?getParameterInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAUFMOD_DSP_PARAMETER_DESC@@@Z
?getNumParameters@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?getDSPInfoByPlugin@System@FMOD@@QAG?AW4FMOD_RESULT@@IPAPBUFMOD_DSP_DESCRIPTION@@@Z
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?disconnectFrom@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAVDSPConnection@2@@Z
?addInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAPAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?setMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?getIdle@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?reset@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setChannelFormat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@IHW4FMOD_SPEAKERMODE@@@Z
?setActive@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getSystemObject@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@_NPAPAVDSPConnection@2@@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getDSPIndex@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAH@Z
?removeDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@@Z
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?getDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVDSP@2@@Z
?getDSPClock@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_K0@Z
?setMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getPitch@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?setPitch@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DDopplerLevel@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getVolumeRamp@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?get3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM00@Z

Exports

Exports

?create@System@Studio@FMOD@@SG?AW4FMOD_RESULT@@PAPAV123@I@Z
?createInstance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventInstance@23@@Z
?flushCommands@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?flushSampleLoading@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?get3DAttributes@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_3D_ATTRIBUTES@@@Z
?getAdvancedSettings@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_STUDIO_ADVANCEDSETTINGS@@@Z
?getBank@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVBank@23@@Z
?getBankByID@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@PAPAVBank@23@@Z
?getBankCount@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getBankList@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVBank@23@HPAH@Z
?getBufferUsage@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_STUDIO_BUFFER_USAGE@@@Z
?getBus@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVBus@23@@Z
?getBusByID@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@PAPAVBus@23@@Z
?getBusCount@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getBusList@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVBus@23@HPAH@Z
?getCPUUsage@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_STUDIO_CPU_USAGE@@@Z
?getChannelGroup@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVChannelGroup@3@@Z
?getChannelGroup@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVChannelGroup@3@@Z
?getCommandAtTime@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@MPAH@Z
?getCommandCount@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getCommandInfo@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAUFMOD_STUDIO_COMMAND_INFO@@@Z
?getCommandString@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPADH@Z
?getCurrentCommand@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAHPAM@Z
?getDescription@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventDescription@23@@Z
?getDescription@ParameterInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getEvent@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVEventDescription@23@@Z
?getEventByID@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@PAPAVEventDescription@23@@Z
?getEventCount@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getEventList@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventDescription@23@HPAH@Z
?getID@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_GUID@@@Z
?getID@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_GUID@@@Z
?getID@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_GUID@@@Z
?getID@VCA@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAUFMOD_GUID@@@Z
?getInstanceCount@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getInstanceList@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVEventInstance@23@HPAH@Z
?getLength@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getLength@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getListenerAttributes@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAUFMOD_3D_ATTRIBUTES@@@Z
?getListenerMask@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAI@Z
?getListenerWeight@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HPAM@Z
?getLoadingState@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getLowLevelSystem@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAV13@@Z
?getMaximumDistance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getMinimumDistance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getMute@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?getNumListeners@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getParameter@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameter@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVParameterInstance@23@@Z
?getParameterByIndex@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameterByIndex@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAPAVParameterInstance@23@@Z
?getParameterCount@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getParameterCount@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getParameterValue@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAM1@Z
?getParameterValueByIndex@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HPAM0@Z
?getPath@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PADHPAH@Z
?getPath@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PADHPAH@Z
?getPath@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PADHPAH@Z
?getPath@VCA@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PADHPAH@Z
?getPaused@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?getPaused@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?getPaused@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?getPitch@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM0@Z
?getPlaybackState@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?getPlaybackState@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?getProperty@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@W4FMOD_STUDIO_EVENT_PROPERTY@@PAM@Z
