00e8bf59fd4c24da04b723894c47d334

Sharing

Copy URL Twitter E-mail

General

Target

00e8bf59fd4c24da04b723894c47d334
Size

5.2MB
MD5

00e8bf59fd4c24da04b723894c47d334
SHA1

f98e5541a1417beeae6846f22ab9f85f9241851d
SHA256

617e3be67c0924d7d58e348bca1ec0fc2775f5f2fc4b8778596347ffc806c377
SHA512

ebff6c7e3411eb210cbf5c3ef09a4127fa748de06ccbf4a4eeb3fe4ef1d503285fae4b63a41887191e0dbd6532aaf9b7861f9236471a5db0b480c7f45de168bb
SSDEEP

98304:oOqEz68aD4I7wN2tYUoEr2olQsNlem2ztn3LmeXtLLVbndHmcK7cJ8RG4+fzU:EEz68aD48tYdEDCsNUVwc8XL

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SysinternalsSuite-v20081210/DMON.SYS
unpack001/SysinternalsSuite-v20081210/ctrl2cap.nt4.sys
unpack001/SysinternalsSuite-v20081210/ctrl2cap.nt5.sys

Files

00e8bf59fd4c24da04b723894c47d334
.rar
SysinternalsSuite-v20081210/ADExplorer.exe
.exe windows:4 windows x86 arch:x86

9d4d88e08c1d255b0605cd7e61edff7c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

db:ac:0b:50:c2:06:95:de:6e:37:01:e9:3a:7c:c8:8a:93:de:7f:c6
Signer

Actual PE Digest

db:ac:0b:50:c2:06:95:de:6e:37:01:e9:3a:7c:c8:8a:93:de:7f:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetUserGetGroups
NetUserGetLocalGroups

rpcrt4

UuidFromStringW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
GetConsoleCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
RaiseException
RtlUnwind
GetStartupInfoA
GetVersionExA
GetCommandLineA
CreateThread
ResumeThread
ExitThread
HeapSize
HeapReAlloc
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LoadLibraryA
ExpandEnvironmentStringsA
GetProcessHeap
HeapFree
WideCharToMultiByte
lstrlenA
WriteFile
FreeLibrary
FileTimeToLocalFileTime
GetCurrentProcess
Sleep
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
MultiByteToWideChar
CreateFileW
GetSystemDirectoryW
ReadFile
OutputDebugStringW
GetFileSize
TlsSetValue
GetUserDefaultLangID
TlsAlloc
GetSystemDefaultLangID
TlsGetValue
FormatMessageW
LocalAlloc
GetTimeFormatW
CompareFileTime
GetDateFormatW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
LocalFree
SystemTimeToTzSpecificLocalTime
InterlockedDecrement
SetFilePointer
GetModuleFileNameW
GlobalFree
UnmapViewOfFile
GetFileAttributesW
MapViewOfFile
GetVersionExW
DeleteFileW
GlobalUnlock
InitializeCriticalSection
GetTickCount
GetModuleHandleW
CloseHandle
SetEndOfFile
InterlockedIncrement
GlobalAlloc
GetCommandLineW
EnterCriticalSection
GlobalLock
CreateFileMappingW
DeleteCriticalSection
LeaveCriticalSection
GetProcAddress
CompareStringW
LoadLibraryW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetModuleHandleA

user32

GetMenuItemCount
RegisterClassExW
MsgWaitForMultipleObjects
GetWindowPlacement
DrawFrameControl
GetDlgItemTextW
LoadIconW
InflateRect
GetPropW
BeginDeferWindowPos
GetDlgItem
EndDeferWindowPos
SetPropW
ReleaseCapture
CheckDlgButton
DestroyIcon
IsZoomed
ClientToScreen
MessageBoxW
GetWindowTextLengthW
LoadMenuW
GetMenuItemInfoW
DialogBoxIndirectParamW
CopyIcon
EnumChildWindows
IsDlgButtonChecked
SetMenuDefaultItem
ChildWindowFromPoint
SendDlgItemMessageW
GetClassNameW
DestroyMenu
GetSubMenu
GetSystemMetrics
LoadImageW
LoadCursorW
EnableMenuItem
OffsetRect
IsWindowVisible
SetDlgItemInt
SetWindowLongW
GetMessageW
BeginPaint
EmptyClipboard
SetDlgItemTextW
DestroyWindow
GetClientRect
GetSysColor
PeekMessageW
SetCursor
EndPaint
SetClipboardData
GetDlgItemInt
EnableWindow
CreateWindowExW
GetSysColorBrush
MessageBeep
GetMenu
PtInRect
IsDialogMessageW
CreateDialogParamW
DeleteMenu
GetWindowLongW
ShowWindow
OpenClipboard
SendMessageW
AppendMenuW
SetWindowPos
DrawMenuBar
MoveWindow
GetFocus
SetFocus
GetWindowTextW
SetWindowPlacement
SetCapture
EndDialog
ScreenToClient
CreatePopupMenu
GetActiveWindow
DeferWindowPos
GetWindowRect
PostQuitMessage
CloseClipboard
PostMessageW
TranslateMessage
MenuItemFromPoint
DialogBoxParamW
CallWindowProcW
LoadAcceleratorsW
InvalidateRect
SetWindowTextW
DefWindowProcW
DispatchMessageW
DrawTextW
TranslateAcceleratorW
MapWindowPoints
TrackPopupMenu
UpdateWindow
GetParent

gdi32

SetBkColor
ExtTextOutW
StartPage
GetDeviceCaps
SetMapMode
StartDocW
SetBkMode
CreateFontIndirectW
SetTextColor
GetStockObject
SelectObject
EndPage
GetObjectW
EndDoc

comdlg32

GetSaveFileNameW
GetOpenFileNameW
PrintDlgW

advapi32

RegSetValueExW
RegCreateKeyW
RegEnumValueW
RegQueryValueExW
GetSecurityDescriptorLength
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSidToSidW
RegDeleteValueW
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LookupAccountSidW
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
EqualSid
IsValidSid
GetSidSubAuthorityCount
GetSidIdentifierAuthority
MapGenericMask
GetSidSubAuthority
AllocateAndInitializeSid
GetSecurityDescriptorOwner
GetAce
RegCloseKey

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CoInitialize
CoCreateInstance
CreateBindCtx
CoUninitialize
StringFromGUID2
IIDFromString

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SafeArrayGetLBound
SafeArrayGetElement
VariantChangeType
VariantClear
SysStringLen
SafeArrayGetUBound
VariantInit
VarDateFromStr
SysAllocString
SysFreeString

comctl32

ImageList_Draw
ImageList_BeginDrag
CreateStatusWindowW
CreateToolbarEx
PropertySheetW
ImageList_ReplaceIcon
ord17
CreatePropertySheetPageW
ImageList_EndDrag
ImageList_Create
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove

activeds

ord9
ord20
ord15
ord12
ord13
ord7

wldap32

ord13
ord118
ord88
ord188
ord145
ord14
ord155
ord73

Sections

.text
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ADInsight.chm
.chm
SysinternalsSuite-v20081210/ADInsight.exe
.exe windows:4 windows x86 arch:x86

d140f11cc65811212afe98adaa36a53a

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e6:6b:93:35:a4:b0:80:6a:fb:98:bd:67:94:dc:81:9d:e7:2b:78:88
Signer

Actual PE Digest

e6:6b:93:35:a4:b0:80:6a:fb:98:bd:67:94:dc:81:9d:e7:2b:78:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_ReplaceIcon
ord17
ImageList_GetIconSize
ImageList_SetBkColor
ImageList_Draw
ImageList_Add
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
ImageList_LoadImageW

ws2_32

WSACleanup
WSAStartup

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

SetThreadPriority
WaitForSingleObject
ResetEvent
SetEvent
GetLastError
SetWaitableTimer
WaitNamedPipeW
MoveFileExW
GetCurrentProcess
SetNamedPipeHandleState
GetVersionExW
OutputDebugStringW
ReleaseMutex
CreateWaitableTimerW
CreateFileW
LeaveCriticalSection
lstrlenW
GetCurrentThreadId
EnterCriticalSection
InitializeCriticalSection
MultiByteToWideChar
SetLastError
GlobalAlloc
GetTimeFormatW
GlobalUnlock
FileTimeToSystemTime
GlobalLock
GlobalReAlloc
HeapAlloc
CreateThread
HeapFree
GetProcessHeap
WriteFile
ReadFile
GetOverlappedResult
WaitForMultipleObjects
GetUserDefaultLangID
ReadProcessMemory
InterlockedIncrement
GetExitCodeThread
LoadLibraryA
GetStringTypeA
SetFilePointer
GetCurrentProcessId
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
HeapSize
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
CreateNamedPipeW
InterlockedDecrement
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
DeleteCriticalSection
RtlUnwind
RaiseException
GetStartupInfoA
GetVersionExA
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
ResumeThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ConnectNamedPipe
lstrcmpW
GetCommandLineW
CreateEventW
GetTickCount
LocalFree
GetCurrentDirectoryW
OpenProcess
GetModuleHandleW
CloseHandle
lstrcmpiW
LoadLibraryW
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
FlushFileBuffers
GetComputerNameW
GetProcAddress
Sleep
WideCharToMultiByte
LoadResource
LockResource
FindResourceW
GetTempPathW
FindResourceExW
GetTempFileNameW
DeleteFileW
SizeofResource
GetModuleFileNameW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeW
GetLocaleInfoA
SetStdHandle
GetACP
SetEndOfFile
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExpandEnvironmentStringsA

user32

CloseClipboard
EmptyClipboard
OpenClipboard
DrawFocusRect
RegisterClassExW
DrawFrameControl
OffsetRect
EndPaint
SystemParametersInfoW
SetRect
DrawTextW
GetDCEx
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
BeginPaint
PtInRect
GetSystemMetrics
GetDesktopWindow
GetIconInfo
UpdateWindow
ClientToScreen
CreateDialogParamW
GetWindowLongW
AppendMenuW
DeferWindowPos
GetWindowTextW
InvalidateRgn
DestroyMenu
LoadImageW
GetMenuState
GetActiveWindow
DispatchMessageW
EndDeferWindowPos
CreateIconIndirect
GetSubMenu
CreateWindowExW
DestroyWindow
ScreenToClient
ShowWindow
LoadIconW
FindWindowW
DefWindowProcW
MessageBoxW
IsChild
GetClientRect
SetWindowPos
CheckMenuItem
CreatePopupMenu
GetWindow
GetClassNameW
SendMessageTimeoutW
IsZoomed
IsIconic
CallWindowProcW
TrackMouseEvent
GetDlgItemTextW
GetDlgCtrlID
GetMessageW
GetWindowThreadProcessId
ReleaseCapture
TranslateAcceleratorW
PostQuitMessage
SetDlgItemInt
SetCapture
BeginDeferWindowPos
GetDlgItemInt
GetFocus
GetMenu
LoadMenuW
IsWindow
SetFocus
IsDialogMessageW
RegisterClassW
DestroyAcceleratorTable
PostMessageW
DialogBoxParamW
GetCursorPos
GetDC
SetWindowLongW
SetWindowTextW
TrackPopupMenu
MessageBeep
RegisterWindowMessageW
SetMenuItemInfoW
WaitForInputIdle
KillTimer
SendMessageW
ReleaseDC
SetForegroundWindow
EnableMenuItem
TranslateMessage
LoadStringW
IsDlgButtonChecked
CheckDlgButton
LoadAcceleratorsW
SetTimer
GetMenuItemInfoW
InvalidateRect
GetSysColor
GetWindowRect
SetDlgItemTextW
GetParent
GetSysColorBrush
ChildWindowFromPoint
LoadCursorW
GetDlgItem
MoveWindow
EndDialog
SetCursor
GetDlgItemTextA
SetDlgItemTextA
FlashWindow
CheckRadioButton
DrawIconEx
EnableWindow
FillRect
SetClipboardData
DestroyIcon
UnregisterClassA

gdi32

GetTextExtentPoint32W
LineTo
MoveToEx
SetBkColor
GetDIBits
BitBlt
CreateSolidBrush
DeleteDC
CreateCompatibleDC
CreateDIBSection
DeleteObject
CreateCompatibleBitmap
GetTextMetricsW
SetBkMode
SelectObject
SetTextColor
GetObjectW
CreateFontIndirectW
ExtTextOutW
GetStockObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ChooseColorW

advapi32

RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegSetValueW
RegCreateKeyW
RegQueryValueExW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
LookupAccountSidW
GetTokenInformation
RegOpenKeyW
ConvertSidToStringSidW
IsValidSid

shell32

SHGetFileInfoW
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteW

shlwapi

SHDeleteKeyW

Sections

.text
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 584KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/AccessEnum.exe
.exe windows:4 windows x86 arch:x86

83787f51a42290311b4f8e08f0802867

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bc:e2:6e:0f:15:48:9a:32:45:f6:3b:ef:ad:6d:fc:65:37:59:76:36
Signer

Actual PE Digest

bc:e2:6e:0f:15:48:9a:32:45:f6:3b:ef:ad:6d:fc:65:37:59:76:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetStartupInfoA
LocalAlloc
LocalFree
OpenProcess
CompareStringW
GetModuleHandleW
GetCurrentProcess
FindFirstFileW
FindNextFileW
FindClose
LoadLibraryW
GetProcAddress
GetLastError
CreateThread
FormatMessageW
SetThreadPriority
ResumeThread
DeleteFileW
GetFileAttributesW
Sleep
GetEnvironmentVariableW
InterlockedIncrement
CreateFileW
WriteFile
CloseHandle
InterlockedDecrement
lstrlenW

user32

GetSysColor
GetDlgItem
LoadCursorW
GetParent
GetSysColorBrush
SetCursor
InvalidateRect
ChildWindowFromPoint
CheckDlgButton
IsDlgButtonChecked
SetDlgItemTextW
EndPaint
DrawFrameControl
EnableWindow
DefWindowProcW
PostQuitMessage
DestroyMenu
TrackPopupMenu
SetMenuItemInfoW
GetWindowRect
MoveWindow
EndDialog
LoadIconW
SendMessageW
EnableMenuItem
GetSubMenu
LoadMenuW
GetFocus
ChildWindowFromPointEx
MapWindowPoints
SetWindowLongW
GetWindowLongW
SetWindowTextW
CheckMenuItem
GetMenuItemInfoW
GetMenu
CreateDialogParamW
GetDlgItemTextW
GetClientRect
BeginPaint
PtInRect
wsprintfW
IsWindowEnabled
DialogBoxParamW
SetClassLongW
PostMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
UpdateWindow
ShowWindow
RegisterClassExW
InflateRect
DialogBoxIndirectParamW
FindWindowW
WaitForInputIdle
SetForegroundWindow
FindWindowExW
SetFocus
GetWindowThreadProcessId
CreatePopupMenu
InsertMenuItemW
GetCursorPos
SetWindowPos
LoadImageW
ScreenToClient
GetClassNameW
DeferWindowPos
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
OffsetRect
UnionRect
GetPropW
CallWindowProcW
IsZoomed
GetSystemMetrics
DestroyIcon
MessageBoxW
SetPropW

gdi32

SetMapMode
StartDocW
StartPage
GetDeviceCaps
EndPage
EndDoc
SetBkMode
SetTextColor
SelectObject
GetStockObject
GetObjectW
CreateFontIndirectW

comdlg32

PrintDlgW
GetOpenFileNameW
GetSaveFileNameW

advapi32

GetSidLengthRequired
RegEnumKeyExW
RegGetKeySecurity
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
InitializeSid
LookupAccountNameW
GetTokenInformation
OpenProcessToken
RegCreateKeyW
AllocateAndInitializeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
LookupAccountSidW
GetLengthSid
EqualSid
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetAce
GetSecurityDescriptorDacl
IsValidSecurityDescriptor
RegEnumKeyW
RegCloseKey
RegQueryInfoKeyW
GetFileSecurityW
RegOpenKeyExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHGetFileInfoW
ShellExecuteExW

ole32

CoInitializeEx

oleaut32

VariantChangeType
SetErrorInfo
GetErrorInfo
VariantClear
CreateErrorInfo
VariantInit
VarDateFromStr
SysStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString

comctl32

ord17
ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetWkstaUserGetInfo
NetUserGetGroups

mpr

WNetGetConnectionW

msvcrt

_ftol
swprintf
isspace
wcschr
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_CxxThrowException
malloc
toupper
swscanf
vswprintf
_wfopen
fgetwc
fclose
strlen
strcpy
wcscmp
_purecall
_wcsnicmp
iswspace
wcsncpy
_except_handler3
memset
wcscat
free
wcslen
_EH_prolog
__CxxFrameHandler
??3@YAXPAX@Z
qsort
memcpy
_wcsdup
wcscpy
_wcsicmp
realloc
??2@YAPAXI@Z

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/AdExplorer.chm
.chm
SysinternalsSuite-v20081210/Autologon.exe
.exe windows:4 windows x86 arch:x86

65150fafe026de015358a41a7d8b49be

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f3:81:64:08:47:d9:53:77:0b:c6:6f:6f:a9:7e:88:38:aa:27:1b:e2
Signer

Actual PE Digest

f3:81:64:08:47:d9:53:77:0b:c6:6f:6f:a9:7e:88:38:aa:27:1b:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
GetEnvironmentStrings
SetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
SetHandleCount
GetProcAddress
GetStdHandle
GetFileType
RtlUnwind
WriteFile
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
ExitProcess
GetCommandLineA
GetCurrentProcess
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetModuleHandleA
LocalAlloc
LoadLibraryA
LocalFree
GetVersion
GetCommandLineW
HeapReAlloc
GetStartupInfoA
HeapFree
HeapAlloc
CloseHandle

user32

GetDlgItemTextW
LoadCursorA
InflateRect
SetWindowTextA
SendMessageA
DialogBoxIndirectParamA
LoadIconW
RegisterClassExW
CreateDialogParamW
ShowWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
DefWindowProcW
DialogBoxParamW
SetDlgItemTextW
GetWindowRect
OffsetRect
GetSystemMetrics
MoveWindow
GetDlgItem
LoadCursorW
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
MessageBoxW
EndDialog

gdi32

SetBkMode
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetStockObject
GetObjectW
CreateFontIndirectW
SetTextColor
SelectObject

comdlg32

PrintDlgA

advapi32

RegCloseKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
LsaOpenPolicy
LsaStorePrivateData
RegDeleteValueW
LsaClose

shell32

CommandLineToArgvW
ShellExecuteW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Bginfo.exe
.exe windows:5 windows x86 arch:x86

cd9d9cad93570d0dc1584fdd6b261ecd

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:71:f4:96:5c:ab:1f:37:10:c3:b6:8f:cf:34:92:83:8c:b8:81:7c
Signer