?getReverbLevel@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAM@Z
?getSampleLoadingState@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getSampleLoadingState@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_LOADING_STATE@@@Z
?getSoundInfo@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAUFMOD_STUDIO_SOUND_INFO@@@Z
?getSoundSize@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getStringCount@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getStringInfo@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAUFMOD_GUID@@PADHPAH@Z
?getSystem@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVSystem@23@@Z
?getTimelinePosition@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getUserData@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@CommandReplay@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?getUserData@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAX@Z
?getUserProperty@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAUFMOD_STUDIO_USER_PROPERTY@@@Z
?getUserPropertyByIndex@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@HPAUFMOD_STUDIO_USER_PROPERTY@@@Z
?getUserPropertyCount@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getVCA@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAPAVVCA@23@@Z
?getVCAByID@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@PAPAVVCA@23@@Z
?getVCACount@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAH@Z
?getVCAList@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAPAVVCA@23@HPAH@Z
?getValue@ParameterInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?getVolume@Bus@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM0@Z
?getVolume@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM0@Z
?getVolume@VCA@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM0@Z
?hasCue@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?initialize@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HIIPAX@Z
?is3D@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?isOneshot@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?isSnapshot@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?isStream@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?isValid@Bank@Studio@FMOD@@QBG_NXZ
?isValid@Bus@Studio@FMOD@@QBG_NXZ
?isValid@CommandReplay@Studio@FMOD@@QBG_NXZ
?isValid@EventDescription@Studio@FMOD@@QBG_NXZ
?isValid@EventInstance@Studio@FMOD@@QBG_NXZ
?isValid@ParameterInstance@Studio@FMOD@@QBG_NXZ
?isValid@System@Studio@FMOD@@QBG_NXZ
?isValid@VCA@Studio@FMOD@@QBG_NXZ
?isVirtual@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PA_N@Z
?loadBankCustom@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_STUDIO_BANK_INFO@@IPAPAVBank@23@@Z
?loadBankFile@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAPAVBank@23@@Z
?loadBankMemory@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDHW4FMOD_STUDIO_LOAD_MEMORY_MODE@@IPAPAVBank@23@@Z
?loadCommandReplay@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAPAVCommandReplay@23@@Z
?loadSampleData@Bank@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?loadSampleData@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?lockChannelGroup@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?lookupID@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBDPAUFMOD_GUID@@@Z
?lookupPath@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@PADHPAH@Z
?registerPlugin@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_DSP_DESCRIPTION@@@Z
?release@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?releaseAllInstances@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?resetBufferUsage@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?seekToCommand@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?seekToTime@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DAttributes@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_3D_ATTRIBUTES@@@Z
?setAdvancedSettings@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_STUDIO_ADVANCEDSETTINGS@@@Z
?setBankPath@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBD@Z
?setCallback@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@IPAUFMOD_STUDIO_EVENTINSTANCE@@PAX@ZI@Z
?setCallback@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@IPAUFMOD_STUDIO_EVENTINSTANCE@@PAX@ZI@Z
?setCallback@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@PAUFMOD_STUDIO_SYSTEM@@IPAX1@ZI@Z
?setCreateInstanceCallback@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@PAUFMOD_STUDIO_COMMANDREPLAY@@HPAUFMOD_STUDIO_EVENTDESCRIPTION@@PAPAUFMOD_STUDIO_EVENTINSTANCE@@PAX@Z@Z
?setFrameCallback@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@PAUFMOD_STUDIO_COMMANDREPLAY@@HMPAX@Z@Z
?setListenerAttributes@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_3D_ATTRIBUTES@@@Z
?setListenerMask@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setListenerWeight@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setLoadBankCallback@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@PAUFMOD_STUDIO_COMMANDREPLAY@@HPBUFMOD_GUID@@PBDIPAPAUFMOD_STUDIO_BANK@@PAX@Z@Z
?setMute@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setNumListeners@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setParameterValue@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDM@Z
?setParameterValueByIndex@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setParameterValuesByIndices@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAMH@Z
?setPaused@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setPaused@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setPaused@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setPitch@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setProperty@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_STUDIO_EVENT_PROPERTY@@M@Z
?setReverbLevel@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setTimelinePosition@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?setUserData@Bank@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setUserData@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setValue@ParameterInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setVolume@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setVolume@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setVolume@VCA@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?start@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?start@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?startCommandCapture@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDI@Z
?stop@CommandReplay@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?stop@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?stopAllEvents@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?stopCommandCapture@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?triggerCue@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unload@Bank@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unloadAll@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unloadSampleData@Bank@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unloadSampleData@EventDescription@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unlockChannelGroup@Bus@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?unregisterPlugin@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBD@Z
?update@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_Studio_Bank_GetBusCount
FMOD_Studio_Bank_GetBusList
FMOD_Studio_Bank_GetEventCount
FMOD_Studio_Bank_GetEventList
FMOD_Studio_Bank_GetID
FMOD_Studio_Bank_GetLoadingState
FMOD_Studio_Bank_GetPath
FMOD_Studio_Bank_GetSampleLoadingState
FMOD_Studio_Bank_GetStringCount
FMOD_Studio_Bank_GetStringInfo
FMOD_Studio_Bank_GetUserData
FMOD_Studio_Bank_GetVCACount
FMOD_Studio_Bank_GetVCAList
FMOD_Studio_Bank_IsValid
FMOD_Studio_Bank_LoadSampleData
FMOD_Studio_Bank_SetUserData
FMOD_Studio_Bank_Unload
FMOD_Studio_Bank_UnloadSampleData
FMOD_Studio_Bus_GetChannelGroup
FMOD_Studio_Bus_GetID
FMOD_Studio_Bus_GetMute
FMOD_Studio_Bus_GetPath
FMOD_Studio_Bus_GetPaused
FMOD_Studio_Bus_GetVolume
FMOD_Studio_Bus_IsValid
FMOD_Studio_Bus_LockChannelGroup
FMOD_Studio_Bus_SetMute
FMOD_Studio_Bus_SetPaused
FMOD_Studio_Bus_SetVolume
FMOD_Studio_Bus_StopAllEvents
FMOD_Studio_Bus_UnlockChannelGroup
FMOD_Studio_CommandReplay_GetCommandAtTime
FMOD_Studio_CommandReplay_GetCommandCount
FMOD_Studio_CommandReplay_GetCommandInfo
FMOD_Studio_CommandReplay_GetCommandString
FMOD_Studio_CommandReplay_GetCurrentCommand
FMOD_Studio_CommandReplay_GetLength
FMOD_Studio_CommandReplay_GetPaused
FMOD_Studio_CommandReplay_GetPlaybackState
FMOD_Studio_CommandReplay_GetSystem
FMOD_Studio_CommandReplay_GetUserData
FMOD_Studio_CommandReplay_IsValid
FMOD_Studio_CommandReplay_Release
FMOD_Studio_CommandReplay_SeekToCommand
FMOD_Studio_CommandReplay_SeekToTime
FMOD_Studio_CommandReplay_SetBankPath
FMOD_Studio_CommandReplay_SetCreateInstanceCallback
FMOD_Studio_CommandReplay_SetFrameCallback
FMOD_Studio_CommandReplay_SetLoadBankCallback
FMOD_Studio_CommandReplay_SetPaused
FMOD_Studio_CommandReplay_SetUserData
FMOD_Studio_CommandReplay_Start
FMOD_Studio_CommandReplay_Stop
FMOD_Studio_EventDescription_CreateInstance
FMOD_Studio_EventDescription_GetID
FMOD_Studio_EventDescription_GetInstanceCount
FMOD_Studio_EventDescription_GetInstanceList
FMOD_Studio_EventDescription_GetLength
FMOD_Studio_EventDescription_GetMaximumDistance
FMOD_Studio_EventDescription_GetMinimumDistance
FMOD_Studio_EventDescription_GetParameter
FMOD_Studio_EventDescription_GetParameterByIndex
FMOD_Studio_EventDescription_GetParameterCount
FMOD_Studio_EventDescription_GetPath
FMOD_Studio_EventDescription_GetSampleLoadingState
FMOD_Studio_EventDescription_GetSoundSize
FMOD_Studio_EventDescription_GetUserData
FMOD_Studio_EventDescription_GetUserProperty
FMOD_Studio_EventDescription_GetUserPropertyByIndex
FMOD_Studio_EventDescription_GetUserPropertyCount
FMOD_Studio_EventDescription_HasCue
FMOD_Studio_EventDescription_Is3D
FMOD_Studio_EventDescription_IsOneshot
FMOD_Studio_EventDescription_IsSnapshot
FMOD_Studio_EventDescription_IsStream
FMOD_Studio_EventDescription_IsValid
FMOD_Studio_EventDescription_LoadSampleData
FMOD_Studio_EventDescription_ReleaseAllInstances
FMOD_Studio_EventDescription_SetCallback
FMOD_Studio_EventDescription_SetUserData
FMOD_Studio_EventDescription_UnloadSampleData
FMOD_Studio_EventInstance_Get3DAttributes
FMOD_Studio_EventInstance_GetChannelGroup
FMOD_Studio_EventInstance_GetDescription
FMOD_Studio_EventInstance_GetListenerMask
FMOD_Studio_EventInstance_GetParameter
FMOD_Studio_EventInstance_GetParameterByIndex
FMOD_Studio_EventInstance_GetParameterCount
FMOD_Studio_EventInstance_GetParameterValue
FMOD_Studio_EventInstance_GetParameterValueByIndex
FMOD_Studio_EventInstance_GetPaused
FMOD_Studio_EventInstance_GetPitch
FMOD_Studio_EventInstance_GetPlaybackState
FMOD_Studio_EventInstance_GetProperty
FMOD_Studio_EventInstance_GetReverbLevel
FMOD_Studio_EventInstance_GetTimelinePosition
FMOD_Studio_EventInstance_GetUserData
FMOD_Studio_EventInstance_GetVolume
FMOD_Studio_EventInstance_IsValid
FMOD_Studio_EventInstance_IsVirtual
FMOD_Studio_EventInstance_Release
FMOD_Studio_EventInstance_Set3DAttributes
FMOD_Studio_EventInstance_SetCallback
FMOD_Studio_EventInstance_SetListenerMask
FMOD_Studio_EventInstance_SetParameterValue
FMOD_Studio_EventInstance_SetParameterValueByIndex
FMOD_Studio_EventInstance_SetParameterValuesByIndices
FMOD_Studio_EventInstance_SetPaused
FMOD_Studio_EventInstance_SetPitch
FMOD_Studio_EventInstance_SetProperty
FMOD_Studio_EventInstance_SetReverbLevel
FMOD_Studio_EventInstance_SetTimelinePosition
FMOD_Studio_EventInstance_SetUserData
FMOD_Studio_EventInstance_SetVolume
FMOD_Studio_EventInstance_Start
FMOD_Studio_EventInstance_Stop
FMOD_Studio_EventInstance_TriggerCue
FMOD_Studio_ParameterInstance_GetDescription
FMOD_Studio_ParameterInstance_GetValue
FMOD_Studio_ParameterInstance_IsValid
FMOD_Studio_ParameterInstance_SetValue
FMOD_Studio_ParseID
FMOD_Studio_System_Create
FMOD_Studio_System_FlushCommands
FMOD_Studio_System_FlushSampleLoading
FMOD_Studio_System_GetAdvancedSettings
FMOD_Studio_System_GetBank
FMOD_Studio_System_GetBankByID
FMOD_Studio_System_GetBankCount
FMOD_Studio_System_GetBankList
FMOD_Studio_System_GetBufferUsage
FMOD_Studio_System_GetBus
FMOD_Studio_System_GetBusByID
FMOD_Studio_System_GetCPUUsage
FMOD_Studio_System_GetEvent
FMOD_Studio_System_GetEventByID
FMOD_Studio_System_GetListenerAttributes
FMOD_Studio_System_GetListenerWeight
FMOD_Studio_System_GetLowLevelSystem
FMOD_Studio_System_GetNumListeners
FMOD_Studio_System_GetSoundInfo
FMOD_Studio_System_GetUserData
FMOD_Studio_System_GetVCA
FMOD_Studio_System_GetVCAByID
FMOD_Studio_System_Initialize
FMOD_Studio_System_IsValid
FMOD_Studio_System_LoadBankCustom
FMOD_Studio_System_LoadBankFile
FMOD_Studio_System_LoadBankMemory
FMOD_Studio_System_LoadCommandReplay
FMOD_Studio_System_LookupID
FMOD_Studio_System_LookupPath
FMOD_Studio_System_RegisterPlugin
FMOD_Studio_System_Release
FMOD_Studio_System_ResetBufferUsage
FMOD_Studio_System_SetAdvancedSettings
FMOD_Studio_System_SetCallback
FMOD_Studio_System_SetListenerAttributes
FMOD_Studio_System_SetListenerWeight
FMOD_Studio_System_SetNumListeners
FMOD_Studio_System_SetUserData
FMOD_Studio_System_StartCommandCapture
FMOD_Studio_System_StopCommandCapture
FMOD_Studio_System_UnloadAll
FMOD_Studio_System_UnregisterPlugin
FMOD_Studio_System_Update
FMOD_Studio_VCA_GetID
FMOD_Studio_VCA_GetPath
FMOD_Studio_VCA_GetVolume
FMOD_Studio_VCA_IsValid
FMOD_Studio_VCA_SetVolume