Actual PE Digest

67:71:f4:96:5c:ab:1f:37:10:c3:b6:8f:cf:34:92:83:8c:b8:81:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSAStartup

comctl32

CreateToolbarEx
ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

snmpapi

SnmpSvcGetUptime
SnmpUtilOidCpy
SnmpUtilOidNCmp

kernel32

GetModuleFileNameW
lstrcmpA
GlobalFlags
SetThreadPriority
ResumeThread
WaitForSingleObject
SetEvent
SuspendThread
CreateEventA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentProcessId
GetCPInfo
GetOEMCP
GetAtomNameA
GetThreadLocale
lstrlenW
GetProcessHeap
HeapFree
MultiByteToWideChar
SystemTimeToTzSpecificLocalTime
CompareStringW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
LockFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
LCMapStringW
LCMapStringA
HeapDestroy
HeapCreate
SetFilePointer
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualQuery
VirtualProtect
GetCommandLineA
SetEnvironmentVariableA
DeleteFileA
GetFileAttributesA
FreeLibrary
GetEnvironmentStrings
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineW
GetModuleHandleA
GetFullPathNameA
ExitProcess
GetModuleFileNameA
WaitForMultipleObjects
GetExitCodeProcess
TerminateProcess
OpenProcess
GetVersionExA
WideCharToMultiByte
CreateDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GetComputerNameA
LoadLibraryA
GetProcAddress
GlobalMemoryStatus
FileTimeToLocalFileTime
FileTimeToSystemTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
SystemTimeToFileTime
GetLogicalDriveStringsA
GetDriveTypeA
SetErrorMode
GetVolumeInformationA
GetDiskFreeSpaceA
FindFirstFileA
FindClose
GetFileSize
ReadFile
GetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
GetWindowsDirectoryA
FindResourceA
LoadResource
SizeofResource
LockResource
ExpandEnvironmentStringsA
GetSystemInfo
GetCurrentThread
SetThreadAffinityMask
Sleep
GetCurrentProcess
GetProcessAffinityMask
GetLocalTime
CreateFileA
GetLastError
WriteFile
SetEndOfFile
CloseHandle
InterlockedDecrement
FormatMessageA
lstrlenA
LocalAlloc
GetSystemDirectoryA
LocalFree
InterlockedIncrement
GetModuleHandleW
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
MoveFileA
GetStringTypeExA
lstrcmpiA
FlushFileBuffers
GetSystemTimeAsFileTime
FatalAppExitA
IsValidCodePage
GetACP
CreateThread
ExitThread
HeapSize
RaiseException
GetStartupInfoA
VirtualAlloc
VirtualFree
HeapAlloc
HeapReAlloc
RtlUnwind
GetFileTime
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
CopyFileA
GlobalSize
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetFileSizeEx
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
GetShortPathNameA
DuplicateHandle
UnlockFile
GlobalDeleteAtom
CompareStringA
SetLastError
lstrcmpW

user32

SubtractRect
InflateRect
GetSysColor
SystemParametersInfoA
SetSysColors
DrawEdge
DrawIconEx
SetCapture
RegisterClipboardFormatA
EnableMenuItem
CheckMenuItem
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
RegisterClassExA
SetWindowPlacement
IntersectRect
LoadAcceleratorsA
GetMessageA
GetActiveWindow
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetWindowPlacement
DestroyWindow
GetMenu
GetMenuItemInfoA
SetMenuItemInfoA
SetTimer
GetWindow
GetSystemMetrics
GetDlgCtrlID
CopyRect
SetScrollInfo
GetScrollInfo
EqualRect
RegisterClassA
GetClassInfoA
GetClassInfoExA
GetMenuItemCount
GetMenuItemID
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
GetKeyState
TrackPopupMenuEx
ScrollWindow
PeekMessageA
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
SetActiveWindow
GetLastActivePopup
GetForegroundWindow
IsWindow
GetFocus
RemovePropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
GetCapture
IsChild
WinHelpA
SendDlgItemMessageA
RegisterWindowMessageA
GetMenuState
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
RemoveMenu
InsertMenuA
AppendMenuA
GetMenuStringA
GetDlgItemInt
SetDlgItemInt
IsWindowEnabled
ScrollWindowEx
DestroyMenu
LoadImageA
GetDesktopWindow
ValidateRect
TabbedTextOutA
DrawTextExA
GrayStringA
GetWindowDC
GetWindowThreadProcessId
SetRectEmpty
UnregisterClassA
ShowOwnedPopups
DeleteMenu
DestroyIcon
CharUpperA
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
ReleaseCapture
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
SetRect
WindowFromPoint
GetKeyNameTextA
MapVirtualKeyA
IsRectEmpty
GetSystemMenu
SetParent
GetNextDlgTabItem
CreateDialogIndirectParamA
GetDCEx
LockWindowUpdate
GetDialogBaseUnits
LoadStringA
IsIconic
CheckMenuRadioItem
CreateDialogParamA
GetWindowTextLengthA
KillTimer
GetWindowTextA
IsZoomed
PtInRect
DrawFrameControl
DefWindowProcA
IsWindowVisible
GetCursorPos
LoadMenuA
GetSubMenu
SetMenuDefaultItem
SetForegroundWindow
TrackPopupMenu
AdjustWindowRectEx
SetWindowPos
UpdateWindow
ShowWindow
EnableWindow
CheckRadioButton
BeginPaint
EndPaint
DialogBoxParamA
GetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
LoadIconA
PostMessageA
ChildWindowFromPoint
SetFocus
SetWindowLongA
MoveWindow
CreateWindowExA
FrameRect
MapWindowPoints
CallWindowProcA
SetDlgItemTextA
MessageBoxA
PostQuitMessage
SetPropA
GetPropA
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
GetClientRect
UnionRect
GetParent
GetClassNameA
GetWindowLongA
InvalidateRect
DeferWindowPos
GetWindowRect
ScreenToClient
DialogBoxIndirectParamA
GetDlgItem
EndDialog
FillRect
OffsetRect
GetSysColorBrush
GetUserObjectInformationA
LoadCursorA
SetCursor
GetDC
ReleaseDC
wsprintfA
ClientToScreen
GetProcessWindowStation
PostThreadMessageA
SendMessageA
SetWindowTextA
DrawTextA

gdi32

PatBlt
CreateFontA
ExtTextOutA
DPtoLP
CreateBitmap
GetMapMode
SetBkColor
EnumFontsA
CreateHalftonePalette
GetDIBColorTable
UpdateColors
SetTextColor
GetStockObject
CreateFontIndirectA
GetPixel
StartDocA
StartPage
EndPage
EndDoc
CreatePen
MoveToEx
LineTo
SetPixel
CreatePalette
GetPaletteEntries
SetDIBColorTable
UnrealizeObject
SelectPalette
RealizePalette
CreateSolidBrush
SetStretchBltMode
SetBrushOrgEx
StretchBlt
BitBlt
SetBkMode
DeleteDC
GetSystemPaletteEntries
GetNearestColor
GdiFlush
GetObjectA
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
CreateDIBSection
GetDeviceCaps
GetDCOrgEx
GetClipBox
CopyMetaFileA
CreateDCA
GetTextExtentPoint32A
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SetMapMode
GetTextMetricsA
GetBkColor
CombineRgn
SetRectRgn
CreateRectRgnIndirect
StretchDIBits
GetCharWidthA
CreateHatchBrush
ExtCreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SelectClipPath

comdlg32

GetOpenFileNameA
ChooseColorA
PrintDlgA
GetSaveFileNameA
CommDlgExtendedError
GetFileTitleA

advapi32

RegSetValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCreateKeyA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyExA
StartServiceCtrlDispatcherA
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
DeleteService
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf
RegOpenKeyA
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegDeleteValueA
RegSetValueExA
GetUserNameA
RegEnumKeyExA
RegQueryValueA

shell32

DragQueryFileA
SHChangeNotify
Shell_NotifyIconA
ShellExecuteA
SHAppBarMessage
ExtractIconA
SHGetFileInfoA
DragFinish

ole32

CLSIDFromString
CoInitializeEx
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoDisconnectObject
StringFromGUID2
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CreateStreamOnHGlobal
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleInitialize
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
CreateBindCtx
OleRegGetUserType

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
SafeArrayGetLBound
SafeArrayGetUBound
LoadRegTypeLi
VariantChangeType
SysAllocString
SysStringLen
OleLoadPicture
SystemTimeToVariantTime
VariantClear
VariantInit
VariantCopy
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
LoadTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
RegisterTypeLi
SafeArrayGetElement

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathRemoveExtensionA
PathFindExtensionA

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

Sections

.text
Size: 523KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Cacheset.exe
.exe windows:4 windows x86 arch:x86

439a3d1d985661e145989e94cd516315

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

70:62:b4:28:63:9e:25:d9:bc:20:7e:b0:2e:f0:eb:33:2a:ba:50:87
Signer

Actual PE Digest

70:62:b4:28:63:9e:25:d9:bc:20:7e:b0:2e:f0:eb:33:2a:ba:50:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
SetFilePointer
WideCharToMultiByte
LCMapStringA
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetCPInfo
GetACP
GetOEMCP
ReadFile
FlushFileBuffers
GetEnvironmentStrings
SetStdHandle
GetProcAddress
HeapDestroy
ExitProcess
LocalAlloc
LoadLibraryA
LocalFree
GetVersion
GetCurrentProcess
CloseHandle
GetModuleHandleA
FreeEnvironmentStringsW
HeapAlloc
HeapFree
GetStartupInfoA
GetCommandLineA
LCMapStringW

user32

MoveWindow
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
SetWindowTextA
SendMessageA
DialogBoxIndirectParamA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
CreateDialogParamA
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
IsDialogMessageA
wsprintfA
SetDlgItemTextA
SetTimer
GetDlgItemTextA
DefWindowProcA
MessageBoxA
EndDialog
PostQuitMessage
GetWindowRect
OffsetRect
GetSystemMetrics

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comctl32

ord17

comdlg32

PrintDlgA

advapi32

RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Clockres.exe
.exe windows:4 windows x86 arch:x86

87f938e3bcf207d506ac0dae5dee8010

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a1:dd:36:f3:b3:38:8c:cb:34:82:39:3a:48:cd:d4:ed:38:22:67:72
Signer

Actual PE Digest

a1:dd:36:f3:b3:38:8c:cb:34:82:39:3a:48:cd:d4:ed:38:22:67:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
GetOEMCP
MultiByteToWideChar
GetCPInfo
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
GetModuleHandleA
SetFilePointer
GetLastError
LocalAlloc
LoadLibraryA
LocalFree
GetACP
GetSystemTimeAdjustment
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
GetProcAddress
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
WriteFile
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

EndPage
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/Contig.exe
.exe windows:5 windows x86 arch:x86

93379fc1e3bd97a7a99b999eca193fc7

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:81:1d:54:00:cb:e1:bf:6a:79:55:01:86:64:3a:41:88:b7:81:e8
Signer

Actual PE Digest

40:81:1d:54:00:cb:e1:bf:6a:79:55:01:86:64:3a:41:88:b7:81:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
SetFilePointer
GetProcAddress
GetModuleHandleW
GetVersionExW
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
WriteFile
CompareStringW
CompareStringA
ReadFile
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
GetFullPathNameW
GetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
CloseHandle
GetFileSize
FlushFileBuffers
WaitForSingleObject
CreateFileW
GetLastError
FormatMessageW
GetCommandLineW
LocalFree
HeapAlloc
HeapFree
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
MultiByteToWideChar
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
GetLocaleInfoW
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
SetEnvironmentVariableA

user32

DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Coreinfo.exe
.exe windows:5 windows x86 arch:x86

32f0845b178f99ccb22b2a9eb981919e

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:b3:5a:14:97:1d:02:5e:13:dd:b3:84:1b:20:bd:72:4d:5f:dc:dc
Signer

Actual PE Digest

8a:b3:5a:14:97:1d:02:5e:13:dd:b3:84:1b:20:bd:72:4d:5f:dc:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

GetSystemInfo
CloseHandle
GetVersion
DeleteFileW
LocalFree
ExpandEnvironmentStringsW
FindResourceW
LoadResource
SizeofResource
CreateFileW
SetLastError
GetProcAddress
LocalAlloc
GetProcessHeap
SetEndOfFile
CreateFileA
HeapSize
GetLocaleInfoA
GetLastError
GetStdHandle
GetModuleFileNameW
GetFileAttributesW
LoadLibraryW
FormatMessageA
WriteFile
WaitForSingleObject
GetModuleHandleW
GetCurrentProcess
CreateProcessW
GetCommandLineW
ReadFile
LockResource
UnhandledExceptionFilter
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
Sleep
ExitProcess
HeapFree
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
LCMapStringA
MultiByteToWideChar
LCMapStringW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW

user32

SetCursor
DialogBoxIndirectParamW
LoadCursorW
InflateRect
GetDlgItem
EndDialog
GetSysColorBrush
SendMessageW
SetWindowTextW

gdi32

StartPage
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
EndPage

comdlg32

PrintDlgW

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyW
RegQueryValueExW

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/DISKMON.HLP
SysinternalsSuite-v20081210/DMON.SYS
.sys windows:4 windows x86 arch:x86

4a6a9a8e3dc1b05458f7523b9795055c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExInitializeNPagedLookasideList
IoDeleteDevice
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
NtClose
NtOpenFile
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
vsprintf
DbgPrint
ObfDereferenceObject
IoGetDeviceObjectPointer
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoGetConfigurationInformation
InterlockedDecrement
ExInterlockedPushEntrySList
InterlockedIncrement
ExInterlockedPopEntrySList
KeQuerySystemTime
IofCompleteRequest
ExFreePool
sprintf
IoBuildDeviceIoControlRequest
RtlFreeUnicodeString

hal

KeQueryPerformanceCounter
KfAcquireSpinLock
KfReleaseSpinLock

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 926B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Dbgview.exe
.exe windows:5 windows x86 arch:x86

6c426e7c6e3e940e5e5b74af51c68765

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:a4:fa:87:ac:06:3a:b1:86:f3:2f:b5:59:19:55:e9:c2:eb:b1:4d
Signer

Actual PE Digest

9c:a4:fa:87:ac:06:3a:b1:86:f3:2f:b5:59:19:55:e9:c2:eb:b1:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htonl
bind
getsockname
listen
accept
inet_ntoa
WSAStartup
inet_addr
gethostbyaddr
htons
gethostbyname
socket
connect
WSAGetLastError
closesocket

mpr

WNetAddConnection2A
WNetCancelConnection2A

comctl32

ord17
CreateToolbarEx

kernel32

lstrlenA
GetTimeFormatA
InitializeCriticalSection
GetCurrentProcessId
GetComputerNameA
GetFullPathNameA
GetCommandLineA
GetVersion
GetOverlappedResult
WriteFile
ResetEvent
WaitForMultipleObjects
ReadFile
LockResource
SizeofResource
LoadResource
FindResourceA
LocalAlloc
GetCommandLineW
RaiseException
GetTickCount
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyA
lstrcatA
HeapFree
HeapAlloc
GetProcessHeap
GetDateFormatA
DosDateTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSize
GlobalFree
WriteFileEx
QueueUserAPC
SleepEx
ExpandEnvironmentStringsA
SetFilePointer
FindFirstFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
GetStdHandle
ExitProcess
Sleep
HeapReAlloc
VirtualAlloc
FatalAppExitA
DeleteCriticalSection
VirtualFree
HeapDestroy
HeapCreate
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
CreateThread
ResumeThread
ExitThread
SearchPathA
FindClose
GlobalMemoryStatus
LoadLibraryA
FreeLibrary
CreateFileA
QueryPerformanceFrequency
GetLocaleInfoA
GetCurrentDirectoryA
GetSystemDirectoryA
DeviceIoControl
GetCurrentThreadId
WaitForSingleObject
TerminateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
OpenMutexA
CreateMutexA
CreateFileMappingA
MapViewOfFile
CreateEventA
UnmapViewOfFile
GetSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
InterlockedIncrement
CloseHandle
lstrcpynA
GetLastError
FormatMessageA
LocalFree
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetEnvironmentVariableA
DeleteFileA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
InterlockedExchange
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
HeapSize
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
GetSystemTimeAsFileTime
SetEnvironmentVariableA

user32

BeginPaint
DrawTextA
EndPaint
GetFocus
ClientToScreen
ScreenToClient
GetDialogBaseUnits
DrawFocusRect
GetParent
IsDlgButtonChecked
PostMessageA
CheckRadioButton
DialogBoxIndirectParamA
InflateRect
RegisterClassExA
FindWindowA
LoadAcceleratorsA
RegisterWindowMessageA
MsgWaitForMultipleObjects
PeekMessageA
TranslateAcceleratorA
IsWindow
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetMessageA
RegisterClassA
LoadBitmapA
SetTimer
LoadStringA
MoveWindow
DefWindowProcA
KillTimer
GetClientRect
InvalidateRgn
CreateDialogParamA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CallWindowProcA
GetWindowThreadProcessId
SetWindowLongA
GetCursorPos
DestroyWindow
SetForegroundWindow
TrackPopupMenu
CreateWindowExA
UpdateWindow
SetWindowPos
SetDlgItemTextA
SendDlgItemMessageA
AttachThreadInput
AppendMenuA
SetMenuItemBitmaps
DialogBoxParamA
SetFocus
GetDlgItemTextA
SetCapture
ReleaseCapture
EnableMenuItem
DeleteMenu
GetWindowRect
IsIconic
IsZoomed
SendMessageA
GetSystemMetrics
LoadIconA
GetWindowTextA
ShowWindow
GetDC
GetMenuCheckMarkDimensions
ReleaseDC
PostQuitMessage
SetWindowTextA
EndDialog
GetDlgItem
LoadCursorA
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
GetSubMenu
GetMenuItemCount
InsertMenuItemA
MessageBoxA
GetMenu
CheckMenuItem
EnableWindow
CheckDlgButton
ModifyMenuA

gdi32

CreateFontA
GetTextExtentPointA
TextOutA
AbortDoc
GetTextExtentPoint32A
ExtTextOutA
SetAbortProc
SetBkColor
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetTextMetricsA
DeleteObject
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
DeleteDC
StretchBlt
CreateCompatibleBitmap
CreateSolidBrush
CreateCompatibleDC

comdlg32

GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
FindTextA
ChooseFontA
PrintDlgA

advapi32

OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Desktops.exe
.exe windows:5 windows x86 arch:x86

f234c92f1980d2dd0bb3adb839e8de13

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:a1:4e:45:2c:69:66:38:c8:42:b2:3a:dd:a2:a8:bf:58:6f:d4:a2
Signer

Actual PE Digest

05:a1:4e:45:2c:69:66:38:c8:42:b2:3a:dd:a2:a8:bf:58:6f:d4:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
RtlUnwind
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetStringTypeW
GetModuleHandleW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
ExitProcess
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
WideCharToMultiByte
LocalAlloc
GetCommandLineW
CreateProcessW
LocalFree
GetVersion
CloseHandle
CreateEventW
GetProcAddress
GetLastError
GetModuleFileNameW
FormatMessageW
Sleep
LoadLibraryW
FreeEnvironmentStringsW
HeapReAlloc
VirtualAlloc
EnterCriticalSection
HeapFree
ExitThread
ResumeThread
CreateThread
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleA

user32

DialogBoxIndirectParamW
InflateRect
SetWindowTextW
CreateDesktopW
DestroyWindow
SetCursor
TranslateAcceleratorW
GetWindowRect
SetActiveWindow
GetMessageW
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
PostMessageW
GetKeyState
SetForegroundWindow
DialogBoxParamW
LoadCursorW
CallNextHookEx
OpenDesktopW
FindWindowW
GetClientRect
SetFocus
GetDC
TranslateMessage
LoadAcceleratorsW
ChildWindowFromPoint
LoadIconW
OffsetRect
InvalidateRect
BringWindowToTop
SystemParametersInfoW
ReleaseDC
GetDlgItem
EndDialog
GetSysColor
SetWindowPos
GetCursorPos
CheckDlgButton
ShowWindow
CreatePopupMenu
GetSysColorBrush
IsDlgButtonChecked
SwitchDesktop
SetThreadDesktop
CreateWindowExW
InsertMenuW
SetWindowsHookExW
MessageBoxW
RegisterClassW
GetSystemMetrics
SendMessageW
UnregisterHotKey
DestroyMenu
RegisterHotKey
DefWindowProcW
MoveWindow
DispatchMessageW
GetWindowPlacement

gdi32

StartPage
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
SetStretchBltMode
GetStockObject
EndPage

comdlg32

PrintDlgW

advapi32

RegCreateKeyW
RegSetValueExW
RegCloseKey
GetSecurityDescriptorSacl
RegOpenKeyExW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW

shell32

ShellExecuteW
Shell_NotifyIconW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/DiskView.exe
.exe windows:4 windows x86 arch:x86

9156698bd385b215b9ac600f69b8dc72

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9f:2a:64:24:14:53:96:18:b3:6f:cc:35:35:ea:c7:22:97:24:9b:29
Signer

Actual PE Digest

9f:2a:64:24:14:53:96:18:b3:6f:cc:35:35:ea:c7:22:97:24:9b:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
ReadFile
SetEndOfFile
SetConsoleCtrlHandler
LoadLibraryA
GetOEMCP
GetACP
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
SetFilePointer
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThread
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetCurrentThreadId
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
FatalAppExitA
HeapSize
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsSetValue
CreateThread
ResumeThread
RaiseException
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
lstrlenW
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalAlloc
LocalFree
SetErrorMode
GetVersionExW
GetLogicalDriveStringsW
GetDriveTypeW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
GetModuleHandleW
GetDiskFreeSpaceW
DeviceIoControl
FindNextFileW
InitializeCriticalSection
CreateFileW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CloseHandle
FormatMessageW
GetLastError
FindFirstFileW
FindClose
LoadLibraryW
GetProcAddress
DeleteCriticalSection
Sleep

user32

TrackPopupMenu
LoadImageW
GetCursorPos
DialogBoxIndirectParamW
CreatePopupMenu
SetWindowTextW
SendMessageW
InflateRect
SetCursor
InsertMenuItemW
GetWindowTextW
GetSysColorBrush
ChildWindowFromPoint
SetCapture
ReleaseCapture
GetClassNameW
DeferWindowPos
GetPropW
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
GetSystemMetrics
UnionRect
CallWindowProcW
IsZoomed
PtInRect
DrawFrameControl
LoadIconW
SetWindowPos
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
IsDialogMessageW
DispatchMessageW
PostQuitMessage
CheckDlgButton
ScreenToClient
CreateDialogParamW
GetMenu
CheckMenuItem
EnableWindow
SetTimer
KillTimer
SetForegroundWindow
DestroyWindow
GetDlgItemInt
IsWindowEnabled
DrawTextW
DrawFocusRect
GetScrollInfo
GetDlgItemTextW
GetFocus
SetScrollInfo
ScrollWindowEx
UpdateWindow
InvalidateRect
SetFocus
DialogBoxParamW
DefWindowProcW
SetDlgItemInt
SetDlgItemTextW
SetPropW
GetWindowLongW
SetWindowLongW
BeginPaint
GetClientRect
FillRect
EndPaint
EndDialog
GetDlgItem
LoadCursorW
RegisterClassExW
ShowWindow
GetWindowRect
GetParent
MapWindowPoints
CreateWindowExW
GetDC
ReleaseDC
GetSysColor
OffsetRect
MessageBoxW

gdi32

CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
CreateCompatibleBitmap
StartPage
StartDocW
SetMapMode
GetDeviceCaps
CreateFontIndirectW
GetObjectW
SetBkMode
SetBkColor
SetTextColor
PolyPolygon
GetStockObject
EndDoc
CreateSolidBrush
BitBlt
EndPage

comdlg32

PrintDlgW
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegCloseKey
RegQueryValueExW
RegCreateKeyW
RegSetValueExW

shell32

ShellExecuteW

ole32

CreateBindCtx

oleaut32

VariantInit
SysAllocString
SysFreeString
GetErrorInfo
VariantClear
CreateErrorInfo
VariantChangeType
SetErrorInfo