Sections

.text
Size: 932KB - Virtual size: 931KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/fsbank.dll
.dll windows:6 windows x86 arch:x86

7b00c570335eaed97199fa28db5dc83b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindFirstFileExW
RaiseException
FreeLibrary
GetProcAddress
GetCurrentThreadId
SetThreadPriority
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
CloseHandle
CreateSemaphoreA
LoadLibraryW
CreateFileW
QueryPerformanceCounter
MultiByteToWideChar
HeapSize
SetEndOfFile
GetTimeZoneInformation
GetStringTypeW
WriteConsoleW
SetStdHandle
LCMapStringW
CompareStringW
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
CreateDirectoryW
FileTimeToLocalFileTime
FindClose
SetEnvironmentVariableA
GetDriveTypeW
FileTimeToSystemTime
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetProcessHeap
InterlockedDecrement
ExitProcess
GetModuleHandleExW
SetLastError
InterlockedIncrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
WideCharToMultiByte
GetConsoleCP
RtlUnwind
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
GetModuleFileNameA
GetCurrentProcessId

ole32

CoInitializeEx
CoUninitialize

fmod

FMOD_Memory_GetStats
FMOD_Memory_Initialize
?getLoopPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII0I@Z
?getSyncPointInfo@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_SYNCPOINT@@PADHPAII@Z
?getSyncPoint@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAUFMOD_SYNCPOINT@@@Z
?getNumSyncPoints@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?readData@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAXIPAI@Z
?getNumSubSounds@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getFormat@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_SOUND_TYPE@@PAW4FMOD_SOUND_FORMAT@@PAH2@Z
FMOD_Debug_Initialize
?getSubSound@Sound@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_System_Create
?getGlobals@FMOD@@YGXPAPAVGlobal@1@@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z

Exports

Exports

_FSBank_Build@28
_FSBank_BuildCancel@0
_FSBank_FetchFSBMemory@8
_FSBank_FetchNextProgressItem@4
_FSBank_Init@16
_FSBank_MemoryGetStats@8
_FSBank_MemoryInit@12
_FSBank_Release@0
_FSBank_ReleaseProgressItem@4

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/gog.ico
CARRION v1.0.5.617-PiviGames.blog/x32/goggame-1785384169.hashdb
.zip
goggame-1785384169.hashdb
CARRION v1.0.5.617-PiviGames.blog/x32/goggame-1785384169.ico
CARRION v1.0.5.617-PiviGames.blog/x32/goggame-1785384169.info
CARRION v1.0.5.617-PiviGames.blog/x32/hostfxr.dll
.dll windows:6 windows x86 arch:x86

585117a8646051ec7b33d62ddd70f8b1

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:3f:07:bd:7b:54:9c:41:7f:64:27:0c:68:13:fb:6e:cc:12:fa:17:f2:1c:f3:11:00:88:a8:a6:24:ea:e1:fb
Signer

Actual PE Digest

a8:3f:07:bd:7b:54:9c:41:7f:64:27:0c:68:13:fb:6e:cc:12:fa:17:f2:1c:f3:11:00:88:a8:a6:24:ea:e1:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
CloseHandle
GetLastError
InitializeCriticalSection
GetEnvironmentVariableW
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
OutputDebugStringW
FormatMessageW
EnterCriticalSection
GetModuleHandleA
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
Sleep
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
GetCurrentThreadId
TryEnterCriticalSection
RaiseException
DecodePointer
EncodePointer
GetStringTypeW

advapi32

RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initterm
_initialize_onexit_table
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_register_onexit_function
terminate
_execute_onexit_table
_initterm_e
_errno
abort
_invalid_parameter_noinfo_noreturn
_crt_atexit
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free
calloc
_callnewh
malloc

api-ms-win-crt-stdio-l1-1-0

fputc
fgetpos
fgetc
fsetpos
fclose
_get_stream_buffer_pointers
_fseeki64
fwrite
__acrt_iob_func
fputwc
fputws
_wfopen
setvbuf
__stdio_common_vfwprintf
__stdio_common_vswprintf
ungetc
__stdio_common_vswprintf_s
_wfsopen
fseek
fread
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
fflush