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ord17
ImageList_Create

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Diskmnt.exe
.exe windows:4 windows x86 arch:x86

7064482ced0a58ce3754083095a62f16

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7d:43:95:7b:f1:d0:37:bd:86:e1:de:ed:48:52:cd:9d:5b:75:4e:fc
Signer

Actual PE Digest

7d:43:95:7b:f1:d0:37:bd:86:e1:de:ed:48:52:cd:9d:5b:75:4e:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
SetStdHandle
SetFilePointer
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
MultiByteToWideChar
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetCommandLineA
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEndOfFile
GetModuleHandleA
LocalAlloc
CreateFileA
GetVersion
QueryPerformanceFrequency
GetCurrentDirectoryA
DeviceIoControl
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
ReadFile
lstrcpyA
HeapFree
lstrcatA
lstrlenA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatA
CloseHandle
GetTickCount
lstrcpynA
FormatMessageA
GetModuleFileNameA
LocalFree

user32

GetSysColorBrush
DialogBoxIndirectParamA
LoadAcceleratorsA
RegisterWindowMessageA
GetMessageA
TranslateAcceleratorA
IsWindow
TranslateMessage
IsDialogMessageA
DispatchMessageA
PostQuitMessage
MessageBoxA
DefWindowProcA
DestroyWindow
InflateRect
ScreenToClient
UpdateWindow
LoadIconA
RegisterClassA
LoadCursorA
GetMenu
CheckMenuItem
DialogBoxParamA
InvalidateRect
WinHelpA
ReleaseDC
InvalidateRgn
SetWindowPos
EnableWindow
PostMessageA
LoadStringA
GetDlgItemTextA
EndDialog
SetDlgItemTextA
GetDlgItem
SetCapture
SetCursor
ReleaseCapture
SetWindowLongA
SetTimer
GetCursorPos
GetClientRect
CreateWindowExA
CallWindowProcA
GetSysColor
DrawFocusRect
OemToCharA
GetWindowRect
IsIconic
IsZoomed
SendMessageA
SetFocus
GetDC
GetFocus
DrawTextA
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
SetWindowTextA

gdi32

EndPage
SetMapMode
StartDocA
StartPage
EndDoc
CreateSolidBrush
CreateCompatibleDC
SetBkMode
SetTextColor
SelectObject
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
ExtTextOutA
GetDeviceCaps
DeleteObject
SetBkColor

comctl32

CreateToolbarEx
ord17

comdlg32

ChooseFontA
CommDlgExtendedError
GetSaveFileNameA
FindTextA
PrintDlgA

advapi32

DeleteService
ControlService
OpenServiceA
StartServiceA
CreateServiceA
OpenSCManagerA
CloseServiceHandle
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegCloseKey

shell32

Shell_NotifyIconA

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Diskmnt.hlp
SysinternalsSuite-v20081210/Diskmon.exe
.exe windows:4 windows x86 arch:x86

934543d446cf80015b5041258a567c79

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d9:1d:76:f1:e5:4d:32:a7:63:bf:f3:f9:f1:5e:29:49:6f:c0:d0:c4
Signer

Actual PE Digest

d9:1d:76:f1:e5:4d:32:a7:63:bf:f3:f9:f1:5e:29:49:6f:c0:d0:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
CreateToolbarEx

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GetLastError
GetUserDefaultLangID
SetLastError
LeaveCriticalSection
EnterCriticalSection
lstrlenW
CreateFileA
InitializeCriticalSection
WideCharToMultiByte
MultiByteToWideChar
lstrcpynA
LocalAlloc
SetEndOfFile
ReadFile
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
SetFilePointer
Sleep
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsAlloc
GetCurrentThreadId
HeapReAlloc
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetCommandLineA
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
ExitThread
TlsSetValue
CreateThread
ResumeThread
RtlUnwind
OpenProcess
ReadProcessMemory
CloseHandle
GetModuleHandleA
GetProcessHeap
HeapAlloc
lstrcpyA
lstrlenA
HeapFree
lstrcatA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GetTickCount
GetVersion
GetCurrentProcess
GetSystemTime
SystemTimeToFileTime
LoadLibraryA
GetProcAddress
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatA
FormatMessageA
LocalFree
WriteFile

user32

OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
DrawTextA
LoadCursorA
InvalidateRect
GetDlgItemTextA
EnableWindow
IsWindowEnabled
SetDlgItemTextA
GetSysColorBrush
ChildWindowFromPoint
GetSysColor
ClientToScreen
GetDlgItem
MoveWindow
GetWindowRect
GetParent
SetCursor
CallWindowProcA
GetClientRect
DrawIconEx
SetWindowLongA
SetWindowTextA
DestroyIcon
IsZoomed
DialogBoxIndirectParamA
InflateRect
ScreenToClient
CheckDlgButton
IsDlgButtonChecked
CheckRadioButton
RegisterWindowMessageA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
UpdateWindow
LoadIconA
RegisterClassA
SetCapture
DialogBoxParamA
ReleaseCapture
SetTimer
SetFocus
GetMenu
CheckMenuItem
GetCursorPos
LoadMenuA
GetSubMenu
TrackPopupMenu
DestroyMenu
EnableMenuItem
LoadStringA
GetDC
GetSystemMetrics
ReleaseDC
WinHelpA
SetWindowPos
PostMessageA
ShowWindow
InvalidateRgn
KillTimer
DefWindowProcA
SendMessageA
DestroyWindow
MessageBoxA
PostQuitMessage
EndDialog
IsIconic

gdi32

EndDoc
EndPage
ExtTextOutA
StartDocA
SetMapMode
GetDeviceCaps
GetTextExtentPoint32A
SetBkColor
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
DeleteObject
CreateCompatibleDC
GetTextMetricsA
StartPage
CreateSolidBrush

comdlg32

GetSaveFileNameA
FindTextA
ChooseColorA
ChooseFontA
PrintDlgA

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
LookupAccountSidW
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
AdjustTokenPrivileges

shell32

SHGetFileInfoA
Shell_NotifyIconA
ShellExecuteA

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket

oleaut32

SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantChangeType
SafeArrayGetElement
VariantInit
VariantClear
SysAllocString
SysFreeString
SafeArrayGetLBound

Sections

.text
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Eula.txt
SysinternalsSuite-v20081210/FILEMON.HLP
SysinternalsSuite-v20081210/Filemon.exe
.exe windows:4 windows x86 arch:x86

14c43471ab039add605775c4733a9917

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

96:13:b7:63:0a:2f:c1:ba:06:e2:e5:db:61:a4:b5:89:5c:89:23:62
Signer

Actual PE Digest

96:13:b7:63:0a:2f:c1:ba:06:e2:e5:db:61:a4:b5:89:5c:89:23:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
CreateToolbarEx

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

GetCurrentDirectoryA
DeleteFileA
GetModuleFileNameA
GetSystemDirectoryA
QueryPerformanceFrequency
CreateProcessA
GetCommandLineA
ExpandEnvironmentStringsA
GetFileAttributesA
GetVersion
GetTickCount
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcatA
HeapFree
lstrlenA
lstrcpyA
HeapAlloc
GetProcessHeap
ReadProcessMemory
OpenProcess
Sleep
GetVersionExA
GetUserDefaultLangID
HeapSize
SetEndOfFile
ReadFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetCurrentProcessId
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
ExitProcess
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
DeleteCriticalSection
RtlUnwind
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
CreateThread
ResumeThread
ExitThread
CreateEventA
GetLogicalDrives
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
DosDateTimeToFileTime
GetTimeFormatA
SetEvent
FreeLibrary
WaitForSingleObject
WaitForMultipleObjects
DeviceIoControl
FormatMessageA
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
CloseHandle
FlushFileBuffers

user32

GetSysColor
GetSysColorBrush
LoadCursorA
IsIconic
IsZoomed
SetWindowLongA
ChildWindowFromPoint
GetClientRect
CallWindowProcA
SetCapture
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
InvalidateRect
SetCursor
DrawIconEx
RegisterClassA
DrawTextA
GetSystemMetrics
SetTimer
ClientToScreen
ScreenToClient
GetDlgItemTextA
IsWindowEnabled
SetDlgItemTextA
CheckDlgButton
EnableWindow
IsDlgButtonChecked
CheckRadioButton
RegisterWindowMessageA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
IsWindow
IsDialogMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
GetFocus
DialogBoxParamA
GetMenu
EnableMenuItem
CreateMenu
InsertMenuA
GetCursorPos
LoadMenuA
GetSubMenu
TrackPopupMenu
DestroyMenu
LoadStringA
GetDC
ReleaseDC
SetFocus
BeginPaint
EndPaint
WinHelpA
SetWindowPos
InvalidateRgn
ReleaseCapture
PostMessageA
DefWindowProcA
DestroyWindow
CheckMenuItem
MessageBoxA
PostQuitMessage
DialogBoxIndirectParamA
SetWindowTextA
InflateRect
SendMessageA
EndDialog
GetParent
GetWindowRect
MoveWindow
GetDlgItem

gdi32

EndDoc
GetStockObject
EndPage
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
StartPage
StartDocA
SetMapMode
GetDeviceCaps
DeleteObject
CreateCompatibleDC
GetTextMetricsA
CreateSolidBrush
SetBkColor
GetTextExtentPoint32A
ExtTextOutA
GetObjectA

comdlg32

ChooseFontA
GetOpenFileNameA
GetSaveFileNameA
ChooseColorA
FindTextA
PrintDlgA

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyA
GetTokenInformation
LookupAccountSidA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
AdjustTokenPrivileges

shell32

ShellExecuteExA
ShellExecuteA
SHGetFileInfoA

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 492KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Listdlls.exe
.exe windows:4 windows x86 arch:x86

8e10c341fcaf4a63a89dfa85916cbf29

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ae:fc:1c:c9:6d:44:c1:6b:a5:8f:2a:f1:7f:75:6c:f2:61:d0:b5:43
Signer

Actual PE Digest

ae:fc:1c:c9:6d:44:c1:6b:a5:8f:2a:f1:7f:75:6c:f2:61:d0:b5:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetProcAddress
GetCPInfo
SetFilePointer
LocalAlloc
GetModuleHandleA
LoadLibraryA
GetVersion
GetCurrentProcess
OpenProcess
FlushFileBuffers
GetTimeZoneInformation
WriteFile
RtlUnwind
GetStartupInfoA
GetFileType
ReadProcessMemory
CreateFileA
ReadFile
CloseHandle
FormatMessageA
LocalFree
GetLastError
GetACP
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetEnvironmentVariableA

user32

DialogBoxIndirectParamA
SendMessageA
SetWindowTextA
EndDialog
GetSysColorBrush
GetDlgItem
LoadCursorA
SetCursor
InflateRect

gdi32

EndPage
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndDoc

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

comdlg32

PrintDlgA

advapi32

RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

imagehlp

ImageNtHeader

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/LoadOrd.exe
.exe windows:4 windows x86 arch:x86

7e882ca50ab916f7ae8f8efa861ef033

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2d:a4:06:d8:20:68:53:e6:36:1a:15:07:37:5a:98:61:b7:0b:22:b7
Signer

Actual PE Digest

2d:a4:06:d8:20:68:53:e6:36:1a:15:07:37:5a:98:61:b7:0b:22:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetStdHandle
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
GetFileType
RtlUnwind
WriteFile
GetStringTypeA
GetStringTypeW
SetFilePointer
GetProcAddress
SetStdHandle
GlobalUnlock
FlushFileBuffers
GetModuleHandleA
LocalAlloc
LoadLibraryA
LocalFree
GetLastError
Sleep
GlobalAlloc
GlobalLock
HeapDestroy
CloseHandle

user32

MoveWindow
SetCursor
InflateRect
GetSysColorBrush
EndDialog
SetWindowTextA
DialogBoxIndirectParamA
LoadIconA
LoadCursorA
RegisterClassExA
UpdateWindow
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
PostQuitMessage
CreateWindowExA
GetDlgItem
EnableWindow
MessageBoxA
DefWindowProcA
GetClientRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
FindWindowA
WaitForInputIdle
ShowWindow
SetForegroundWindow
FindWindowExA
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageA

gdi32

StartDocA
EndPage
EndDoc
GetStockObject
CreateDCA
GetDeviceCaps
DeleteDC
SetMapMode
StartPage

comdlg32

PrintDlgA

advapi32

RegSetValueExA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

shell32

ShellExecuteExA

comctl32

ord6
ord17

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/PHYSMEM.EXE
.exe windows:4 windows x86 arch:x86

6fe9c4e149562997bf8df2aa8312540f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a2:c8:a1:da:10:dc:83:a6:b9:5e:98:1b:61:f2:4d:5f:d4:71:6f:5a
Signer

Actual PE Digest

a2:c8:a1:da:10:dc:83:a6:b9:5e:98:1b:61:f2:4d:5f:d4:71:6f:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetStdHandle
SetFilePointer
RtlUnwind
GetCPInfo
GetEnvironmentStrings
WideCharToMultiByte
GetProcAddress
GetACP
GetOEMCP
LCMapStringA
CloseHandle
FormatMessageA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleHandleA
LocalAlloc
LoadLibraryA
GetEnvironmentStringsW
LocalFree
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
ReadFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
FlushFileBuffers
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
LCMapStringW

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

EndDoc
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/PORTMON.CNT
SysinternalsSuite-v20081210/PORTMON.HLP
SysinternalsSuite-v20081210/ProcFeatures.exe
.exe windows:4 windows x86 arch:x86

83143505850db450c1611bd911c8dc28

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

37:4e:97:f1:50:5a:93:6f:0d:75:2e:f2:56:1e:c7:06:8c:67:d1:17
Signer

Actual PE Digest

37:4e:97:f1:50:5a:93:6f:0d:75:2e:f2:56:1e:c7:06:8c:67:d1:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
FlushFileBuffers
SetStdHandle
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetStringTypeA
GetOEMCP
GetCPInfo
SetFilePointer
GetModuleHandleA
LocalAlloc
LoadLibraryA
LocalFree
GetACP
IsProcessorFeaturePresent
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
WriteFile
GetLastError
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

StartPage
GetDeviceCaps
SetMapMode
StartDocA
EndPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Procmon.exe
.exe windows:5 windows x86 arch:x86

a9333a4133f99dcc4b399c81d0d4c7ed

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:38:0e:5c:8d:fb:8a:f8:3c:27:73:08:c0:21:8b:09:68:d5:99:3a
Signer

Actual PE Digest

ad:38:0e:5c:8d:fb:8a:f8:3c:27:73:08:c0:21:8b:09:68:d5:99:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

send
socket
bind
listen
accept
closesocket
gethostbyname
getservbyname
inet_ntoa
inet_addr
htonl
getservbyport
htons
WSASetLastError
gethostbyaddr
WSAStartup
ntohs
connect
WSAGetLastError
getsockname
recv

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_DrawEx
ImageList_Destroy
ord17
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Create
ImageList_SetOverlayImage
CreateStatusWindowW
CreateToolbarEx
InitCommonControlsEx

psapi

GetProcessMemoryInfo

kernel32

OpenProcess
GlobalLock
GlobalAlloc
GetLocaleInfoW
CompareStringW
GlobalUnlock
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
CreateFileW
CreateFileMappingW
GetDateFormatW
CreateProcessW
SystemTimeToFileTime
WriteFile
FormatMessageW
GetTimeFormatW
FileTimeToSystemTime
ReadFile
GetNumberFormatW
FileTimeToLocalFileTime
GetVersion
LocalFileTimeToFileTime
ExitProcess
GetComputerNameA
HeapAlloc
QueryPerformanceCounter
HeapFree
SetEvent
GetCurrentThread
HeapDestroy
HeapCreate
SetThreadPriority
ReleaseSemaphore
HeapSize
ResetEvent
LoadLibraryExW
CreateEventW
WaitForMultipleObjects
QueryPerformanceFrequency
GetComputerNameW
GetFileAttributesExW
GetThreadContext
OpenThread
GetCurrentProcessId
GetSystemDirectoryA
LoadLibraryA
MulDiv
FindFirstFileW
FindClose
FindNextFileW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
FatalAppExitA
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetCurrentThreadId
ResumeThread
ExitThread
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
lstrlenW
GetProcessHeap
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetConsoleMode
SetHandleCount
GetFileType
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeLibrary
EnumResourceNamesW
GlobalAddAtomW
CreateThread
GetSystemInfo
GlobalMemoryStatusEx
GetFileAttributesW
GetVersionExW
Sleep
GetSystemTimeAsFileTime
VirtualFree
GetTickCount
WaitForSingleObject
GetFullPathNameW
LocalFree
LocalAlloc
GetCommandLineW
ExpandEnvironmentStringsW
SetFileAttributesW
DeleteFileW
CloseHandle
LockResource
SetLastError
GetCurrentDirectoryW
GetLastError
SizeofResource
GetSystemDirectoryW
GetCurrentProcess
InterlockedIncrement
LoadResource
FindResourceW
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcAddress
GetConsoleCP
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
InterlockedDecrement
TlsFree
GetCPInfo
GetEnvironmentStringsW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
InterlockedExchange
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
CreateFileA
CompareStringA
SetEnvironmentVariableA
GetACP
GetOEMCP
IsValidCodePage
CreateSemaphoreW
VirtualQuery

user32

GetClassNameW
EnableMenuItem
EnumChildWindows
CreatePopupMenu
LoadBitmapW
CreateDialogParamW
SetMenuInfo
GetMenuItemCount
SetMenuDefaultItem
CheckRadioButton
InsertMenuW
EqualRect
DeferWindowPos
BeginDeferWindowPos
SetWindowTextA
GetDlgItemTextW
DestroyMenu
EndDeferWindowPos
DrawFrameControl
CheckMenuItem
DispatchMessageW
GetActiveWindow
GetWindow
CloseClipboard
LoadImageW
EmptyClipboard
OpenClipboard
SetClipboardData
IsIconic
SetForegroundWindow
WaitForInputIdle
FindWindowW
GetWindowThreadProcessId
CreateIconFromResourceEx
SetPropW
GetCapture
SetWindowPos
GetPropW
ClientToScreen
DestroyWindow
ScreenToClient
FillRect
PostMessageW
DrawIconEx
GetFocus
InvalidateRgn
LoadMenuW
PtInRect
GetDoubleClickTime
PostQuitMessage
SetClassLongW
GetCursorPos
CheckDlgButton
FrameRect
IsDlgButtonChecked
RegisterClassW
IsWindowVisible
DestroyIcon
SetActiveWindow
SetTimer
DialogBoxParamW
GetAncestor
GetDesktopWindow
GetSystemMetrics
UpdateWindow
EnableWindow
LoadStringW
SetCursor
DialogBoxIndirectParamW
GetWindowDC
WindowFromPoint
GetUpdateRgn
GetKeyState
GetClassLongW
IntersectRect
GetScrollInfo
ScrollWindowEx
SetScrollInfo
SetWindowPlacement
TranslateAcceleratorW
InflateRect
SetWindowTextW
MessageBoxW
GetDC
ReleaseDC
EndPaint
GetWindowRect
SetCapture
TrackPopupMenu
RegisterWindowMessageW
KillTimer
IsZoomed
GetSubMenu
DeleteMenu
MessageBeep
IsWindowEnabled
GetMenuItemInfoW
InsertMenuItemW
TranslateMessage
LoadAcceleratorsW
SetDlgItemInt
GetMenu
IsDialogMessageW
GetWindowPlacement
OffsetRect
SetFocus
GetDlgItemInt
DrawTextW
GetParent
LoadCursorW
GetClientRect
BeginPaint
ChildWindowFromPoint
RegisterClassExW
InvalidateRect
GetWindowLongW
GetWindowTextW
GetDlgItem
SetWindowLongW
EndDialog
GetSysColor
ShowWindow
GetSysColorBrush
CreateWindowExW
ReleaseCapture
SetDlgItemTextW
SendMessageW
MapWindowPoints
DefWindowProcW
MoveWindow
CallWindowProcW
GetMessageW
FlashWindowEx
LoadIconW
UnionRect
FindWindowExW

gdi32

RestoreDC
SetROP2
SaveDC
Rectangle
SelectClipRgn
CreateRectRgnIndirect
MoveToEx
GetTextMetricsW
CreateFontW
GdiFlush
RectInRegion
LineTo
Polygon
CreateCompatibleBitmap
Polyline
CreatePen
GetStockObject
GetBkColor
CreateSolidBrush
EndPage
StartPage
GetDeviceCaps
SetMapMode
StartDocW
EndDoc
BitBlt
DeleteDC
CreateDIBSection
SetBkColor
DeleteObject
CreateCompatibleDC
SetTextColor
CreateFontIndirectW
SetBkMode
CreateRectRgn
GetObjectW
SelectObject

comdlg32

FindTextW
ChooseColorW
GetOpenFileNameW
ChooseFontW
GetSaveFileNameW
PrintDlgW

advapi32

RegQueryValueExA
GetSecurityDescriptorLength
RegEnumValueW
ConvertStringSidToSidW
ConvertSidToStringSidW
GetLengthSid
RegOpenKeyExW
LookupAccountSidW
RegSetValueW
RegCreateKeyExW
RegEnumKeyW
GetTokenInformation
MapGenericMask
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegDeleteValueW
LookupPrivilegeValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
OpenProcessToken
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHGetMalloc
ShellExecuteW
SHChangeNotify
SHBrowseForFolderW
ShellExecuteExW
SHGetFileInfoW
SHAppBarMessage