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-string-l1-1-0

_wcsdup
strcpy_s
islower
__strncnt
towlower
_wcsnicmp
wcsncmp
isupper
_wcsicmp
memset
strcspn
iswspace
_isctype_l
wcsnlen
strnlen

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_free_locale
_create_locale
___mb_cur_max_func
___lc_locale_name_func
__pctype_func
___lc_codepage_func
_lock_locales
localeconv
setlocale

api-ms-win-crt-convert-l1-1-0

_strtod_l
_i64tow_s
_ui64tow_s
_i64toa_s
_ui64toa_s
wcstoul
_wtoi

api-ms-win-crt-math-l1-1-0

_CIexp
_CIsqrt
_except1
frexp

api-ms-win-crt-time-l1-1-0

wcsftime
_gmtime64
_time64

Exports

Exports

hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value

Sections

.text
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/hostpolicy.dll
.dll windows:6 windows x86 arch:x86

0b92dc882d8fabe686c0fb2f31d03bba

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:bf:94:ca:21:39:cf:51:76:23:30:42:47:14:8f:2b:37:14:a2:01:21:f3:5c:14:9f:cd:09:36:c1:7e:9c:60
Signer

Actual PE Digest

51:bf:94:ca:21:39:cf:51:76:23:30:42:47:14:8f:2b:37:14:a2:01:21:f3:5c:14:9f:cd:09:36:c1:7e:9c:60

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
CloseHandle
GetLastError
InitializeCriticalSection
GetEnvironmentVariableW
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
OutputDebugStringW
FormatMessageW
EnterCriticalSection
GetModuleHandleA
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
LCMapStringW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
QueryPerformanceCounter
RaiseException
DecodePointer
EncodePointer
GetStringTypeW
TryEnterCriticalSection
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
SwitchToThread
Sleep
DuplicateHandle
WaitForSingleObjectEx

advapi32

RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_seh_filter_dll
_execute_onexit_table
_initterm_e
_errno
_cexit
_beginthreadex
abort
_initterm
_invalid_parameter_noinfo_noreturn
terminate
_crt_atexit
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsdup
islower
__strncnt
strcpy_s
towlower
_wcsnicmp
wcsncmp
isupper
memset
_wcsicmp
strcspn
iswspace
_isctype_l
wcsnlen
strnlen

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers
fflush
fgetc
fgetpos
fputc
fread
fsetpos
_fseeki64
fwrite
setvbuf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
fclose
__stdio_common_vswprintf_s
__acrt_iob_func
fputwc
fputws
_wfopen
_wfsopen
fseek
__stdio_common_vfwprintf
__stdio_common_vswprintf
ungetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
setlocale
__pctype_func
___lc_locale_name_func
___mb_cur_max_func
___lc_codepage_func
_lock_locales
_unlock_locales
localeconv

api-ms-win-crt-convert-l1-1-0

_strtod_l
_i64tow_s
_ui64tow_s
_i64toa_s
_ui64toa_s
wcstoul
_wtoi

api-ms-win-crt-math-l1-1-0

_CIsqrt
_CIexp
frexp
_except1

api-ms-win-crt-time-l1-1-0

wcsftime
_gmtime64
_time64

Exports

Exports

corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/libfsbvorbis.dll
.dll windows:5 windows x86 arch:x86

f8bf267c38ccf72fbcd0ba0721300fba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
RaiseException
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
RtlUnwind
GetStringTypeW

Exports

Exports

_floor_P
_mapping_P
_residue_P
vorbis_analysis
vorbis_analysis_blockout
vorbis_analysis_buffer
vorbis_analysis_headerout
vorbis_analysis_init
vorbis_analysis_wrote
vorbis_bitrate_addblock
vorbis_bitrate_flushpacket
vorbis_block_clear
vorbis_block_init
vorbis_comment_add
vorbis_comment_add_tag
vorbis_comment_clear
vorbis_comment_init
vorbis_comment_query
vorbis_comment_query_count
vorbis_commentheader_out
vorbis_dsp_clear
vorbis_encode_ctl
vorbis_encode_init
vorbis_encode_init_vbr
vorbis_encode_setup_init
vorbis_encode_setup_managed
vorbis_encode_setup_vbr
vorbis_granule_time
vorbis_info_blocksize
vorbis_info_clear
vorbis_info_init
vorbis_packet_blocksize
vorbis_synthesis
vorbis_synthesis_blockin
vorbis_synthesis_halfrate
vorbis_synthesis_halfrate_p
vorbis_synthesis_headerin
vorbis_synthesis_idheader
vorbis_synthesis_init
vorbis_synthesis_lapout
vorbis_synthesis_pcmout
vorbis_synthesis_read
vorbis_synthesis_restart
vorbis_synthesis_trackonly
vorbis_version_string
vorbis_window

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/lua54.dll
.dll windows:6 windows x86 arch:x86

d72f799f268279889f70998b674569c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ReadFile
CloseHandle
DuplicateHandle
CreateProcessW
GetTempPathW
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
GetFileSizeEx
SetFilePointerEx
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
DecodePointer
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
MoveFileExW
GetCPInfo
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
HeapSize
SetEndOfFile