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitialize
OleInitialize
ReleaseStgMedium
RegisterDragDrop
CreateBindCtx

oleaut32

CreateErrorInfo
GetErrorInfo
SysStringByteLen
SysAllocStringLen
VariantTimeToSystemTime
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetElement
VariantChangeType
VariantInit
SafeArrayDestroy
SafeArrayAccessData
VariantClear
SafeArrayGetLBound
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
SetErrorInfo

shlwapi

SHAutoComplete

Sections

.text
Size: 820KB - Virtual size: 820KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Psinfo.exe
.exe windows:4 windows x86 arch:x86

744fed6fc1cfe100d8f2bcf4bc1eff4c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

14:74:45:ec:6c:8c:c8:1c:47:32:52:b4:89:0d:b3:8e:a1:52:ff:7b
Signer

Actual PE Digest

14:74:45:ec:6c:8c:c8:1c:47:32:52:b4:89:0d:b3:8e:a1:52:ff:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

pdh

PdhOpenQueryW
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

netapi32

NetServerEnum
NetApiBufferFree

ws2_32

inet_ntoa
WSAStartup
gethostbyname
gethostname

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

Sleep
GetTickCount
CloseHandle
CreateFileW
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExW
LockResource
SizeofResource
LoadResource
FindResourceW
DeleteFileW
GetSystemDirectoryW
GetComputerNameW
TerminateThread
WaitForSingleObject
MultiByteToWideChar
GetCurrentProcess
SetLastError
GetModuleFileNameW
ReadFile
GetProcAddress
GetDateFormatW
FileTimeToSystemTime
GetTimeFormatW
FileTimeToLocalFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
HeapSize
GetLastError
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
GetLogicalDrives
SetErrorMode
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetVersion
InitializeCriticalSection
LoadLibraryA
FlushFileBuffers
CreateFileA
RtlUnwind
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetModuleHandleA
ExitProcess
HeapReAlloc
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP

user32

GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
LoadCursorW
SetCursor
InflateRect
SendMessageW
DialogBoxIndirectParamW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegEnumKeyExW
RegConnectRegistryW
RegEnumKeyW
RegQueryInfoKeyW
RegOpenKeyW
RegOpenKeyExW
RegEnumValueW
DeleteService
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CreateServiceW
CloseServiceHandle
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Pstools.chm
.chm
SysinternalsSuite-v20081210/REGMON.HLP
SysinternalsSuite-v20081210/RegDelNull.exe
.exe windows:4 windows x86 arch:x86

b1390b864aeb15bc9a19e8510570896f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d9:df:6f:9a:56:a0:7b:c4:38:c4:bd:22:44:7b:f3:5a:6e:1a:2d:33
Signer

Actual PE Digest

d9:df:6f:9a:56:a0:7b:c4:38:c4:bd:22:44:7b:f3:5a:6e:1a:2d:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
GetModuleFileNameA
SetFilePointer
FreeEnvironmentStringsA
SetStdHandle
LCMapStringW
LCMapStringA
LocalAlloc
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
GetVersion
SetLastError
ReadFile
GetCurrentProcess
GetLastError
CloseHandle
FormatMessageA
GetStdHandle
WriteFile
LocalFree
GetStringTypeA
GetStringTypeW
LoadLibraryA
UnhandledExceptionFilter
RtlUnwind
ExitProcess
TerminateProcess
HeapAlloc
HeapFree
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
WideCharToMultiByte

user32

EndDialog
SendMessageW
LoadCursorW
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
SetWindowTextW
DialogBoxIndirectParamW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

SetSecurityDescriptorDacl
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegSetKeySecurity
InitializeSecurityDescriptor
GetTokenInformation
SetSecurityDescriptorOwner
SetEntriesInAclW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Reghide.exe
.exe windows:4 windows x86 arch:x86

9cdfd0af3d007d52e4bbe7f287e44893

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

75:a0:77:0e:e3:b8:22:f3:12:48:51:20:b1:7c:ed:33:2f:19:e8:ac
Signer

Actual PE Digest

75:a0:77:0e:e3:b8:22:f3:12:48:51:20:b1:7c:ed:33:2f:19:e8:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetOEMCP
GetACP
SetStdHandle
LocalAlloc
SetFilePointer
CloseHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetCPInfo
WriteFile
RtlUnwind
LoadLibraryA
LocalFree
GetModuleHandleA
FlushFileBuffers
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetStartupInfoA
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetLastError
ReadFile
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW

user32

MessageBoxA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA
DialogBoxIndirectParamA

gdi32

EndDoc
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/Regmon.exe
.exe windows:4 windows x86 arch:x86

78ed4477b393b2cdb229c358f68b52da

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5a:7c:a0:5e:63:d1:bf:f0:a3:b5:bc:5e:7e:0a:fb:81:57:0d:07:e0
Signer

Actual PE Digest

5a:7c:a0:5e:63:d1:bf:f0:a3:b5:bc:5e:7e:0a:fb:81:57:0d:07:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

CreateToolbarEx
ord17

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

Sleep
GetVersionExA
GetUserDefaultLangID
FormatMessageA
WaitForMultipleObjects
WaitForSingleObject
FreeLibrary
SetFileAttributesA
GetTimeFormatA
DosDateTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateEventA
GetCurrentProcessId
GetEnvironmentVariableA
DeleteFileA
GetModuleFileNameA
GetSystemDirectoryA
GetCurrentDirectoryA
GetVersion
QueryPerformanceFrequency
CreateProcessA
GetCommandLineA
ExpandEnvironmentStringsA
GetFileAttributesA
GlobalMemoryStatus
HeapSize
SetEndOfFile
ReadFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
OpenProcess
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
ExitProcess
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
DeleteCriticalSection
RtlUnwind
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
CreateThread
ResumeThread
ExitThread
ReadProcessMemory
GetProcessHeap
HeapAlloc
lstrcpyA
lstrlenA
HeapFree
lstrcatA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GetTickCount
DeviceIoControl
SetEvent
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
CloseHandle
FlushFileBuffers

user32

GetMessageA
SetCursor
InvalidateRect
ChildWindowFromPoint
GetSysColor
GetSysColorBrush
LoadCursorA
GetDlgItem
TranslateAcceleratorA
IsDialogMessageA
LoadAcceleratorsA
DispatchMessageA
UpdateWindow
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemCount
InsertMenuItemA
CheckMenuItem
LoadMenuA
TrackPopupMenu
IsZoomed
IsIconic
TranslateMessage
DestroyMenu
EnableMenuItem
LoadStringA
ReleaseDC
BeginPaint
EndPaint
WinHelpA
wsprintfA
PostQuitMessage
EnumDisplaySettingsA
FindWindowA
WaitForInputIdle
GetWindowThreadProcessId
SetForegroundWindow
FindWindowExA
SetWindowPos
LoadIconA
SetWindowLongA
DrawIconEx
GetClientRect
CreateWindowExA
CallWindowProcA
SetCapture
ReleaseCapture
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDC
DrawTextA
GetFocus
GetSystemMetrics
ShowWindow
SetTimer
ClientToScreen
ScreenToClient
GetCursorPos
DestroyWindow
DefWindowProcA
GetDlgItemTextA
InvalidateRgn
IsWindowEnabled
SetDlgItemTextA
CheckDlgButton
MessageBoxA
EnableWindow
IsDlgButtonChecked
PostMessageA
RegisterWindowMessageA
CheckRadioButton
SetFocus
DialogBoxIndirectParamA
SetWindowTextA
InflateRect
SendMessageA
EndDialog
GetParent
GetWindowRect
MoveWindow
DialogBoxParamA

gdi32

SelectObject
SetTextColor
CreateCompatibleDC
GetTextMetricsA
CreateSolidBrush
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
EndDoc
EndPage
StartPage
StartDocA
SetMapMode
GetDeviceCaps
SetBkColor
GetTextExtentPoint32A
DeleteObject
ExtTextOutA

comdlg32

PrintDlgA
GetOpenFileNameA
GetSaveFileNameA
ChooseFontA
ChooseColorA
FindTextA

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegDeleteValueA
RegOpenKeyA
GetTokenInformation
LookupAccountSidA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
AdjustTokenPrivileges

shell32

SHGetFileInfoA
ShellExecuteA
ShellExecuteExA

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 456KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/RootkitRevealer.chm
.chm
SysinternalsSuite-v20081210/RootkitRevealer.exe
.exe windows:4 windows x86 arch:x86

c2971e27e558678b614d78284a46f77e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

01:c2:d8:95:ba:79:32:68:57:54:49:ab:f3:e2:ce:96:01:b8:ed:fc
Signer

Actual PE Digest

01:c2:d8:95:ba:79:32:68:57:54:49:ab:f3:e2:ce:96:01:b8:ed:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
TerminateProcess
CreateProcessW
GetDriveTypeW
GetLogicalDrives
CreateThread
ResetEvent
OpenEventW
SetEvent
LoadLibraryW
CreateEventW
InitializeCriticalSection
GetFullPathNameW
GetSystemDirectoryW
WaitForMultipleObjects
GetTempPathW
GetCommandLineW
GetVersion
GetModuleFileNameW
FlushFileBuffers
LocalAlloc
SetConsoleCtrlHandler
SetEndOfFile
IsBadCodePtr
SetUnhandledExceptionFilter
SetStdHandle
GetStringTypeW
GetStringTypeA
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetModuleFileNameA
ReadFile
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SystemTimeToFileTime
GetCurrentThread
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
FatalAppExitA
DeleteCriticalSection
ExitProcess
GetStartupInfoW
GetModuleHandleA
WideCharToMultiByte
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
LoadLibraryA
FindFirstFileW
FindNextFileW
FindClose
CompareFileTime
FileTimeToLocalFileTime
SetEnvironmentVariableA
lstrlenW
CreateFileMappingW
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetTickCount
VirtualProtect
IsBadReadPtr
GetCurrentDirectoryW
GetOEMCP
DeviceIoControl
SetFileAttributesW
DeleteFileW
CopyFileW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
WriteFile
MultiByteToWideChar
DosDateTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileAttributesW
LocalFree
FormatMessageW
Sleep
HeapSize
DebugBreak
GetModuleHandleW
GetProcAddress
InterlockedExchange
SetLastError
CreateFileW
FindResourceW
LoadResource
SizeofResource
LockResource
GetCurrentProcess
CloseHandle
GetVersionExW
CreateFileA
SetFilePointer
GetLastError
CompareStringA
CompareStringW
GetACP
GetStartupInfoA
RaiseException

user32

EndPaint
BeginPaint
PtInRect
IsZoomed
CallWindowProcW
DrawFrameControl
CreateDialogParamW
UnionRect
OffsetRect
GetSystemMetrics
EndDeferWindowPos
EnumChildWindows
BeginDeferWindowPos
GetPropW
DeferWindowPos
GetClassNameW
SetWindowPlacement
UpdateWindow
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
ScreenToClient
DrawTextW
GetWindowTextW
wsprintfW
IsDialogMessageW
TranslateMessage
DispatchMessageW
DialogBoxIndirectParamW
GetWindowLongW
SetWindowLongW
SetFocus
GetMenu
CheckMenuItem
GetWindowPlacement
GetDlgItemTextW
SetTimer
EnableWindow
DialogBoxParamW
KillTimer
DefWindowProcW
MsgWaitForMultipleObjects
LoadIconW
SetWindowTextW
DestroyIcon
PostQuitMessage
SetDlgItemTextW
IsWindowEnabled
CheckDlgButton
IsDlgButtonChecked
RegisterClassExW
ShowWindow
MapWindowPoints
CreateWindowExW
SetCapture
ReleaseCapture
EndDialog
GetParent
GetWindowRect
MoveWindow
GetDlgItem
LoadCursorW
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
OpenClipboard
EmptyClipboard
SendMessageW
SetClipboardData
CloseClipboard
LoadStringW
PostMessageW
MessageBoxW
InflateRect
SetPropW
GetClientRect

gdi32

EndDoc
GetStockObject
GetObjectW
EndPage
SetBkMode
SetTextColor
SelectObject
StartPage
StartDocW
SetMapMode
CreateFontIndirectW
GetDeviceCaps

comdlg32

GetSaveFileNameW
PrintDlgW

advapi32

RegQueryInfoKeyW
GetSecurityDescriptorLength
MakeAbsoluteSD
MakeSelfRelativeSD
RegOpenKeyExW
RegQueryValueW
RegConnectRegistryW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegGetKeySecurity
IsValidSecurityDescriptor
CloseServiceHandle
DeleteService
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
SetServiceStatus
RegEnumKeyW
RegDeleteValueW
FreeSid
EqualSid
GetTokenInformation
AllocateAndInitializeSid
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegEnumValueW

shell32

CommandLineToArgvW
ShellExecuteW
ExtractIconExW

ole32

CreateBindCtx

oleaut32

SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeType
VariantInit
VariantClear
VariantTimeToSystemTime
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringLen

comctl32

ImageList_Create
ImageList_ReplaceIcon
PropertySheetW
ord17

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ShareEnum.exe
.exe windows:4 windows x86 arch:x86

8c990359c655b89fe20ef4fb7b5b756c

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

81:4f:c1:bf:b0:95:d2:4c:fc:10:5f:b7:18:e4:a6:96:c3:c2:7c:7a
Signer

Actual PE Digest

81:4f:c1:bf:b0:95:d2:4c:fc:10:5f:b7:18:e4:a6:96:c3:c2:7c:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Create
ImageList_SetBkColor
ImageList_ReplaceIcon

kernel32

SetConsoleCtrlHandler
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
SetFilePointer
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
ReadFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetTimeZoneInformation
LCMapStringA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TerminateProcess
GetCurrentThread
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetLocaleInfoW
CompareStringA
SetEnvironmentVariableA
lstrlenW
lstrlenA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
WideCharToMultiByte
HeapAlloc
HeapReAlloc
RaiseException
LCMapStringW
GetStdHandle
SetHandleCount
MultiByteToWideChar
Sleep
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
GetComputerNameW
FormatMessageW
GetFileAttributesW
InterlockedIncrement
CreateThread
SetThreadPriority
ResumeThread
InterlockedDecrement
DeleteFileW
CreateFileW
WriteFile
GetCurrentProcessId
GetTickCount
GetProcessHeap
HeapFree
CompareStringW
GetModuleHandleW
SetLastError
GetLastError
LocalFree
LoadLibraryW
GetProcAddress
LocalAlloc
GetCurrentProcess
CloseHandle
GetVersion
ExitProcess
RtlUnwind

user32

SetClassLongW
UpdateWindow
EndDeferWindowPos
EnumChildWindows
BeginDeferWindowPos
GetWindowRect
EndPaint
DrawFrameControl
GetSystemMetrics
GetClientRect
BeginPaint
IsZoomed
MessageBoxW
SendMessageW
GetDlgItem
SetWindowLongW
PtInRect
EndDialog
DeferWindowPos
GetWindowLongW
GetClassNameW
InflateRect
DialogBoxIndirectParamW
LoadIconW
RegisterClassExW
ShowWindow
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
IsDialogMessageW
DispatchMessageW
PostQuitMessage
LoadMenuW
GetSubMenu
SetMenuDefaultItem
SetWindowTextW
DefWindowProcW
EnableWindow
IsWindowEnabled
GetDlgItemTextW
PostMessageW
DialogBoxParamW
CreateDialogParamW
GetSysColorBrush
ChildWindowFromPoint
InvalidateRect
wsprintfW
CreatePopupMenu
InsertMenuItemW
GetCursorPos
TrackPopupMenu
LoadCursorW
SetCursor
SetWindowPos
MoveWindow
GetSysColor
LoadImageW
GetParent
ScreenToClient

gdi32

GetDeviceCaps
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetStockObject
GetObjectW
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

comdlg32

PrintDlgW
GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetAclInformation
GetAce
LookupAccountSidW
AllocateAndInitializeSid
RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
MapGenericMask
MakeSelfRelativeSD
GetSecurityDescriptorLength
IsValidSecurityDescriptor
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
GetSecurityDescriptorDacl
IsValidSid
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
OpenProcessToken
GetTokenInformation
EqualSid
LookupAccountNameW
InitializeSid

shell32

ShellExecuteW
CommandLineToArgvW

oleaut32

SysStringLen
SysAllocStringByteLen
SysFreeString
SysAllocString
VarDateFromStr
VariantClear
VariantInit
GetErrorInfo
SetErrorInfo
VariantChangeType
CreateErrorInfo

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

netapi32

NetGetDCName
NetShareSetInfo
NetShareEnum
NetWkstaUserGetInfo
NetShareGetInfo
NetApiBufferFree

ws2_32

setsockopt
WSAStartup
gethostname
recvfrom
WSAGetLastError
sendto
inet_addr
gethostbyaddr
WSASocketW
ntohl
gethostbyname

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ShellRunas.exe
.exe windows:4 windows x86 arch:x86

a19128c77d60d2b394dfa78b2e70b342

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:cc:e2:cc:c4:d6:e4:f0:ff:e7:49:0d:c2:b5:56:b0:21:59:a0:fe
Signer

Actual PE Digest

c3:cc:e2:cc:c4:d6:e4:f0:ff:e7:49:0d:c2:b5:56:b0:21:59:a0:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord217
ord173

credui

CredUIParseUserNameW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

SetStdHandle
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
WriteConsoleA
GetConsoleCP
SetFilePointer
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleOutputCP
GetCommandLineW
SetEnvironmentVariableW
GetCurrentProcess
GetProcAddress
Sleep
CloseHandle
GetLastError
CreateProcessW
GetShortPathNameW
GetModuleFileNameW
SearchPathW
GetComputerNameW
FormatMessageW
LoadLibraryW
LocalAlloc
LocalFree
GetModuleHandleW
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers
GetConsoleMode
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
WideCharToMultiByte
LCMapStringA
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
MultiByteToWideChar

user32

CreateDialogParamW
DialogBoxIndirectParamW
InflateRect
GetSysColorBrush
SetCursor
DispatchMessageW
MessageBoxW
EnumWindows
SetDlgItemTextW
GetMessageW
TranslateMessage
PostQuitMessage
ChildWindowFromPoint
IsDialogMessageW
GetSysColor
RegisterClassExW
ShowWindow
LoadIconW
DefWindowProcW
InvalidateRect
SetWindowTextW
GetWindowThreadProcessId
SendMessageW
GetDlgItem
LoadCursorW
EndDialog

gdi32

SelectObject
GetStockObject
GetObjectW
SetTextColor
CreateFontIndirectW
StartPage
GetDeviceCaps
EndDoc
EndPage
StartDocW
SetMapMode
SetBkMode

comdlg32

PrintDlgW

advapi32

RegSetValueW
CreateProcessWithLogonW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetMalloc
SHGetDesktopFolder

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/TCPVIEW.HLP
SysinternalsSuite-v20081210/Tcpview.exe
.exe windows:4 windows x86 arch:x86

664ad68120361779226e0c390ff4562b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cb
Signer

Actual PE Digest

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ws2_32

connect
send
recv
closesocket
WSAStartup
socket
gethostbyaddr
htonl
htons
getservbyport
ntohs
ntohl
WSAGetLastError
gethostbyname
gethostname

iphlpapi

SetTcpEntry
GetTcpTable
GetUdpTable

comctl32

ord17
ord6
ImageList_Create
ImageList_ReplaceIcon
CreateToolbarEx

kernel32

OpenProcess
CreateEventA
DeviceIoControl
GetCurrentProcessId
DuplicateHandle
GetModuleFileNameA
DeleteFileA
GetSystemDirectoryA
GetVersion
FormatMessageA
GetTickCount
SetEvent
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcatA
HeapFree
lstrlenA
lstrcpyA
HeapAlloc
GetProcessHeap
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSection
ExpandEnvironmentStringsA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
Sleep
GetFileType
SetHandleCount
GetStdHandle
ExitProcess
ReadProcessMemory
HeapDestroy
VirtualAlloc
VirtualFree
DeleteCriticalSection
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RtlUnwind
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
IsDebuggerPresent
WriteConsoleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetVersionExA
GetCommandLineA
HeapReAlloc
CreateThread
ResumeThread
ExitThread
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
CloseHandle
LocalAlloc
LoadLibraryA
HeapCreate
LocalFree
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
ReadFile
GetEnvironmentStringsW

user32

TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
LoadMenuA
InsertMenuA
GetMessageA
PostQuitMessage
LoadStringA
DialogBoxParamA
GetSubMenu
EnableMenuItem
TrackPopupMenu
UpdateWindow
LoadAcceleratorsA
CreateMenu
DestroyIcon
SetDlgItemTextA
GetParent
ChildWindowFromPoint
InvalidateRect
SetCapture
ReleaseCapture
SetWindowLongA
GetWindowLongA
GetClientRect
CreateWindowExA
SetFocus
CallWindowProcA
GetSysColor
LoadIconA
DrawIconEx
InvalidateRgn
SetWindowPos
GetMenu
CheckMenuItem
SetTimer
KillTimer
GetWindowRect
IsIconic
IsZoomed
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
GetDC
DrawTextA
ReleaseDC
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
DefWindowProcA
MessageBoxA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA
GetCursorPos

gdi32

CreateSolidBrush
EndDoc
EndPage
StartPage
StartDocA
SetMapMode
GetDeviceCaps
SetBkMode
SetTextColor
SelectObject
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
ExtTextOutA
SetBkColor
DeleteObject
GetTextMetricsA
CreateCompatibleDC

comdlg32

ChooseFontA
PrintDlgA
GetSaveFileNameA

advapi32

RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteA
SHGetFileInfoA

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/Volumeid.exe
.exe windows:4 windows x86 arch:x86

c51be73105081640890f581847c006ec

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ed:91:bb:86:f6:bd:9d:98:04:40:57:86:5a:f1:55:01:98:49:11:75
Signer

Actual PE Digest

ed:91:bb:86:f6:bd:9d:98:04:40:57:86:5a:f1:55:01:98:49:11:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
LoadLibraryA
LocalAlloc
GetModuleHandleA
FlushFileBuffers
GetProcAddress
ReadFile
GetDriveTypeA
GetCPInfo
GetStringTypeW
GetStringTypeA
RtlUnwind
GetStartupInfoA
GetFileType
SetFilePointer
WriteFile
CreateFileA
GetLastError
GetVolumeInformationA
GetOEMCP
CloseHandle
GetStdHandle
SetHandleCount
GetVersionExA
DeviceIoControl
LocalFree
FormatMessageA
GetACP
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetStdHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/WINOBJ.HLP
SysinternalsSuite-v20081210/Winobj.exe
.exe windows:4 windows x86 arch:x86

21095d3077f7e9c193972ab3f98700c0

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d5:73:76:c9:a5:fe:6a:40:51:83:d7:34:d3:65:60:76:96:a5:70:5b
Signer

Actual PE Digest

d5:73:76:c9:a5:fe:6a:40:51:83:d7:34:d3:65:60:76:96:a5:70:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
HeapReAlloc
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FreeLibrary
LocalAlloc
GetCurrentProcess
lstrlenA
GetProcAddress
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetLastError
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalFree
GetVersion
FlushFileBuffers

user32

MoveWindow
ChildWindowFromPoint
GetMenu
GetSubMenu
TrackPopupMenu
DeferWindowPos
EndDeferWindowPos
SetFocus
GetParent
GetDC
DialogBoxIndirectParamA
BeginDeferWindowPos
InvertRect
ReleaseDC
SetCapture
ReleaseCapture
PostQuitMessage
InvalidateRect
DefWindowProcA
WinHelpA
DialogBoxParamA
LoadStringA
UpdateWindow
GetSysColor
RegisterClassA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetWindowRect
IsIconic
IsZoomed
LoadBitmapA
PostMessageA
SetDlgItemTextA
CheckDlgButton
ShowWindow
EnableWindow
MessageBoxA
wsprintfA
GetMessagePos
ScreenToClient
GetCursorPos
GetWindowLongA
SetWindowLongA
GetClientRect
CreateWindowExA
LoadIconA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

GetObjectA
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetMapMode
StartPage
EndDoc
GetStockObject
EndPage
StartDocA

comdlg32

PrintDlgA

advapi32

MapGenericMask
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
IsValidSecurityDescriptor
SetKernelObjectSecurity
GetKernelObjectSecurity
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord17
ord6
ImageList_Destroy
ImageList_Add
ImageList_GetImageCount
CreatePropertySheetPageA
PropertySheetA
ImageList_Create
ImageList_ReplaceIcon
CreateToolbarEx

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ZoomIt.exe
.exe windows:5 windows x86 arch:x86

27c93b78f733be4acb18aa2b65ca676e

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:47:2f:85:09:ef:f3:fc:af:8c:65:cf:50:93:3b:45:e8:2c:bf:b7
Signer

Actual PE Digest

cf:47:2f:85:09:ef:f3:fc:af:8c:65:cf:50:93:3b:45:e8:2c:bf:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

winmm

PlaySoundA

gdiplus

GdipCreateBitmapFromHBITMAP
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdipCreateFromHDC
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipDrawImageRectRect
GdipCloneImage

msimg32

AlphaBlend

kernel32

SetEnvironmentVariableA
GetConsoleMode
GetConsoleCP
SetFilePointer
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
HeapDestroy
HeapCreate
HeapReAlloc
VirtualAlloc
VirtualFree
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
GetStartupInfoA
GetCommandLineA
HeapFree
HeapAlloc
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
RaiseException
CreateEventA
Sleep
OutputDebugStringA
GetCurrentThread
SetThreadPriority
GetFileAttributesA
ExpandEnvironmentStringsA
Beep
lstrcpynA
FormatMessageA
MultiByteToWideChar
GetLastError
GetProcAddress
GetCommandLineW
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
ReadFile
CreateFileA
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
LCMapStringA

user32

LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
FindWindowA
CreateWindowExA
GetKeyState
GetAsyncKeyState
KillTimer
SetTimer
RegisterClassA
SendMessageA
PostQuitMessage
GetCursorPos
SetActiveWindow
ShowWindow
SetRect
DefWindowProcA
CreatePopupMenu
InsertMenuA
TrackPopupMenu
DestroyMenu
GetDesktopWindow
GetActiveWindow
GetParent
RegisterHotKey
BeginPaint
GetWindowRect
ScreenToClient
EndPaint
BringWindowToTop
InflateRect
SetForegroundWindow
UnregisterHotKey
PostMessageA
DialogBoxParamA
GetSysColor
ChildWindowFromPoint
IsDlgButtonChecked
EnableWindow
GetDlgItemTextA
SetDlgItemTextA
CheckDlgButton
GetMessageExtraInfo
GetClipCursor
ClipCursor
DrawTextA
InvalidateRect
SystemParametersInfoA
GetWindowLongA
SetWindowLongA
RedrawWindow
LoadIconA
MessageBoxA
GetDC
FillRect
ReleaseDC
EnumDisplaySettingsA
ChangeDisplaySettingsExA
FindWindowW
SetWindowPos
SetCursorPos
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
SetFocus

gdi32

SetStretchBltMode
StretchBlt
CreateDCA
CreateBitmap
SetROP2
GetStockObject
GetObjectA
CreateFontIndirectA
SetBkMode
SetTextColor
CreatePen
Rectangle
Ellipse
MoveToEx
LineTo
Polygon
BitBlt
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc

comdlg32

GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

CoInitialize

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/accesschk.exe
.exe windows:5 windows x86 arch:x86

9b3a99c35cf1f75d1cc6ef6b4eb480d5

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:c9:c9:aa:6b:83:64:8d:80:00:e9:c0:a1:49:4b:84:a0:c7:5c:0c
Signer

Actual PE Digest

80:c9:c9:aa:6b:83:64:8d:80:00:e9:c0:a1:49:4b:84:a0:c7:5c:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetApiBufferFree
NetUserGetLocalGroups

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoA
GetLocaleInfoW
GetTimeZoneInformation
Thread32First
OpenThread
Thread32Next
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFullPathNameW
GetVersion
GetModuleFileNameW
GetLastError
GetCurrentProcess
SetLastError
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CloseHandle
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetCurrentDirectoryW
DeleteFileW
SetEnvironmentVariableA
DeviceIoControl
FormatMessageW
GetProcAddress
GetCommandLineW
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
CreateFileA
SetEndOfFile
GetProcessHeap
ReadFile
CompareStringA
CompareStringW
SetStdHandle
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
SetFilePointer
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID

user32

GetSysColorBrush
EndDialog
SetWindowTextW
GetDlgItem
SetCursor
InflateRect
SendMessageW
DialogBoxIndirectParamW
LoadCursorW

gdi32

GetDeviceCaps
SetMapMode
StartDocW
StartPage
EndDoc
EndPage

comdlg32

PrintDlgW

advapi32

GetKernelObjectSecurity
OpenSCManagerW
CloseServiceHandle
OpenServiceW
EnumServicesStatusW
QueryServiceObjectSecurity
GetSecurityInfo
DeleteAce
RegOpenKeyExW
RegGetKeySecurity
RegEnumKeyW
GetNamedSecurityInfoW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RevertToSelf
LsaOpenPolicy
LsaNtStatusToWinError
LsaEnumerateAccountsWithUserRight
LookupPrivilegeNameW
LsaEnumerateAccountRights
LsaFreeMemory
LsaClose
GetEffectiveRightsFromAclW
GetSecurityDescriptorSacl
IsWellKnownSid
GetSecurityDescriptorOwner
LookupAccountNameW
GetSecurityDescriptorDacl
GetLengthSid
CopySid
GetTokenInformation
EqualSid
IsValidSid
GetSidIdentifierAuthority
GetAce
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 111KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/adrestore.exe
.exe windows:4 windows x86 arch:x86

66a38e1024d19e37020ae76f47816fa4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

96:fc:37:60:78:3b:25:ea:8e:28:12:5d:3a:d0:e5:35:2f:50:5f:c9
Signer

Actual PE Digest

96:fc:37:60:78:3b:25:ea:8e:28:12:5d:3a:d0:e5:35:2f:50:5f:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wldap32

ord145
ord14
ord88
ord73
ord155
ord118
ord13

activeds

ord9

kernel32

LocalFree
LoadLibraryA
LocalAlloc
GetModuleHandleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
lstrlenW
RtlUnwind
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
lstrcpyW
lstrcatW
OutputDebugStringW
GetCommandLineA
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
ReadFile
GetProcAddress
GetModuleFileNameA
SetFilePointer
GetStringTypeA
CloseHandle
GetModuleFileNameW
GetCurrentProcess
SetStdHandle
TerminateProcess
GetStartupInfoA
GetFileType
HeapAlloc
HeapFree
GetVersion
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetLastError
FlushFileBuffers
WriteFile
SetHandleCount
GetStdHandle
GetStringTypeW

user32

LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
CharNextW
SendMessageA
DialogBoxIndirectParamA
SetWindowTextA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyA

ole32

CoInitialize

oleaut32

VariantInit
VariantClear

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/autoruns.chm
.chm
SysinternalsSuite-v20081210/autoruns.exe
.exe windows:5 windows x86 arch:x86

57e7d3c04c9f7174d0993322cc327628

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:fb:4c:01:72:a7:76:87:36:96:e3:66:07:ed:5e:8e:7a:a9:d8:6f
Signer

Actual PE Digest

ef:fb:4c:01:72:a7:76:87:36:96:e3:66:07:ed:5e:8e:7a:a9:d8:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

ImageList_ReplaceIcon
ImageList_Draw
ImageList_Add
ord17
CreateToolbarEx
ImageList_GetIcon
ImageList_Create
ImageList_Remove
ImageList_GetImageCount

kernel32

LoadLibraryExA
SetErrorMode
GetCommandLineA
TerminateProcess
CreateSemaphoreA
InitializeCriticalSection
TlsAlloc
GetCommandLineW
SearchPathA
FindClose
FindNextFileA
FindFirstFileA
EnumSystemLocalesA
GetUserDefaultLCID
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
FileTimeToLocalFileTime
GetStringTypeA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
FatalAppExitA
DeleteCriticalSection
GetCurrentThread
GetCurrentThreadId
SetLastError
FreeLibrary
GetModuleHandleW
GetStartupInfoA
CreateThread
ResumeThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
HeapReAlloc
HeapAlloc
RtlUnwind
lstrlenW
GetProcessHeap
HeapFree
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileAttributesA
GetModuleHandleA
LocalAlloc
FlushFileBuffers
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
CompareStringA
lstrcmpA
LocalFree
FormatMessageA
GetVersion
MulDiv
lstrcpyA
lstrlenA
lstrcatA
GetTickCount
CreateFileA
ReadFile
SetFilePointer
GetWindowsDirectoryA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
GetLocaleInfoA
GetNumberFormatA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
TlsSetValue
GetCurrentProcess
GetLastError
CloseHandle
ExitThread
WaitForSingleObject
ReleaseSemaphore
MultiByteToWideChar
OpenProcess
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
GetPrivateProfileStringA
WriteProfileStringA
WritePrivateProfileStringA
GetProfileStringA
CreateDirectoryA
SetFileAttributesA
MoveFileA
RemoveDirectoryA
CreateProcessA
EnterCriticalSection
LeaveCriticalSection
GetFileSize
TlsFree
GetFileTime
WideCharToMultiByte
TlsGetValue
CompareStringW
GetStringTypeW
IsValidLocale

user32

GetMessageA
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetMenuItemInfoA
DrawMenuBar
LoadStringA
DrawIconEx
PostQuitMessage
InvalidateRgn
MapWindowPoints
ModifyMenuA
GetSysColorBrush
ChildWindowFromPoint
LoadAcceleratorsA
GetClassNameA
CreateDialogParamA
RegisterClassExA
LoadImageA
RegisterWindowMessageA
DialogBoxIndirectParamA
DeferWindowPos
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
OffsetRect
UnionRect
PtInRect
BeginPaint
DrawFrameControl
EndPaint
SetPropA
GetWindowLongA
SetWindowLongA
EnableWindow
InflateRect
GetPropA
EndDialog
TrackPopupMenu
EnableMenuItem
DeleteMenu
GetSubMenu
InsertMenuA
SetDlgItemTextA
EnumDisplaySettingsA
FindWindowA
GetWindowThreadProcessId
SetForegroundWindow
FindWindowExA
WaitForInputIdle
CreateIconIndirect
GetIconInfo
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetMenu
CheckMenuItem
SetWindowTextA
DialogBoxParamA
SetWindowPos
GetWindowRect
IsIconic
IsZoomed
GetDlgItem
SetTimer
GetParent
GetCursorPos
CreateWindowExA
CallWindowProcA
GetSysColor
GetClientRect
GetSystemMetrics
IntersectRect
InvalidateRect
GetFocus
GetDC
DrawTextA
ReleaseDC
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
DestroyWindow
DefWindowProcA
MessageBoxA
PostMessageA
SetFocus
LoadCursorA
SetCursor
SendMessageA
LoadIconA
DestroyIcon
ReleaseCapture

gdi32

GetDIBits
CreateDIBSection
SetMapMode
StartDocA
StartPage
EndPage
EndDoc
CreateSolidBrush
GetTextMetricsA
DeleteObject
GetStockObject
GetObjectA
CreateCompatibleDC
GetDeviceCaps
DeleteDC
CreateFontIndirectA
SetBkColor
ExtTextOutA
GetTextExtentPoint32A
SelectObject
SetTextColor
SetBkMode
GdiFlush

comdlg32

GetOpenFileNameA
FindTextA
GetSaveFileNameA
PrintDlgA
ChooseFontA

advapi32

RegOpenKeyA
RegGetKeySecurity
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegSetKeySecurity
RegDeleteKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegUnLoadKeyA
RegLoadKeyA
RegDeleteValueA
RegCreateKeyExA
RegQueryInfoKeyA
LookupAccountSidA
RegQueryValueA
RegEnumKeyA
DeleteService
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CryptReleaseContext
GetTokenInformation

shell32

SHGetFileInfoA
CommandLineToArgvW
ShellExecuteExA
ShellExecuteA

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
SysStringByteLen
VariantInit
VariantClear
VariantChangeType
GetErrorInfo
SetErrorInfo
CreateErrorInfo

shlwapi

SHCreateStreamOnFileA
UrlUnescapeA

Sections

.text
Size: 429KB - Virtual size: 429KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/autorunsc.exe
.exe windows:5 windows x86 arch:x86

3780ca98593f814f3bfa59f1cfe6a796

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:fe:89:6e:f9:92:07:32:fd:74:f9:b9:bd:b6:44:b1:d7:cc:0d:2c
Signer

Actual PE Digest

6c:fe:89:6e:f9:92:07:32:fd:74:f9:b9:bd:b6:44:b1:d7:cc:0d:2c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

ImageList_Add
ImageList_GetIcon
ImageList_ReplaceIcon

kernel32

LeaveCriticalSection
EnterCriticalSection
CreateProcessA
MultiByteToWideChar
ExitThread
SetErrorMode
InitializeCriticalSection
TlsAlloc
SearchPathA
GetCommandLineW
GetPrivateProfileStringA
FreeLibrary
LoadLibraryExA
WritePrivateProfileStringA
FindClose
FindNextFileA
FindFirstFileA
CompareStringA
SetEndOfFile
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileSize
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileAttributesA
lstrcpyA
GetVersion
GetModuleHandleA
LocalAlloc
lstrcmpA
lstrlenA
FormatMessageA
GetStdHandle
WriteFile
LocalFree
IsValidCodePage
CreateFileA
ReadFile
SetFilePointer
GetWindowsDirectoryA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
GetLocaleInfoA
GetNumberFormatA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
TlsSetValue
GetCurrentProcess
GetLastError
CloseHandle
WideCharToMultiByte
TlsGetValue
CompareStringW
GetOEMCP
GetACP
FlushFileBuffers
HeapSize
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
GetCPInfo
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
ExitProcess
Sleep
GetModuleHandleW
HeapDestroy
SetHandleCount
LCMapStringW
HeapFree
GetProcessHeap
lstrlenW
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapCreate
LCMapStringA

user32

LoadCursorA
LoadIconA
DestroyIcon
SetCursor
SendMessageA
LoadStringA
DialogBoxIndirectParamA
GetSysColorBrush
EndDialog
InflateRect
TrackPopupMenu
EnableMenuItem
GetDlgItem
SetDlgItemTextA
ShowWindow
GetMenu
DeleteMenu
GetSubMenu
InsertMenuA
SetWindowTextA
CheckMenuItem

gdi32

DeleteObject
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegOpenKeyA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
CloseServiceHandle
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegQueryInfoKeyA
RegEnumKeyA
RegQueryValueA
RegLoadKeyA
RegUnLoadKeyA
RegCreateKeyA
RegEnumValueA
RegSetValueExA
RegDeleteKeyA
LookupAccountSidA
RegQueryValueExA
RegSetKeySecurity
RegGetKeySecurity
AllocateAndInitializeSid
GetTokenInformation
EqualSid
FreeSid
OpenProcessToken

shell32

SHGetFileInfoA
ShellExecuteA

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocString
SysFreeString
SetErrorInfo
GetErrorInfo
CreateErrorInfo

shlwapi

UrlUnescapeA

Sections

.text
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ctrl2cap.amd.sys
.sys windows:5 windows x64 arch:x64

053a0aec95933cbf178d865941afc5bf

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:c1:a7:98:b8:75:89:43:35:c7:8c:dd:bf:05:cb:ff
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02/02/2006, 00:00

Not After

04/04/2007, 23:59

Subject

CN=Sysinternals,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Headquarters,O=Sysinternals,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

29:63:9d:13:86:b7:68:42:ef:cd:8a:89:c6:4d:8a:96:6e:39:42:f4
Signer

Actual PE Digest

29:63:9d:13:86:b7:68:42:ef:cd:8a:89:c6:4d:8a:96:6e:39:42:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoDeleteDevice
IoCreateDevice
IoAttachDeviceToDeviceStack
IoDetachDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp
KeBugCheckEx

Sections

.text
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 441B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ctrl2cap.exe
.exe windows:4 windows x86 arch:x86

30deec6579f48261855708cba9a37fd6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e7:c3:fd:d1:6b:37:27:73:8d:f5:de:36:59:56:81:10:87:84:35:93
Signer

Actual PE Digest

e7:c3:fd:d1:6b:37:27:73:8d:f5:de:36:59:56:81:10:87:84:35:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
SetStdHandle
FlushFileBuffers
LCMapStringA
LocalFree
GetCPInfo
LCMapStringW
GetStringTypeA
GetStringTypeW
LocalAlloc
GetModuleHandleA
GetOEMCP
SetFilePointer
WriteFile
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetVersion
GetSystemDirectoryA
CopyFileA
GetLastError
FormatMessageA
DeleteFileA
GetACP
ExitProcess
TerminateProcess
HeapAlloc
HeapFree
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

StartDocA
GetDeviceCaps
SetMapMode
StartPage
EndPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegOpenKeyA
RegCreateKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/ctrl2cap.nt4.sys
.sys windows:4 windows x86 arch:x86

f8e3459f539be62994d9e0b7ee4b6de7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