Exports

Exports

luaL_addgsub
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_buffinitsize
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_checkversion_
luaL_error
luaL_execresult
luaL_fileresult
luaL_getmetafield
luaL_getsubtable
luaL_gsub
luaL_len
luaL_loadbufferx
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffsize
luaL_pushresult
luaL_pushresultsize
luaL_ref
luaL_requiref
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_tolstring
luaL_traceback
luaL_typeerror
luaL_unref
luaL_where
lua_absindex
lua_arith
lua_atpanic
lua_callk
lua_checkstack
lua_close
lua_compare
lua_concat
lua_copy
lua_createtable
lua_dump
lua_error
lua_gc
lua_getallocf
lua_getfield
lua_getglobal
lua_gethook
lua_gethookcount
lua_gethookmask
lua_geti
lua_getinfo
lua_getiuservalue
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_iscfunction
lua_isinteger
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_len
lua_load
lua_newstate
lua_newthread
lua_newuserdatauv
lua_next
lua_pcallk
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawgetp
lua_rawlen
lua_rawset
lua_rawseti
lua_rawsetp
lua_resetthread
lua_resume
lua_rotate
lua_setallocf
lua_setcstacklimit
lua_setfield
lua_setglobal
lua_sethook
lua_seti
lua_setiuservalue
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_setwarnf
lua_status
lua_stringtonumber
lua_toboolean
lua_tocfunction
lua_toclose
lua_tointegerx
lua_tolstring
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_warning
lua_xmove
lua_yieldk
luaopen_base
luaopen_coroutine
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
luaopen_utf8

Sections

.text
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscordaccore.dll
.dll windows:6 windows x86 arch:x86

b48f4be60ce658f8283045be599a540f

Code Sign

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:29

Not After

03/03/2021, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:63:da:c2:9b:a7:c0:04:47:54:02:d5:eb:0b:4a:9e:87:53:18:95:fa:bf:57:df:29:b7:fa:8a:37:1d:56:77
Signer

Actual PE Digest

fd:63:da:c2:9b:a7:c0:04:47:54:02:d5:eb:0b:4a:9e:87:53:18:95:fa:bf:57:df:29:b7:fa:8a:37:1d:56:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
TlsGetValue
TlsAlloc
TlsFree
RaiseException
TlsSetValue
CreateEventW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
DebugBreak
GetProcessAffinityMask
SwitchToThread
GetEnvironmentVariableW
GetFullPathNameW
ReadProcessMemory
LoadLibraryExW
CreateFileW
GetModuleFileNameW
TerminateProcess
OutputDebugStringW
IsDebuggerPresent
RaiseFailFastException
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoTaskMemFree
CoCreateGuid
IIDFromString

oleaut32

SetErrorInfo
CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s
wcscat_s
strcmp
strcpy_s
strlen
strncat_s
wcsncat_s
wcsncmp
_wcslwr_s
wcscpy_s
strncmp
strncpy_s
strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
abort
_cexit
_errno
_execute_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
_putws
__stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 704KB - Virtual size: 703KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscordaccore_x86_x86_4.700.20.26901.dll
.dll windows:6 windows x86 arch:x86

b48f4be60ce658f8283045be599a540f

Code Sign

33:00:00:03:25:48:b2:9d:0e:7f:c5:f4:1f:00:00:00:00:03:25
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:29

Not After

03/03/2021, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:63:da:c2:9b:a7:c0:04:47:54:02:d5:eb:0b:4a:9e:87:53:18:95:fa:bf:57:df:29:b7:fa:8a:37:1d:56:77
Signer

Actual PE Digest

fd:63:da:c2:9b:a7:c0:04:47:54:02:d5:eb:0b:4a:9e:87:53:18:95:fa:bf:57:df:29:b7:fa:8a:37:1d:56:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
TlsGetValue
TlsAlloc
TlsFree
RaiseException
TlsSetValue
CreateEventW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
DebugBreak
GetProcessAffinityMask
SwitchToThread
GetEnvironmentVariableW
GetFullPathNameW
ReadProcessMemory
LoadLibraryExW
CreateFileW
GetModuleFileNameW
TerminateProcess
OutputDebugStringW
IsDebuggerPresent
RaiseFailFastException
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoTaskMemFree
CoCreateGuid
IIDFromString

oleaut32

SetErrorInfo
CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s
wcscat_s
strcmp
strcpy_s
strlen
strncat_s
wcsncat_s
wcsncmp
_wcslwr_s
wcscpy_s
strncmp
strncpy_s
strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
abort
_cexit
_errno
_execute_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
_putws
__stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 704KB - Virtual size: 703KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscordbi.dll
.dll windows:6 windows x86 arch:x86

406ce9b644c8bf4e31063e1f8559d643

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:fa:70:2c:86:12:f6:bf:2c:38:0e:8c:02:ba:1c:21:32:d2:a7:39:a0:06:4b:6b:34:50:21:f9:ee:65:28:20
Signer

Actual PE Digest

17:fa:70:2c:86:12:f6:bf:2c:38:0e:8c:02:ba:1c:21:32:d2:a7:39:a0:06:4b:6b:34:50:21:f9:ee:65:28:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenThread
SuspendThread
ResumeThread
DuplicateHandle
CreateThread
TerminateProcess
GetThreadContext
SetThreadContext
ContinueDebugEvent
FreeLibrary
VirtualQueryEx
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
OpenProcess
GetCurrentProcessId
IsWow64Process
ReadProcessMemory
WriteProcessMemory
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
GetSystemInfo
IsDebuggerPresent
DebugBreak
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
FlushInstructionCache
GetEnvironmentVariableW
GetFullPathNameW
MultiByteToWideChar
SwitchToThread
GetCurrentThread
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
CreateProcessW
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
WriteFile
SetFilePointer
FlushFileBuffers
ReadFile
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetProcAddress
WaitForSingleObject
LoadLibraryW
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

ole32

IIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateGuid

oleaut32

SetErrorInfo
VariantInit
CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

strncpy_s
wcsncmp
strncmp
wcsncat_s
wcscpy_s
_wcsicmp
wcscat_s
wcsncpy_s
strcpy_s
wcsnlen

api-ms-win-crt-runtime-l1-1-0

_cexit
_invalid_parameter_noinfo
_errno
abort
_initterm
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__acrt_iob_func