IoCreateDevice
RtlInitUnicodeString
RtlFreeUnicodeString
IoDeleteDevice
IoAttachDevice
ZwDisplayString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IofCallDriver

Sections

.text
Size: 576B - Virtual size: 547B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 32B - Virtual size: 29B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 352B - Virtual size: 332B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 64B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ctrl2cap.nt5.sys
.sys windows:5 windows x86 arch:x86

4e00a523e4d7d53a2dee34c0906284ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

IoDeleteDevice
IoCreateDevice
IoAttachDeviceToDeviceStack
IoDetachDevice
IofCallDriver
PoCallDriver
PoStartNextPowerIrp

Sections

.text
Size: 160B - Virtual size: 137B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 256B - Virtual size: 249B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 320B - Virtual size: 292B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/dbgview.chm
.chm
SysinternalsSuite-v20081210/diskext.exe
.exe windows:4 windows x86 arch:x86

b22dba3eb8d92bd6ce1baeda177318c8

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c9:b0:b0:68:c7:cc:40:3c:03:43:cb:d0:f9:cf:a4:48:e5:44:6d:22
Signer

Actual PE Digest

c9:b0:b0:68:c7:cc:40:3c:03:43:cb:d0:f9:cf:a4:48:e5:44:6d:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
LocalAlloc
GetLastError
HeapSize
FlushFileBuffers
GetModuleHandleA
GetVersion
LoadLibraryA
GetProcAddress
GetDriveTypeA
WriteConsoleA
CreateFileA
GetConsoleMode
GetConsoleCP
DeviceIoControl
CloseHandle
FormatMessageA
SetStdHandle
LocalFree
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
RtlUnwind
InitializeCriticalSection
SetFilePointer

user32

SendMessageA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/du.exe
.exe windows:5 windows x86 arch:x86

79cd983d895243c54cd1a0d60e7d5520

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:7f:b8:e3:ed:af:97:44:bd:a7:03:e6:98:41:9c:a6:69:00:c7:6c
Signer

Actual PE Digest

bf:7f:b8:e3:ed:af:97:44:bd:a7:03:e6:98:41:9c:a6:69:00:c7:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryW
GetModuleHandleW
LocalFree
LocalAlloc
GetCommandLineW
SetEnvironmentVariableA
GetFullPathNameW
CompareStringA
CreateFileA
GetTimeZoneInformation
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
GetCurrentDirectoryW
GetLocaleInfoW
GetFileAttributesW
FindFirstFileW
FindNextFileW
CreateFileW
FindClose
CloseHandle
GetFileInformationByHandle
GetCompressedFileSizeW
FormatMessageW
InterlockedDecrement
CompareStringW
GetNumberFormatW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapFree
GetProcessHeap
GetLastError
lstrlenW
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
Sleep
ExitProcess
FatalAppExitA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA

user32

SetWindowTextW
SetCursor
InflateRect
SendMessageW
EndDialog
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamW
LoadCursorW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

oleaut32

SysFreeString
SysAllocString
SetErrorInfo
VariantInit
VariantClear
VariantChangeType
GetErrorInfo
CreateErrorInfo

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/efsdump.exe
.exe windows:4 windows x86 arch:x86

94c991fc087e6d6976569ef8614bce42

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cc:61:2f:9b:93:b1:3d:ea:4e:4b:63:4b:28:15:78:b0:25:40:60:ba
Signer

Actual PE Digest

cc:61:2f:9b:93:b1:3d:ea:4e:4b:63:4b:28:15:78:b0:25:40:60:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
LoadLibraryA
WideCharToMultiByte
SetFilePointer
SetStdHandle
CloseHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetModuleHandleW
GetLastError
GetModuleFileNameA
LocalAlloc
LoadLibraryW
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
FormatMessageW
GetProcAddress
LocalFree
HeapAlloc
HeapFree
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
WriteFile
GetStringTypeW

user32

DialogBoxIndirectParamW
LoadCursorW
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
SendMessageW

gdi32

StartDocW
GetDeviceCaps
SetMapMode
StartPage
EndPage
EndDoc

comdlg32

PrintDlgW

advapi32

RegQueryValueExW
RegSetValueExW
RegCloseKey
QueryUsersOnEncryptedFile
LookupAccountSidW
QueryRecoveryAgentsOnEncryptedFile
FreeEncryptionCertificateHashList
RegCreateKeyW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/handle.exe
.exe windows:5 windows x86 arch:x86

772feda8a5b0e1a20e6162a195239816

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:dc:02:d3:4f:54:d0:38:7f:33:07:74:be:3c:ff:16:7f:95:91:86
Signer

Actual PE Digest

f9:dc:02:d3:4f:54:d0:38:7f:33:07:74:be:3c:ff:16:7f:95:91:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DuplicateHandle
GetCurrentProcessId
DeleteFileA
GetSystemDirectoryA
GetConsoleScreenBufferInfo
GetStdHandle
WaitForSingleObject
CreateProcessA
GetCommandLineA
ExpandEnvironmentStringsA
GetFileAttributesA
lstrcpyA
GetVersion
CompareStringW
CompareStringA
GetTimeZoneInformation
ReadFile
GetProcessHeap
SetEndOfFile
GetLocaleInfoW
HeapSize
IsValidLocale
EnumSystemLocalesA
OpenProcess
GetDriveTypeA
DeviceIoControl
FormatMessageA
GetCommandLineW
LoadLibraryA
LocalAlloc
GetModuleHandleA
LocalFree
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
GetModuleFileNameA
CloseHandle
HeapAlloc
HeapFree
GetModuleHandleW
Sleep
ExitProcess
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
WideCharToMultiByte
GetConsoleCP
RtlUnwind
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
LCMapStringA
MultiByteToWideChar
LCMapStringW
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetStdHandle
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
SetEnvironmentVariableA

user32

DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

LookupAccountSidA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/hex2dec.exe
.exe windows:4 windows x86 arch:x86

86cd32601e5478b1662abe3fb33c6620

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

45:af:49:6a:d8:80:9a:0d:bc:ff:e2:bf:46:8b:76:96:74:06:10:e3
Signer

Actual PE Digest

45:af:49:6a:d8:80:9a:0d:bc:ff:e2:bf:46:8b:76:96:74:06:10:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
GetOEMCP
GetProcAddress
LCMapStringW
SetStdHandle
FlushFileBuffers
ReadFile
LCMapStringA
GetCPInfo
GetLastError
WriteFile
GetModuleHandleA
LocalAlloc
LoadLibraryA
SetFilePointer
LocalFree
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

EndPage
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/junction.exe
.exe windows:4 windows x86 arch:x86

14e577546b54e63c7d37aad59ed535d8

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:6b:9b:80:c9:8b:ff:52:e3:d8:f3:2c:c4:03:6a:bc:7b:53:bf:f1
Signer

Actual PE Digest

46:6b:9b:80:c9:8b:ff:52:e3:d8:f3:2c:c4:03:6a:bc:7b:53:bf:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryW
GetVolumeInformationW
GetFullPathNameW
GetCurrentDirectoryW
RemoveDirectoryW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
GetLastError
DeviceIoControl
GetFileAttributesW
FormatMessageW
CloseHandle
LocalAlloc
LoadLibraryW
LocalFree
CreateFileA
GetModuleHandleW
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
HeapSize
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

DialogBoxIndirectParamW
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
LoadCursorW
SetCursor
InflateRect
SendMessageW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ldmdump.exe
.exe windows:4 windows x86 arch:x86

62430f16891f2bbc3e224c30b3127f73

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cd:66:fb:ce:39:19:bc:b9:14:88:64:7c:3a:e0:21:8f:f0:93:2c:ea
Signer

Actual PE Digest

cd:66:fb:ce:39:19:bc:b9:14:88:64:7c:3a:e0:21:8f:f0:93:2c:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
LocalAlloc
GetModuleHandleA
LCMapStringA
SetStdHandle
CreateFileA
GetProcAddress
SetFilePointer
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
CloseHandle
DeviceIoControl
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
FlushFileBuffers
GetTimeFormatA
WriteFile
RtlUnwind
ReadFile
GetLastError
FormatMessageA
LocalFree
GetOEMCP
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
LCMapStringW

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/livekd.exe
.exe windows:4 windows x86 arch:x86

dde1f246f40f0b1d37a6e2e8b8ce5176

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

04:aa:bb:7a:67:95:56:91:13:94:8d:55:28:ee:a9:5a:b8:06:59:e4
Signer

Actual PE Digest

04:aa:bb:7a:67:95:56:91:13:94:8d:55:28:ee:a9:5a:b8:06:59:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

FormatMessageA
TerminateProcess
DeleteFileA
SetFileAttributesA
GetSystemInfo
GetVersionExA
DeviceIoControl
GetSystemDirectoryA
GetModuleFileNameA
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCurrentDirectoryA
IsProcessorFeaturePresent
SearchPathA
SetCurrentDirectoryA
WaitForSingleObject
CreateProcessA
GetCommandLineA
LocalAlloc
GetFileAttributesA
GetEnvironmentStrings
GetStartupInfoA
SetConsoleCtrlHandler
SetFilePointer
SetStdHandle
RtlUnwind
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetEndOfFile
LoadLibraryA
LocalFree
GetModuleHandleA
GetProcAddress
SetLastError
CreateFileA
WideCharToMultiByte
FlushFileBuffers
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
CloseHandle
GetStringTypeA
GetStringTypeW
ExpandEnvironmentStringsA
HeapAlloc
HeapFree
GetVersion
ExitProcess
WriteFile
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
ReadFile

user32

GetSysColorBrush
SendMessageA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
SetWindowTextA
EndDialog
DialogBoxIndirectParamA

gdi32

GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc

comdlg32

PrintDlgA

advapi32

RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 212KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/logonsessions.exe
.exe windows:4 windows x86 arch:x86

14ca7be88bc9bcca24a222ae4c6ccf28

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c0:62:08:eb:fa:33:0b:07:25:cc:c0:9f:4a:e8:6c:af:e6:2e:70:de
Signer

Actual PE Digest

c0:62:08:eb:fa:33:0b:07:25:cc:c0:9f:4a:e8:6c:af:e6:2e:70:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

LsaFreeReturnBuffer
LsaEnumerateLogonSessions
LsaGetLogonSessionData

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

kernel32

GetModuleHandleW
DeviceIoControl
OpenProcess
InterlockedDecrement
InterlockedIncrement
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemDirectoryW
LocalFree
LoadLibraryW
GetProcAddress
GetCurrentProcess
LCMapStringA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WideCharToMultiByte
SetFilePointer
FlushFileBuffers
SetStdHandle
GetModuleFileNameA
SetLastError
CreateFileW
FindResourceW
LoadResource
SizeofResource
LocalAlloc
LockResource
GetCommandLineA
GetCommandLineW
GetLastError
CloseHandle
LoadLibraryA
SetEndOfFile
ReadFile
GetStringTypeA
GetStringTypeW
RaiseException
LCMapStringW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
MultiByteToWideChar
FreeEnvironmentStringsA
GetModuleFileNameW
UnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
RtlUnwind
HeapAlloc
HeapFree
GetVersion
ExitProcess
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc

user32

DialogBoxIndirectParamW
SendMessageW
SetWindowTextW
EndDialog
GetDlgItem
InflateRect
SetCursor
LoadCursorW
GetSysColorBrush

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegQueryValueExW
ConvertSidToStringSidW
GetTokenInformation
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

oleaut32

VariantChangeType
SysStringLen
SysAllocStringByteLen
SysFreeString
SystemTimeToVariantTime
SysAllocString
VariantInit
VariantClear

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/movefile.exe
.exe windows:4 windows x86 arch:x86

00b6ca1f234c6bdbcfbff0daf0a566f2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f0:8e:6d:22:ff:f3:66:4f:d2:3f:f7:83:0f:94:54:da:8a:cf:ef:19
Signer

Actual PE Digest

f0:8e:6d:22:ff:f3:66:4f:d2:3f:f7:83:0f:94:54:da:8a:cf:ef:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetStdHandle
FlushFileBuffers
MultiByteToWideChar
LocalAlloc
GetACP
GetModuleHandleA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetProcAddress
GetCPInfo
SetFilePointer
LoadLibraryA
LocalFree
MoveFileExA
GetOEMCP
GetLastError
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
RtlUnwind
WriteFile
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

EndDoc
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/newsid.exe
.exe windows:4 windows x86 arch:x86

25e90e4411d14c44cd4a1194a1387b99

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

56:70:5f:3c:ce:a3:d4:3e:ff:7a:62:ed:88:ed:67:87:dc:79:24:54
Signer

Actual PE Digest

56:70:5f:3c:ce:a3:d4:3e:ff:7a:62:ed:88:ed:67:87:dc:79:24:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
LCMapStringW
LCMapStringA
MultiByteToWideChar
UnhandledExceptionFilter
FreeEnvironmentStringsA
TlsAlloc
GetCurrentThreadId
IsBadWritePtr
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
SetFilePointer
GetCPInfo
TerminateProcess
VirtualAlloc
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
LoadLibraryA
SetStdHandle
FlushFileBuffers
ReadFile
LocalFree
LocalAlloc
LoadLibraryW
GetVersion
GetCommandLineW
GetComputerNameW
ExitProcess
GetModuleHandleW
GetProcAddress
SetComputerNameW
CreateDirectoryW
lstrcpyW
SetLastError
lstrlenW
GetCurrentProcess
CloseHandle
GetLastError
FormatMessageW
ExpandEnvironmentStringsW
GetFileAttributesW
Sleep
GetLogicalDrives
GetVolumeInformationW
GetDriveTypeW
FindFirstFileW
FindNextFileW
FindClose
TlsGetValue
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
HeapCreate
HeapFree
HeapAlloc
ResumeThread
CreateThread
TlsSetValue
ExitThread
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
RtlUnwind
WideCharToMultiByte
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapDestroy

user32

ShowWindow
InflateRect
DialogBoxIndirectParamW
GetNextDlgGroupItem
DefWindowProcW
SetWindowTextW
CreateWindowExW
SendMessageW
MapWindowPoints
CreateDialogParamW
SetWindowPos
IsWindowEnabled
GetNextDlgTabItem
LoadIconW
RegisterClassExW
GetWindowLongW
SetWindowLongW
GetMessageW
wsprintfW
DispatchMessageW
IsDialogMessageW
PostQuitMessage
TranslateMessage
EnableWindow
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
CheckDlgButton
DialogBoxParamW
EndDialog
GetParent
GetWindowRect
MoveWindow
GetDlgItem
LoadCursorW
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
MessageBoxW
PostMessageW
SetDlgItemTextW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetStockObject
GetObjectW
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
GetDeviceCaps

comctl32

ord17

comdlg32

PrintDlgW

advapi32

RegOpenKeyW
RegConnectRegistryW
RegFlushKey
RegSaveKeyW
RegReplaceKeyW
FreeSid
GetLengthSid
AllocateAndInitializeSid
IsValidSid
GetSidIdentifierAuthority
InitiateSystemShutdownW
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
GetSidSubAuthorityCount
GetSidSubAuthority
RegQueryValueW
RegCreateKeyW
RegEnumValueW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegLoadKeyW
RegUnLoadKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetKeySecurity
RegCloseKey
RegGetKeySecurity
GetNamedSecurityInfoW
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetAclInformation
GetAce
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
SetFileSecurityW
GetSecurityDescriptorGroup

shell32

CommandLineToArgvW
SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteW

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/ntfsinfo.exe
.exe windows:4 windows x86 arch:x86

ad192e4578fb7d605b78b24eb33204a7

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:7b:93:1e:28:f9:a2:73:dc:5b:89:59:c3:02:b2:6a:b9:53:89:ce
Signer

Actual PE Digest

48:7b:93:1e:28:f9:a2:73:dc:5b:89:59:c3:02:b2:6a:b9:53:89:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
printf
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
wcslen
wcscpy
free
malloc
exit
sprintf

kernel32

LocalAlloc
LoadLibraryA
GetModuleHandleA
CreateFileA
GetLastError
CloseHandle
FindFirstFileA
FindClose
FormatMessageA
LocalFree
GetProcAddress

user32

LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA
DialogBoxIndirectParamA

gdi32

StartDocA
StartPage
EndDoc
GetDeviceCaps
SetMapMode
EndPage

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

comdlg32

PrintDlgA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/pagedfrg.exe
.exe windows:4 windows x86 arch:x86

bd450e46d8e9a796db50878d454ea94a

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

21:c6:2d:44:65:d6:c5:c9:b3:b6:44:70:1c:8a:a3:6d:64:53:58:da
Signer

Actual PE Digest

21:c6:2d:44:65:d6:c5:c9:b3:b6:44:70:1c:8a:a3:6d:64:53:58:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
CreateEventA
GetVersion
LocalFree
LoadLibraryA
LocalAlloc
LCMapStringA
GetStringTypeW
GetStringTypeA
ReadFile
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
MultiByteToWideChar
SetFilePointer
FlushFileBuffers
SetStdHandle
RtlUnwind
GetFileType
DeleteFileA
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
WriteFile
ExitProcess
GetStartupInfoA
HeapAlloc
LCMapStringW
HeapFree
FindFirstFileA
FindNextFileA
FindClose
GetCurrentProcessId
OpenProcess
GetCommandLineA
DeviceIoControl
DuplicateHandle
CreateThread
TerminateThread
SetEvent
WaitForSingleObject
GetDriveTypeA
GetProcAddress
GetModuleHandleA
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
GetStdHandle
CloseHandle

user32

EndDialog
SendMessageA
SetWindowTextA
DialogBoxIndirectParamA
LoadIconA
RegisterClassExA
CreateDialogParamA
GetMessageA
TranslateMessage
DispatchMessageA
IsDialogMessageA
IsDlgButtonChecked
GetDlgItemTextA
WinHelpA
GetDlgItem
EnableWindow
SendDlgItemMessageA
InflateRect
CheckDlgButton
SetDlgItemTextA
LoadCursorA
GetWindowRect
GetClientRect
CreateWindowExA
SetWindowPos
ShowWindow
PostQuitMessage
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
DefWindowProcA
PostMessageA
MessageBoxA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetStockObject
GetObjectA
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
GetDeviceCaps

comctl32

ord17

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegCreateKeyA

shell32

ShellExecuteA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pagedfrg.hlp
SysinternalsSuite-v20081210/pdh.dll
.dll windows:5 windows x86 arch:x86

63db478edeb55ea635f2a1b63cbe23b6

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:17:f5:37:fa:ba:03:4c:13:b6:4c:c0:5e:42:a6:5f:32:6e:69:c7
Signer

Actual PE Digest

c6:17:f5:37:fa:ba:03:4c:13:b6:4c:c0:5e:42:a6:5f:32:6e:69:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

mbstowcs
??2@YAPAXI@Z
??3@YAXPAX@Z
atof
atol
_ultoa
_wfopen
sprintf
rewind
fclose
fgets
_wsplitpath
wcsncmp
strstr
wcstol
swprintf
_ultow
wcsncpy
_CIpow
wcstoul
_ltoa
_ftol
floor
_except_handler3
setlocale
wcstombs
_ltow

kernel32

SetErrorMode
InterlockedIncrement
CreateThread
CreateMutexW
GetExitCodeThread
WaitForMultipleObjects
LockFile
SetEndOfFile
FlushViewOfFile
UnlockFile
WriteFile
lstrcpyA
GetWindowsDirectoryA
HeapFree
HeapAlloc
SetLastError
lstrlenW
lstrcpyW
lstrcmpW
lstrcatW
HeapReAlloc
lstrcmpiW
GetLastError
ReleaseMutex
lstrlenA
WaitForSingleObject
lstrcatA
HeapSize
FileTimeToLocalFileTime
SystemTimeToFileTime
GetUserDefaultLangID
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
CreateMutexA
CloseHandle
Sleep
FlushFileBuffers
InterlockedDecrement
SetEvent
CreateEventW
HeapDestroy
GetProcessHeap
HeapCreate
GetComputerNameW
DisableThreadLibraryCalls
GetVersionExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrcmpiA
GetFileSize
GetCurrentProcessId
lstrcpynW
lstrcmpA
lstrcpynA
ReadFile
SetFilePointer
FileTimeToSystemTime
SearchPathW

advapi32

CloseServiceHandle
RegCloseKey
ControlService
RegQueryValueExA
OpenSCManagerW
OpenServiceW
StartServiceA
RegQueryInfoKeyA
DeregisterEventSource
RegisterEventSourceW
RegConnectRegistryW
RegOpenKeyExW
RegQueryValueExW

comdlg32

GetOpenFileNameW

user32

SetWindowTextW
SetWindowTextA
SetCursor
SendDlgItemMessageW
SetWindowLongW
SendMessageA
GetWindowLongW
LoadCursorA
SetFocus
MessageBoxW
MessageBeep
CheckRadioButton
GetDlgItemTextW
ReleaseDC
GetDC
IsDlgButtonChecked
ShowWindow
IsWindowEnabled
CreateDialogParamW
DialogBoxParamW
SetWindowPos
GetWindowRect
GetParent
PostMessageW
SendMessageW
EndDialog
GetDlgCtrlID
GetDlgItem
EnableWindow
WinHelpA
LoadStringW
GetWindowTextW
GetFocus

ole32

CoInitializeEx
CoGetInterfaceAndReleaseStream
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitializeSecurity
CoCreateInstance

gdi32

GetTextExtentPoint32W

oleaut32

SafeArrayDestroy
SysFreeString
VariantClear
SafeArrayGetElement
SysAllocString
SafeArrayGetUBound
VariantInit
SafeArrayGetLBound

Exports

Exports

PdhAddCounterA
PdhAddCounterW
PdhBrowseCountersA
PdhBrowseCountersW
PdhCalculateCounterFromRawValue
PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhEnumMachinesA
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsW
PdhExpandCounterPathA
PdhExpandCounterPathW
PdhExpandWildCardPathA
PdhExpandWildCardPathW
PdhFormatFromRawValue
PdhGetCounterInfoA
PdhGetCounterInfoW
PdhGetCounterTimeBase
PdhGetDataSourceTimeRangeA
PdhGetDataSourceTimeRangeW
PdhGetDefaultPerfCounterA
PdhGetDefaultPerfCounterW
PdhGetDefaultPerfObjectA
PdhGetDefaultPerfObjectW
PdhGetDllVersion
PdhGetFormattedCounterArrayA
PdhGetFormattedCounterArrayW
PdhGetFormattedCounterValue
PdhGetLogFileSize
PdhGetRawCounterArrayA
PdhGetRawCounterArrayW
PdhGetRawCounterValue
PdhIsRealTimeQuery
PdhLogServiceCommandA
PdhLogServiceCommandW
PdhLogServiceControlA
PdhLogServiceControlW
PdhLookupPerfIndexByNameA
PdhLookupPerfIndexByNameW
PdhLookupPerfNameByIndexA
PdhLookupPerfNameByIndexW
PdhMakeCounterPathA
PdhMakeCounterPathW
PdhOpenLogA
PdhOpenLogW
PdhOpenQuery
PdhOpenQueryA
PdhOpenQueryW
PdhParseCounterPathA
PdhParseCounterPathW
PdhParseInstanceNameA
PdhParseInstanceNameW
PdhReadRawLogRecord
PdhRemoveCounter
PdhSelectDataSourceA
PdhSelectDataSourceW
PdhSetCounterScaleFactor
PdhSetDefaultRealTimeDataSource
PdhSetQueryTimeRange
PdhUpdateLogA
PdhUpdateLogFileCatalog
PdhUpdateLogW
PdhValidatePathA
PdhValidatePathW
PdhVbAddCounter
PdhVbCreateCounterPathList
PdhVbGetCounterPathElements
PdhVbGetCounterPathFromList
PdhVbGetDoubleCounterValue
PdhVbGetLogFileSize
PdhVbGetOneCounterPath
PdhVbIsGoodStatus
PdhVbOpenLog
PdhVbOpenQuery
PdhVbUpdateLog

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pendmoves.exe
.exe windows:4 windows x86 arch:x86

5a91fba10cbf977c4bc79b6c310ba433

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

53:ae:e5:b1:43:01:f0:0b:78:d8:5f:1e:10:a8:f7:b4:77:f6:8b:da
Signer

Actual PE Digest

53:ae:e5:b1:43:01:f0:0b:78:d8:5f:1e:10:a8:f7:b4:77:f6:8b:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
GetTimeFormatA
GetProcAddress
GetOEMCP
GetACP
GetModuleHandleA
LocalAlloc
LoadLibraryA
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
GetDateFormatA
GetCPInfo
SetFilePointer
GetFileAttributesA
GetLastError
FormatMessageA
GetStdHandle
WriteFile
LocalFree
FlushFileBuffers
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
CloseHandle

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryInfoKeyA
RegCloseKey
RegQueryValueExA

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pipelist.exe
.exe windows:4 windows x86 arch:x86

266fbb448c826115d3a974ad4a7e81a4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:ef:e6:66:a8:23:7c:bd:22:8f:cf:15:97:41:2c:d7:10:55:12:9e
Signer

Actual PE Digest

30:ef:e6:66:a8:23:7c:bd:22:8f:cf:15:97:41:2c:d7:10:55:12:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
SetStdHandle
FlushFileBuffers
LCMapStringW
CreateFileA
GetCPInfo
SetFilePointer
MultiByteToWideChar
GetStringTypeA
LocalAlloc
LoadLibraryA
GetModuleHandleA
GetOEMCP
GetProcAddress
WriteFile
RtlUnwind
GetLastError
CloseHandle
FormatMessageA
GetACP
LocalFree
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetStringTypeW

user32

DialogBoxIndirectParamA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SysinternalsSuite-v20081210/portmon.exe
.exe windows:4 windows x86 arch:x86

318b0ededb6f2e0a03cd54fdae35e0d9

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bf:b7:b3:e5:68:3d:49:32:9f:e8:91:c4:80:38:3c:06:08:e1:3f:85
Signer

Actual PE Digest

bf:b7:b3:e5:68:3d:49:32:9f:e8:91:c4:80:38:3c:06:08:e1:3f:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetAddConnection2A
WNetCancelConnection2A

ws2_32

inet_ntoa
closesocket
ioctlsocket
WSAGetLastError
accept
inet_addr
gethostbyaddr
connect
WSAStartup
socket
gethostbyname
htonl
htons
bind
getsockname
listen

comctl32

CreateToolbarEx
ord17

kernel32

EnterCriticalSection
LockResource
SizeofResource
LoadResource
FindResourceA
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
lstrlenA
GetTimeFormatA
DosDateTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcatA
HeapFree
lstrcpyA
HeapAlloc
GetProcessHeap
WriteFileEx
CopyFileA
GetCurrentThreadId
QueryPerformanceCounter
FreeLibrary
GetProcAddress
LoadLibraryA
QueueUserAPC
SleepEx
GlobalMemoryStatus
FindClose
SearchPathA
FindFirstFileA
InitializeCriticalSection
GetFullPathNameA
GetCommandLineA
GetVersion
LeaveCriticalSection
GetModuleHandleA
InterlockedDecrement
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
FlushFileBuffers
RtlUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsAlloc
ExitProcess
GetStartupInfoA
ExitThread
TlsSetValue
CreateThread
ResumeThread
FormatMessageA
LocalFree
DeleteFileA
GetCurrentDirectoryA
GetComputerNameA
TerminateThread
SetEvent
CreateEventA
WaitForMultipleObjects
OutputDebugStringA
DeviceIoControl
QueryPerformanceFrequency
WriteFile
ResetEvent
ReadFile
WaitForSingleObject
GetOverlappedResult
CreateFileA
CloseHandle
GetTickCount
GetLastError
SetLastError
InterlockedIncrement
SetStdHandle
LCMapStringA
LCMapStringW
SetEndOfFile
LocalAlloc

user32

EnumWindows
LoadAcceleratorsA
TranslateAcceleratorA
IsWindow
GetWindowTextA
UpdateWindow
RegisterClassA
LoadBitmapA
LoadStringA
WinHelpA
SetWindowPos
KillTimer
SendDlgItemMessageA
AttachThreadInput
AppendMenuA
DeleteMenu
DestroyMenu
GetMenu
EnableMenuItem
RemoveMenu
CreatePopupMenu
InsertMenuA
GetSubMenu
EnumDesktopWindows
SetCapture
SetWindowLongA
GetCursorPos
wsprintfA
EndDialog
SendMessageA
GetDlgItem
MessageBoxA
SetDlgItemTextA
GetClientRect
CreateWindowExA
CallWindowProcA
GetSysColor
DrawFocusRect
SetCursor
OemToCharA
GetWindowRect
IsIconic
IsZoomed
InvalidateRgn
SetForegroundWindow
RegisterWindowMessageA
CheckRadioButton
SetFocus
InflateRect
GetSysColorBrush
SetMenuItemBitmaps
DialogBoxIndirectParamA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
DrawTextA
GetSystemMetrics
MoveWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
GetDC
GetMenuCheckMarkDimensions
ReleaseDC
SetWindowTextA
DialogBoxParamA
CheckMenuItem
InvalidateRect
CheckDlgButton
GetDlgItemTextA
IsDlgButtonChecked
LoadIconA
LoadCursorA
RegisterClassExA
CreateDialogParamA
ShowWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetTimer
PostQuitMessage
DefWindowProcA
ReleaseCapture

gdi32

CreateFontIndirectA
GetObjectA
SetBkColor
GetStockObject
SetAbortProc
GetTextExtentPoint32A
ExtTextOutA
DeleteObject
CreateSolidBrush
CreateCompatibleBitmap
SetMapMode
StartDocA
GetDeviceCaps
CreateFontA
GetTextMetricsA
GetTextExtentPointA
StartPage
TextOutA
EndPage
AbortDoc
EndDoc
SetTextColor
SetBkMode
SelectObject
StretchBlt
DeleteDC
CreateCompatibleDC

comdlg32

PrintDlgA
ChooseColorA
FindTextA
ChooseFontA
GetSaveFileNameA

advapi32

RegEnumValueA
RegCloseKey
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
DeleteService
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
ShellExecuteExA

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 554KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/procexp.chm
.chm
SysinternalsSuite-v20081210/procexp.exe
.exe windows:5 windows x86 arch:x86

cdb84e2d0e41ce0f02a5f297077fa863

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:de:89:f0:6e:69:e5:3f:a8:24:92:66:44:4e:7a:3d:bc:2c:f3:a3
Signer

Actual PE Digest

99:de:89:f0:6e:69:e5:3f:a8:24:92:66:44:4e:7a:3d:bc:2c:f3:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getservbyport
htons
ntohs
ntohl
WSAStartup
gethostbyaddr
htonl

mpr

WNetGetConnectionA

comctl32

ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_Destroy
InitCommonControlsEx
CreateToolbarEx
CreatePropertySheetPageA
ord6
ImageList_Create
ord17
PropertySheetA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

GetLocaleInfoA
FormatMessageA
OutputDebugStringA
TerminateProcess
GetProcessWorkingSetSize
DeviceIoControl
GetDriveTypeA
GetCurrentDirectoryA
GetFileTime
GetExitCodeThread
TerminateThread
DuplicateHandle
VirtualFree
VirtualAlloc
GetPriorityClass
GetThreadContext
ResetEvent
MultiByteToWideChar
GlobalAddAtomA
GetSystemInfo
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
SetProcessWorkingSetSize
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
GetConsoleMode
GetConsoleCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
HeapDestroy
HeapCreate
FatalAppExitA
GetStartupInfoA
GetCurrentThreadId
RaiseException
HeapReAlloc
RtlUnwind
CreateThread
ResumeThread
ExitThread
lstrlenW
GlobalReAlloc
GlobalLock
GlobalAlloc
GlobalUnlock
CreateEventA
SetEnvironmentVariableA
FindFirstFileA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
FindClose
SetPriorityClass
GetCurrentProcessId
SetErrorMode
WaitForMultipleObjects
GlobalMemoryStatus
PulseEvent
CreateFileMappingA
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
GetSystemTimeAsFileTime
FreeLibrary
ReadFile
SetFilePointer
OpenProcess
VirtualQueryEx
ReadProcessMemory
GetCommandLineA
DeleteFileA
WaitForSingleObject
GetCurrentThread
SetThreadAffinityMask
Sleep
GetProcessAffinityMask
GetSystemDirectoryA
GetVersion
lstrcpynA
WideCharToMultiByte
GetNumberFormatA
GetFileAttributesA
SearchPathA
ExpandEnvironmentStringsA
CreateProcessA
MulDiv
GetEnvironmentVariableA
lstrcmpiA
lstrcmpA
SetEvent
GetDateFormatA
InterlockedDecrement
GetProcessHeap
HeapAlloc
lstrcpyA
HeapFree
lstrcatA
GetTickCount
InterlockedIncrement
OpenEventA
GetCommandLineW
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
CloseHandle
IsBadStringPtrA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatA
EnterCriticalSection
LeaveCriticalSection
GetLastError
LocalFree
LocalAlloc
GetModuleFileNameA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
CompareStringA
CompareStringW
FreeEnvironmentStringsW
GetUserDefaultLCID

user32

CheckRadioButton
GetKeyState
SetUserObjectSecurity
GetUserObjectSecurity
GetWindow
SendMessageTimeoutA
GetDlgCtrlID
EnumWindows
RegisterWindowMessageA
CreateMenu
RemoveMenu
DrawMenuBar
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
ExitWindowsEx
RedrawWindow
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
IsDialogMessageA
DispatchMessageA
CreateDialogParamA
ReleaseCapture
GetDlgItemTextA
CheckMenuRadioItem
CheckMenuItem
PostQuitMessage
DrawIconEx
LoadMenuA
InsertMenuA
TrackPopupMenu
GetCapture
SetCapture
DrawEdge
DrawFrameControl
BeginDeferWindowPos
EnumChildWindows
MsgWaitForMultipleObjects
UnionRect
GetClassNameA
DeferWindowPos
wsprintfA
IsZoomed
GetMenuCheckMarkDimensions
SetForegroundWindow
GetDesktopWindow
FindWindowExA
IsIconic
GetWindowThreadProcessId
GetWindowDC
SetMenuItemInfoA
SetClassLongA
SetPropA
FillRect
CallWindowProcA
GetWindowTextA
DeleteMenu
EnableWindow
CheckDlgButton
IsDlgButtonChecked
GetWindowPlacement
ModifyMenuA
OffsetRect
CreatePopupMenu
TrackPopupMenuEx
AppendMenuA
GetMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
EnableMenuItem
GetPropA
DestroyIcon
FrameRect
GetDoubleClickTime
ScreenToClient
SystemParametersInfoA
InvalidateRgn
PeekMessageA
ScrollWindowEx
SetScrollInfo
GetScrollInfo
IntersectRect
GetUpdateRgn
GetClassLongA
EndDeferWindowPos
MessageBoxA
SetFocus
SetTimer
GetCursorPos
PtInRect
WindowFromPoint
KillTimer
LoadStringA
LoadIconA
LoadImageA
RegisterClassExA
RegisterClassA
FindWindowA
PostMessageA
SetWindowPlacement
UpdateWindow
DialogBoxIndirectParamA
SetWindowTextA
InflateRect
SendMessageA
DefDlgProcA
DefFrameProcA
DefMDIChildProcA
GetWindowLongA
SetWindowLongA
BeginPaint
EndPaint
ShowWindow
ClientToScreen
GetSystemMetrics
SetWindowPos
DefWindowProcA
GetClientRect
CreateIconIndirect
MapWindowPoints
DestroyWindow
CreateWindowExA
GetParent
IsWindowVisible
GetFocus
DrawTextA
GetDC
ReleaseDC
DialogBoxParamA
EndDialog
GetDlgItem
GetWindowRect
MoveWindow
SetDlgItemTextA
LoadCursorA
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
ShowWindowAsync

gdi32

CreateCompatibleBitmap
LineTo
SaveDC
SetROP2
CreatePen
Rectangle
RestoreDC
SetTextAlign
ExtTextOutA
GetTextExtentPoint32A
MoveToEx
GetTextMetricsA
EndPage
Polyline
GetBkColor
SelectClipRgn
CreateRectRgnIndirect
RectInRegion
CreateRectRgn
Ellipse
SelectObject
SetTextColor
CreateSolidBrush
GetDeviceCaps
SetMapMode
StartDocA
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
EndDoc
SetBkColor
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
StartPage

comdlg32

GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
FindTextA
ChooseFontA
PrintDlgA

advapi32

SetServiceObjectSecurity
LookupAccountNameA
LookupPrivilegeNameA
IsValidSecurityDescriptor
SetKernelObjectSecurity
GetKernelObjectSecurity
OpenSCManagerA
QueryServiceStatus
CloseServiceHandle
StartServiceA
ControlService
CreateProcessAsUserA
RegConnectRegistryA
AllocateAndInitializeSid
SetTokenInformation
GetSecurityInfo
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
LookupPrivilegeValueW
GetTokenInformation
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
LookupAccountSidA
GetLengthSid
CopySid
RegEnumValueA
OpenServiceA
QueryServiceConfigA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
MapGenericMask
QueryServiceObjectSecurity

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
Shell_NotifyIconA
ShellExecuteA
SHGetFileInfoA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
VariantInit
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

Sections

.text
Size: 462KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/procmon.chm
.chm
SysinternalsSuite-v20081210/psexec.exe
.exe windows:4 windows x86 arch:x86

58130d22c48ff9dc2f3446dabcecfe6c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:c6:9d:4b:80:a0:a5:9f:97:8e:64:d6:eb:90:40:3d:f4:1d:c3:49
Signer

Actual PE Digest

5c:c6:9d:4b:80:a0:a5:9f:97:8e:64:d6:eb:90:40:3d:f4:1d:c3:49

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

NetApiBufferFree
NetServerEnum

ws2_32

WSAStartup
gethostname
inet_ntoa
gethostbyname

mpr

WNetAddConnection2W
WNetCancelConnection2W

kernel32

GetCurrentProcess
GetVersion
GetModuleFileNameW
SetEvent
GetFileAttributesW
DisconnectNamedPipe
ReadConsoleW
ReadFile
GetFileTime
WaitNamedPipeW
SetFileAttributesW
CopyFileW
WaitForMultipleObjects
SetConsoleTitleW
DuplicateHandle
GetCurrentProcessId
TransactNamedPipe
MultiByteToWideChar
LoadLibraryExW
CreateEventW
GetExitCodeProcess
ResumeThread
SetProcessAffinityMask
GetCommandLineW
GetEnvironmentVariableW
GetFullPathNameW
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WaitForSingleObject
GetComputerNameW
GetSystemDirectoryW
DeleteFileW
FindResourceW
SizeofResource
LoadResource
SetNamedPipeHandleState
LockResource
FormatMessageA
GetStdHandle
WriteFile
FreeLibrary
CreateFileW
CloseHandle
GetTickCount
Sleep
SetLastError
GetLastError
LocalAlloc
GetModuleHandleW
LocalFree
SetPriorityClass
LoadLibraryW
GetProcAddress
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
SetConsoleCtrlHandler
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
RtlUnwind
CreateFileA
FlushFileBuffers
LoadLibraryA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

user32

LoadCursorW
SetCursor
SetWindowTextW
SendMessageW
EndDialog
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamW
InflateRect

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

GetSecurityInfo
CreateProcessAsUserW
OpenProcessToken
DeleteService
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CreateServiceW
CloseServiceHandle
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
SetTokenInformation
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
LsaOpenPolicy
LsaEnumerateAccountRights
LookupPrivilegeValueW
LsaFreeMemory
LsaClose

Sections

.text
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psfile.exe
.exe windows:4 windows x86 arch:x86

bcaee2d1f3ce48e6df654e8fc92f6e46

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bb:e6:1e:63:56:9a:4b:f9:b0:6a:88:88:03:9b:c2:3e:b9:a2:1f:bd
Signer

Actual PE Digest

bb:e6:1e:63:56:9a:4b:f9:b0:6a:88:88:03:9b:c2:3e:b9:a2:1f:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetFileGetInfo
NetFileEnum
NetFileClose

mpr

WNetAddConnection2W
WNetCancelConnection2W

kernel32

SetLastError
Sleep
GetTickCount
CloseHandle
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExW
GetComputerNameW
GetLastError
GetLocaleInfoA
MultiByteToWideChar
GetCurrentProcess
GetVersion
GetModuleFileNameW
LCMapStringW
LCMapStringA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStrings
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
ReadFile
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetProcAddress
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
RtlUnwind
CreateFileA
FlushFileBuffers
LoadLibraryA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA

user32

SetCursor
LoadCursorW
SendMessageW
SetWindowTextW
EndDialog
GetSysColorBrush
InflateRect
GetDlgItem
DialogBoxIndirectParamW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psgetsid.exe
.exe windows:4 windows x86 arch:x86

982fb74c0dbbf58c5d9f89bd85cec3de

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3c:cd:32:2b:8d:67:75:09:de:d2:6f:ad:39:d6:3c:0a:18:8f:7e:cd
Signer

Actual PE Digest

3c:cd:32:2b:8d:67:75:09:de:d2:6f:ad:39:d6:3c:0a:18:8f:7e:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

netapi32

NetApiBufferFree
NetServerEnum

ws2_32

gethostbyname
gethostname
WSAStartup
inet_ntoa

mpr

WNetCancelConnection2A
WNetAddConnection2A

kernel32

LoadLibraryExA
LockResource
SizeofResource
LoadResource
FindResourceA
DeleteFileA
GetSystemDirectoryA
TerminateThread
WaitForSingleObject
GetCurrentProcess
WideCharToMultiByte
GetModuleFileNameA
FormatMessageA
GetVersion
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetLastError
GetStdHandle
FreeLibrary
CloseHandle
GetTickCount
Sleep
lstrlenA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCommandLineA
GetFullPathNameA
GetComputerNameA
CreateFileA
GetLastError
WriteFile
ReadFile
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapSize
SetEndOfFile
lstrcpyA
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetProcAddress
ExitProcess
ExitThread
GetCurrentThreadId
CreateThread
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
FlushFileBuffers
InitializeCriticalSection
RtlUnwind

user32

GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
GetDlgItem
InflateRect
SendMessageA
DialogBoxIndirectParamA
wsprintfA
SetCursor

gdi32

EndDoc
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage

comdlg32

PrintDlgA

advapi32

LsaOpenPolicy
LsaNtStatusToWinError
LsaQueryInformationPolicy
LsaClose
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
DeleteService
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
LookupAccountSidA
LookupAccountNameA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pskill.exe
.exe windows:4 windows x86 arch:x86