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_wmakepath_s

api-ms-win-crt-utility-l1-1-0

bsearch
qsort

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

CoreCLRCreateCordbObject
CoreCLRCreateCordbObjectEx
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
OpenVirtualProcessImpl2

Sections

.text
Size: 747KB - Virtual size: 746KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscorlib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:4b:ee:8e:39:3f:02:1c:f4:85:06:f8:1d:87:29:15:62:03:c9:f4:ad:07:48:7e:fe:f4:3e:8e:49:d4:dd:15
Signer

Actual PE Digest

d5:4b:ee:8e:39:3f:02:1c:f4:85:06:f8:1d:87:29:15:62:03:c9:f4:ad:07:48:7e:fe:f4:3e:8e:49:d4:dd:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscorrc.debug.dll
.dll windows:6 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:d1:28:c0:c0:5f:c3:fe:3e:82:bb:f8:af:06:5c:ae:20:9a:4e:5a:20:ee:85:2c:01:c4:c0:7f:f5:75:af:7b
Signer

Actual PE Digest

bd:d1:28:c0:c0:5f:c3:fe:3e:82:bb:f8:af:06:5c:ae:20:9a:4e:5a:20:ee:85:2c:01:c4:c0:7f:f5:75:af:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/mscorrc.dll
.dll windows:6 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:45:20:ec:7e:bc:d7:7f:6f:a6:07:00:a8:17:93:f3:3b:90:29:8c:4c:3c:f1:64:5e:f4:4d:1f:aa:2c:7e:a7
Signer

Actual PE Digest

6f:45:20:ec:7e:bc:d7:7f:6f:a6:07:00:a8:17:93:f3:3b:90:29:8c:4c:3c:f1:64:5e:f4:4d:1f:aa:2c:7e:a7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/netstandard.dll
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:01:88:af:52:d6:b9:92:6d:e8:f9:00:00:00:00:01:88
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:7c:77:6d:7d:1a:d7:68:bb:6b:5e:4f:a4:c5:a7:9b:16:6b:ca:d8:bc:ce:da:6d:7d:2a:1d:1e:2d:39:66:fe
Signer

Actual PE Digest

38:7c:77:6d:7d:1a:d7:68:bb:6b:5e:4f:a4:c5:a7:9b:16:6b:ca:d8:bc:ce:da:6d:7d:2a:1d:1e:2d:39:66:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/support.ico
CARRION v1.0.5.617-PiviGames.blog/x32/ucrtbase.dll
.dll windows:10 windows x86 arch:x86

e97d8949b62ac66aa0d4cfccf17c8a2e

Code Sign

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/09/2017, 18:07

Not After

12/09/2018, 18:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:aa:01:6d:b0:35:c9:61:c8:d9:c3:fe:74:38:8e:42:06:ff:c6:fb:86:9d:17:2d:bb:49:99:de:0f:db:71:37
Signer

Actual PE Digest

30:aa:01:6d:b0:35:c9:61:c8:d9:c3:fe:74:38:8e:42:06:ff:c6:fb:86:9d:17:2d:bb:49:99:de:0f:db:71:37

Digest Algorithm

sha256

PE Digest Matches

true

7e:11:3c:29:b8:de:a4:9c:00:ae:7e:79:e2:be:8d:21:f4:00:84:34
Signer

Actual PE Digest

7e:11:3c:29:b8:de:a4:9c:00:ae:7e:79:e2:be:8d:21:f4:00:84:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
RaiseException
GetLastError
SetLastError

api-ms-win-core-heap-l1-1-0

HeapSize
HeapAlloc
HeapCompact
HeapValidate
HeapReAlloc
HeapQueryInformation
GetProcessHeap
HeapWalk
HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetCurrentProcess
TlsAlloc
TerminateProcess
TlsSetValue
GetCurrentThreadId
TlsGetValue
ExitProcess
TlsFree
GetCurrentProcessId
GetExitCodeProcess
ResumeThread
ExitThread
CreateThread
CreateProcessW
GetStartupInfoW

api-ms-win-core-file-l1-1-0

WriteFile
GetDiskFreeSpaceW
GetLogicalDrives
SetFileTime
SetFilePointerEx
LockFileEx
UnlockFileEx
FlushFileBuffers
SetEndOfFile
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
GetFileAttributesExW
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
FindFirstFileExW
CreateFileW
FindNextFileW
ReadFile
GetFileType
FindClose

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW
GetStdHandle
GetCommandLineA
FreeEnvironmentStringsW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCommandLineW
GetCurrentDirectoryW
SetStdHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
GetStringTypeW
CompareStringW
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
GetCPInfo
GetACP
IsValidCodePage
GetLocaleInfoW
LCMapStringW
EnumSystemLocalesW
IsValidLocale
GetOEMCP

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetLocalTime
SetLocalTime
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleInputW
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleCP
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleW
PeekConsoleInputA
GetConsoleMode

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe
PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualQuery
VirtualProtect

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer
Beep

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList
InterlockedPushEntrySList

Exports

Exports

_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_Exit
_FCbuild
_FCmulcc
_FCmulcr
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_IsExceptionObjectToBeDestroyed
_LCbuild
_LCmulcc
_LCmulcr
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__acrt_iob_func
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
__control87_2
__current_exception
__current_exception_context
__daylight
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__doserrno
__dstbias
__fpe_flt_rounds
__fpecode
__initialize_lconv_for_unsigned_char
__intrinsic_abnormal_termination
__intrinsic_setjmp
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__environ
__p__fmode
__p__mbcasemap
__p__mbctype
__p__pgmptr
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__processing_throw
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__setusermatherr
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__strncnt
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__wcserror
__wcserror_s
__wcsncnt
_abs64
_access
_access_s
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_base
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chgsignf
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_configthreadlocale
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_copysign
_copysignf
_cputs
_cputws
_creat
_create_locale
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_d_int
_dclass
_dexp
_difftime32
_difftime64
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_endthread
_endthreadex
_eof
_errno
_except1
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execute_onexit_table
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flushall
_fpclass
_fpieee_flt
_fpreset
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_base
_free_locale
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwrite_nolock
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_osfhandle
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_stream_buffer_pointers
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_timezone
_get_tzname
_get_unexpected
_get_wide_winmain_command_line
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwc_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapchk
_heapmin
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_is_exception_typeof
_isalnum_l
_isalpha_l
_isatty
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_isnan
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CARRION v1.0.5.617-PiviGames.blog/x32/webcache.zip
.zip
77b058909cf17f0aa662e5e798e4a54a88f23aed14cfa3d829ce43f9487bad71.jpg
.jpg
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_menu_notification_av.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_menu_notification_av2.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_sbicon.png
.png
c705a75fef7bba61daf146eafee31a4ec2a6879db512e22a8735d9fe6c8341f3_sbicon_2x.png
.png
fbb450bb1c6db10a6680dcbf4ceea307b0ab9c83c7f32ab52cc2e6c51d6c3f78_glx_logo.jpg
.jpg
fbb450bb1c6db10a6680dcbf4ceea307b0ab9c83c7f32ab52cc2e6c51d6c3f78_glx_logo_2x.jpg
.jpg
resources.json

Sharing

General

Malware Config

Signatures

Files

5f4ff962dc52febac00d344b025c1959

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

bcrypt

Sections

.text Size: 616KB - Virtual size: 616KB

.managed Size: 13.7MB - Virtual size: 13.7MB

.rdata Size: 12.1MB - Virtual size: 12.1MB

.data Size: 1.0MB - Virtual size: 1.0MB

.pdata Size: 1017KB - Virtual size: 1017KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 103KB - Virtual size: 103KB

.reloc Size: 512KB - Virtual size: 512KB

53c1944248ee9ddf1a5409f6de728cd0

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

bcrypt

wininet

crypt32

iphlpapi

gdi32

shell32

advapi32

mswsock

Exports

Exports

Sections

.text Size: 8.8MB - Virtual size: 8.8MB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 591KB - Virtual size: 657KB

.pdata Size: 599KB - Virtual size: 598KB

.idata Size: 14KB - Virtual size: 14KB

.tls Size: 6KB - Virtual size: 5KB

.gfids Size: 7KB - Virtual size: 7KB

.00cfg Size: 512B - Virtual size: 283B

_RDATA Size: 38KB - Virtual size: 38KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 99KB - Virtual size: 98KB

a31a41ed4f924ab1c161e6bc55518e9c

Headers

DLL Characteristics

File Characteristics

Imports

galaxy64

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 684B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 512B - Virtual size: 120B

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6fCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

.text
Size: 616KB - Virtual size: 616KB

.managed
Size: 13.7MB - Virtual size: 13.7MB

.rdata
Size: 12.1MB - Virtual size: 12.1MB

.data
Size: 1.0MB - Virtual size: 1.0MB

.pdata
Size: 1017KB - Virtual size: 1017KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 103KB - Virtual size: 103KB

.reloc
Size: 512KB - Virtual size: 512KB

.text
Size: 8.8MB - Virtual size: 8.8MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 591KB - Virtual size: 657KB

.pdata
Size: 599KB - Virtual size: 598KB

.idata
Size: 14KB - Virtual size: 14KB

.tls
Size: 6KB - Virtual size: 5KB

.gfids
Size: 7KB - Virtual size: 7KB

.00cfg
Size: 512B - Virtual size: 283B

_RDATA
Size: 38KB - Virtual size: 38KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 99KB - Virtual size: 98KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 684B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 120B

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6b:c4:15:a1:23:fa:49:fb:dc:05:86:1f:21:48:b0:49:3b:d5:1d:dc:c6:72:35:17:aa:75:ea:bc:63:fa:76:f8
Signer

57:19:7f:e6:ec:8b:ea:59:58:33:9f:f6:88:06:04:41:78:e0:04:94
Signer

.text
Size: 229KB - Virtual size: 228KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 4KB - Virtual size: 12KB

.wixburn
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 17KB - Virtual size: 17KB

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4
Signer

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6
Signer