53dea68196821b34a611ca5e381db742

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:10:56:ea:12:7b:e3:15:eb:8c:68:7a:00:ad:0e:8a:c7:36:73:a7
Signer

Actual PE Digest

11:10:56:ea:12:7b:e3:15:eb:8c:68:7a:00:ad:0e:8a:c7:36:73:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ws2_32

gethostbyname
gethostname
WSAStartup
inet_ntoa

mpr

WNetCancelConnection2A
WNetAddConnection2A

kernel32

LocalAlloc
SetLastError
Sleep
GetTickCount
CreateFileA
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExA
LockResource
SizeofResource
LoadResource
FindResourceA
DeleteFileA
GetSystemDirectoryA
GetComputerNameA
TerminateThread
WaitForSingleObject
LoadLibraryA
GetProcAddress
GetVersion
GetModuleFileNameA
ReadFile
GetFullPathNameA
GetCommandLineA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
LocalFree
OpenProcess
GetLastError
TerminateProcess
CloseHandle
GetCurrentProcess
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStrings
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
WideCharToMultiByte
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitProcess
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
RtlUnwind
FlushFileBuffers
InitializeCriticalSection
FreeEnvironmentStringsA

user32

EndDialog
SetWindowTextA
LoadCursorA
SetCursor
GetSysColorBrush
SendMessageA
GetDlgItem
InflateRect
DialogBoxIndirectParamA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

ControlService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pslist.exe
.exe windows:4 windows x86 arch:x86

b341e4693998867a277df3a1616ed62f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

45:d3:92:f6:97:6b:af:5b:0f:7c:f8:c2:ec:ae:52:d1:a6:df:99:3f
Signer

Actual PE Digest

45:d3:92:f6:97:6b:af:5b:0f:7c:f8:c2:ec:ae:52:d1:a6:df:99:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetCancelConnection2A
WNetAddConnection2A

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

Sleep
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
SetConsoleCursorPosition
SetConsoleCtrlHandler
SetPriorityClass
GetCurrentProcess
GetComputerNameA
GetLastError
SetLastError
GetTickCount
CloseHandle
CreateFileA
WriteFile
GetStdHandle
GetModuleHandleA
WideCharToMultiByte
GetVersion
GetModuleFileNameA
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
LocalAlloc
LoadLibraryA
LocalFree
SetHandleCount
FlushFileBuffers
IsBadStringPtrA
lstrlenA
HeapSize
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapAlloc
HeapFree
RtlUnwind
GetProcAddress
ExitProcess
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitThread
ResumeThread
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetStringTypeA
GetStringTypeW
InitializeCriticalSection
GetConsoleCP

user32

GetSysColorBrush
EndDialog
SetWindowTextA
GetDlgItem
SetCursor
InflateRect
SendMessageA
DialogBoxIndirectParamA
LoadCursorA
wsprintfA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegConnectRegistryA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psloggedon.exe
.exe windows:4 windows x86 arch:x86

456bdc4a13aad67c3fa6cb5db8244b3b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1b:50:b4:2d:27:71:91:66:7b:f6:53:e9:51:50:f4:f2:7b:f1:7b:e2
Signer

Actual PE Digest

1b:50:b4:2d:27:71:91:66:7b:f6:53:e9:51:50:f4:f2:7b:f1:7b:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

netapi32

NetApiBufferFree
NetSessionEnum
NetServerEnum

kernel32

CloseHandle
WriteFile
GetStdHandle
GetTickCount
FileTimeToSystemTime
GetVersion
GetModuleFileNameW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
Sleep
SetLastError
GetLastError
FileTimeToLocalFileTime
GetLocalTime
MultiByteToWideChar
SystemTimeToFileTime
QueryPerformanceCounter
GetCommandLineW
GetDateFormatW
GetTimeFormatW
FormatMessageW
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapSize
ReadFile
GetCurrentProcess
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetConsoleMode
GetProcAddress
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
CreateFileA
LoadLibraryA
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA

user32

SetWindowTextW
LoadCursorW
SetCursor
EndDialog
SendMessageW
GetSysColorBrush
GetDlgItem
InflateRect
DialogBoxIndirectParamW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

LookupAccountNameW
RegConnectRegistryW
RegEnumKeyExW
AllocateAndInitializeSid
LookupAccountSidW
FreeSid
RegOpenKeyW
RegQueryInfoKeyW
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psloglist.exe
.exe windows:4 windows x86 arch:x86

7adb784d7ce72a46e693142d0e9c3ca6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:f3:a7:a0:1e:da:24:ca:42:3f:9f:d1:08:b8:65:1e:07:1e:69:0f
Signer

Actual PE Digest

78:f3:a7:a0:1e:da:24:ca:42:3f:9f:d1:08:b8:65:1e:07:1e:69:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

netapi32

NetApiBufferFree
NetServerEnum

mpr

WNetAddConnection2A

kernel32

GetComputerNameA
GetVersion
GetModuleHandleA
LoadLibraryA
SetLastError
Sleep
GetTickCount
CloseHandle
CreateFileA
FreeLibrary
WriteFile
GetStdHandle
CreateEventA
FileTimeToSystemTime
WideCharToMultiByte
GetModuleFileNameA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
SystemTimeToFileTime
GetSystemTimeAsFileTime
FindFirstFileA
GetLastError
FindClose
WaitForSingleObject
FreeEnvironmentStringsA
InitializeCriticalSection
GetTimeFormatA
GetDateFormatA
FormatMessageA
LocalAlloc
LocalFree
FileTimeToLocalFileTime
CompareFileTime
LoadLibraryExA
ExpandEnvironmentStringsA
GetSystemDirectoryA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapSize
ReadFile
SetEndOfFile
GetCurrentProcess
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetProcAddress
ExitProcess
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW

user32

EndDialog
SetWindowTextA
LoadCursorA
SetCursor
GetSysColorBrush
SendMessageA
GetDlgItem
InflateRect
DialogBoxIndirectParamA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegCreateKeyA
RegSetValueExA
OpenBackupEventLogA
OpenEventLogA
BackupEventLogA
RegConnectRegistryA
NotifyChangeEventLog
ReadEventLogA
CloseEventLog
LookupAccountSidA
ClearEventLogA
RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pspasswd.exe
.exe windows:4 windows x86 arch:x86

b901a4e8c09cd7a9b7cb7d2daa286ce5

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

53:5c:e0:18:cf:e6:31:cd:87:8e:17:96:b2:29:df:eb:0f:4f:bd:68
Signer

Actual PE Digest

53:5c:e0:18:cf:e6:31:cd:87:8e:17:96:b2:29:df:eb:0f:4f:bd:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetServerEnum
NetUserSetInfo
NetUserGetInfo

mpr

WNetAddConnection2W
WNetCancelConnection2W

kernel32

Sleep
GetTickCount
CloseHandle
CreateFileW
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExW
GetComputerNameW
SetLastError
GetLocaleInfoA
GetVersion
GetModuleFileNameW
GetFullPathNameW
GetCommandLineW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetLastError
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
MultiByteToWideChar
GetCommandLineA
GetEnvironmentStringsW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
ReadFile
GetCurrentProcess
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetProcAddress
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
RtlUnwind
CreateFileA
FlushFileBuffers
LoadLibraryA
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

LoadCursorW
SetCursor
InflateRect
SetWindowTextW
EndDialog
GetSysColorBrush
SendMessageW
DialogBoxIndirectParamW
GetDlgItem

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psservice.exe
.exe windows:4 windows x86 arch:x86

a8dec569cebd0ff9f908f8e3a2b78b36

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:43:7c:c3:15:2f:b3:a1:4e:ae:d4:d7:a5:ee:01:e3:59:66:ee:f0
Signer

Actual PE Digest

44:43:7c:c3:15:2f:b3:a1:4e:ae:d4:d7:a5:ee:01:e3:59:66:ee:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

netapi32

NetServerEnum
NetApiBufferFree

mpr

WNetAddConnection2A
WNetCancelConnection2A

kernel32

GetCurrentProcess
WideCharToMultiByte
GetVersion
GetModuleFileNameA
lstrlenA
GetProcAddress
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetComputerNameA
LoadLibraryExA
FormatMessageA
GetStdHandle
WriteFile
FreeLibrary
CreateFileA
CloseHandle
GetTickCount
Sleep
SetLastError
GetLastError
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitProcess
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
RtlUnwind
FlushFileBuffers
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

SetWindowTextA
LoadCursorA
EndDialog
InflateRect
SendMessageA
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamA
wsprintfA
SetCursor

gdi32

GetDeviceCaps
StartDocA
StartPage
EndPage
EndDoc
SetMapMode

comdlg32

PrintDlgA

advapi32

MapGenericMask
EnumDependentServicesA
ChangeServiceConfigA
QueryServiceConfigA
QueryServiceObjectSecurity
GetSecurityDescriptorDacl
GetAce
LookupAccountSidA
EnumServicesStatusA
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psshutdown.exe
.exe windows:4 windows x86 arch:x86

02069cdeb9ebc09da43e4d2cd0d07e53

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:ec:9b:c0:6a:85:05:30:07:0b:d5:6b:7a:e5:d2:7a:bb:ba:65:e2
Signer

Actual PE Digest

6a:ec:9b:c0:6a:85:05:30:07:0b:d5:6b:7a:e5:d2:7a:bb:ba:65:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

netapi32

NetApiBufferFree
NetServerEnum

ws2_32

gethostbyname
gethostname
WSAStartup
inet_ntoa

mpr

WNetCancelConnection2A
WNetAddConnection2A

kernel32

CreateFileA
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExA
LockResource
SizeofResource
LoadResource
FindResourceA
DeleteFileA
GetSystemDirectoryA
GetComputerNameA
TerminateThread
WaitForSingleObject
GetCurrentProcess
WideCharToMultiByte
CloseHandle
GetModuleHandleA
ReadFile
GetLocalTime
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTickCount
Sleep
SetLastError
GetLastError
LocalAlloc
GetVersion
LocalFree
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
GetProcAddress
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
GetModuleFileNameA
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitProcess
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
RtlUnwind
FlushFileBuffers
InitializeCriticalSection

user32

EndDialog
SetWindowTextA
LoadCursorA
SetCursor
GetSysColorBrush
SendMessageA
ExitWindowsEx
GetDlgItem
DialogBoxIndirectParamA
InflateRect

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

LookupPrivilegeValueA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
AdjustTokenPrivileges
DeleteService
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/pssuspend.exe
.exe windows:4 windows x86 arch:x86

ce3946baee4ca946ca42e16c1c6defea

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:e0:f1:bb:dd:17:25:4d:e9:cb:77:18:c7:f3:b5:b1:5a:f1:49:b7
Signer

Actual PE Digest

6a:e0:f1:bb:dd:17:25:4d:e9:cb:77:18:c7:f3:b5:b1:5a:f1:49:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
inet_ntoa
WSAStartup
gethostname

mpr

WNetAddConnection2A
WNetCancelConnection2A

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

LoadLibraryA
LocalAlloc
SetLastError
GetTickCount
CreateFileA
FreeLibrary
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryExA
LockResource
SizeofResource
LoadResource
FindResourceA
DeleteFileA
GetSystemDirectoryA
GetComputerNameA
TerminateThread
LocalFree
GetCurrentProcess
GetProcAddress
GetModuleFileNameA
ReadFile
GetFullPathNameA
GetCommandLineA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
Sleep
OpenProcess
GetLastError
GetVersion
CloseHandle
WaitForSingleObject
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStrings
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
WideCharToMultiByte
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
ExitProcess
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
RtlUnwind
FlushFileBuffers
InitializeCriticalSection
FreeEnvironmentStringsA

user32

EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamA
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/psversion.txt
SysinternalsSuite-v20081210/regjump.exe
.exe windows:4 windows x86 arch:x86

2d50cddb751176a0626607a64334a6c0

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ff:a0:a3:77:18:14:36:28:1f:4e:63:83:56:13:d0:dd:70:58:b7:f1
Signer

Actual PE Digest

ff:a0:a3:77:18:14:36:28:1f:4e:63:83:56:13:d0:dd:70:58:b7:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExA

kernel32

FlushFileBuffers
SetFilePointer
GetLastError
GetStringTypeW
GetStringTypeA
WriteFile
GetCPInfo
LoadLibraryA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
RtlUnwind
LocalAlloc
HeapReAlloc
VirtualAlloc
LocalFree
OpenProcess
Sleep
SetStdHandle
GetEnvironmentStringsW
CloseHandle
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree

user32

LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
DialogBoxIndirectParamA
EnumDisplaySettingsA
FindWindowA
WaitForInputIdle
GetWindowThreadProcessId
ShowWindow
SetForegroundWindow
FindWindowExA
SetFocus
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegOpenKeyA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/sdelete.exe
.exe windows:4 windows x86 arch:x86

f8dd17cd22c15cf622ea86852c467c6b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3f:8d:e9:a2:1b:20:47:da:a7:65:64:4b:ab:8d:fe:a6:4b:91:09:38
Signer

Actual PE Digest

3f:8d:e9:a2:1b:20:47:da:a7:65:64:4b:ab:8d:fe:a6:4b:91:09:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceA
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
DeviceIoControl
ExpandEnvironmentStringsA
GetProcAddress
GetModuleHandleA
GetVersion
GetCurrentDirectoryA
GetFullPathNameA
WaitForSingleObject
WriteFile
CompareStringW
CompareStringA
SetStdHandle
GetStringTypeW
GetStringTypeA
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
CreateFileA
GetLastError
CloseHandle
DeleteFileA
VirtualAlloc
LoadLibraryA
SetFilePointer
SetEnvironmentVariableA
GetModuleFileNameA
VirtualFree
MoveFileA
FormatMessageA
LocalAlloc
LocalFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
HeapReAlloc
UnhandledExceptionFilter

user32

GetSysColorBrush
LoadCursorA
SetCursor
InflateRect
GetDlgItem
SendMessageA
EndDialog
SetWindowTextA
DialogBoxIndirectParamA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/sigcheck.exe
.exe windows:5 windows x86 arch:x86

93354f8d753dc370fd61278026ff9ca6

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:c5:38:b5:36:d0:02:08:ca:1b:5a:22:b6:40:7d:48:8a:c8:7f:29
Signer

Actual PE Digest

83:c5:38:b5:36:d0:02:08:ca:1b:5a:22:b6:40:7d:48:8a:c8:7f:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

imagehlp

ImageNtHeader

kernel32

LockResource
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
CreateFileW
ReadFile
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
SizeofResource
InterlockedDecrement
FormatMessageW
GetCurrentDirectoryW
GetLastError
GetFullPathNameW
MultiByteToWideChar
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
IsValidLocale
EnumSystemLocalesA
FreeResource
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetCurrentProcess
GetTimeFormatW
GetCommandLineW
GetProcAddress
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProcessHeap
lstrlenW
GetModuleFileNameW
EnterCriticalSection
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
HeapAlloc
HeapFree
GetModuleHandleA
LeaveCriticalSection
RtlUnwind
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
SetFilePointer
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

SetWindowTextW
SetCursor
InflateRect
SendMessageW
EndDialog
GetSysColorBrush
GetDlgItem
DialogBoxIndirectParamW
LoadCursorW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
CryptAcquireContextW

oleaut32

SysFreeString
SysAllocString
VariantChangeType
VariantClear
VariantInit
SetErrorInfo
CreateErrorInfo
GetErrorInfo

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/streams.exe
.exe windows:4 windows x86 arch:x86

e068200622901cf23a22e2b77cfb548c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6c:d3:cc:fd:d1:aa:0e:8c:59:58:04:20:58:80:09:5b:b8:ed:45:c5
Signer

Actual PE Digest

6c:d3:cc:fd:d1:aa:0e:8c:59:58:04:20:58:80:09:5b:b8:ed:45:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
HeapSize
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcAddress
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
CreateFileW
FindClose
CloseHandle
DeleteFileW
GetCurrentProcess
GetLastError
FormatMessageW
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
ExitProcess
GetVersionExA
GetProcessHeap
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
Sleep
LoadLibraryA
InitializeCriticalSection
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

DialogBoxIndirectParamW
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
LoadCursorW
SetCursor
InflateRect
SendMessageW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
OpenProcessToken

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/strings.exe
.exe windows:4 windows x86 arch:x86

d783b1847bae510ea6fb6aa8499f283c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

df:59:89:a8:fe:36:41:a1:a2:a0:ff:39:ab:af:46:a0:f4:8f:ad:8a
Signer

Actual PE Digest

df:59:89:a8:fe:36:41:a1:a2:a0:ff:39:ab:af:46:a0:f4:8f:ad:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
GetCurrentDirectoryA
GetFullPathNameA
FindNextFileA
HeapSize
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FindClose
CreateFileA
GetLastError
ReadFile
SetFilePointer
GetProcAddress
CloseHandle
FormatMessageA
GetCurrentProcess
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetVersionExA
GetProcessHeap
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
InitializeCriticalSection
RtlUnwind

user32

DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/sync.exe
.exe windows:4 windows x86 arch:x86

9003944e49ef2848ccf4a2bfcade2941

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

53:eb:7e:4b:20:50:0b:a1:bc:54:b9:ed:e5:10:fa:f1:70:60:50:45
Signer

Actual PE Digest

53:eb:7e:4b:20:50:0b:a1:bc:54:b9:ed:e5:10:fa:f1:70:60:50:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
LoadLibraryA
LocalAlloc
GetModuleHandleA
GetStringTypeA
LCMapStringW
SetErrorMode
MultiByteToWideChar
Sleep
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
SetStdHandle
RtlUnwind
GetLogicalDrives
GetDriveTypeA
CreateFileA
FlushFileBuffers
CloseHandle
LCMapStringA
GetLastError
GetEnvironmentStringsW
GetEnvironmentStrings
GetFileAttributesA
DeviceIoControl
LocalFree
FormatMessageA
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetStringTypeW

user32

wsprintfA
LoadCursorA
SetCursor
InflateRect
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
SendMessageA
DialogBoxIndirectParamA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/tcpvcon.exe
.exe windows:4 windows x86 arch:x86

11eff32a7b19ad6475a53bce251dd53d

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:f9:cc:7e:62:29:c7:46:f4:dd:78:5f:3d:58:3c:51:47:bd:87:5e
Signer

Actual PE Digest

6e:f9:cc:7e:62:29:c7:46:f4:dd:78:5f:3d:58:3c:51:47:bd:87:5e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

htonl
getservbyport
gethostbyaddr
gethostname
WSAStartup
htons

iphlpapi

GetTcpTable
GetUdpTable

kernel32

DeviceIoControl
OpenProcess
GetModuleFileNameA
ReadProcessMemory
DuplicateHandle
CreateEventA
GetVersion
GetCurrentProcessId
DeleteFileA
EnterCriticalSection
GetUserDefaultLangID
TerminateProcess
HeapFree
InitializeCriticalSection
GetTickCount
GetProcessHeap
LeaveCriticalSection
HeapAlloc
WriteConsoleA
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapSize
Sleep
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetStdHandle
GetSystemDirectoryA
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RtlUnwind
GetConsoleMode
GetConsoleCP
GetConsoleOutputCP
WideCharToMultiByte
WriteFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVersionExA
GetCommandLineA
HeapReAlloc
GetLocaleInfoA
SetEndOfFile
ReadFile
LoadLibraryA
LocalFree
LocalAlloc
LockResource
CloseHandle
SizeofResource
GetProcAddress
FindResourceA
SetLastError
GetLastError
GetCurrentProcess
CreateFileA
GetModuleHandleA
LoadResource
GetStringTypeW
GetStringTypeA
SetStdHandle
WriteConsoleW
ExitProcess
GetEnvironmentStrings

user32

PostMessageA
MessageBoxA
GetSysColorBrush
SendMessageA
InflateRect
SetWindowTextA
DialogBoxIndirectParamA
LoadCursorA
SetCursor
GetDlgItem
EndDialog

gdi32

StartPage
StartDocA
EndPage
EndDoc
SetMapMode
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
LookupPrivilegeValueA
RegSetValueExA
OpenProcessToken
RegDeleteKeyA
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyA

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/tcpview.chm
.chm
SysinternalsSuite-v20081210/whois.exe
.exe windows:4 windows x86 arch:x86

a5ad285d6992ccb9c3fa95c3126360e1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ce:f7:96:86:cf:61:72:1a:84:28:84:da:43:d2:d5:60:2a:fa:f0:19
Signer

Actual PE Digest

ce:f7:96:86:cf:61:72:1a:84:28:84:da:43:d2:d5:60:2a:fa:f0:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

closesocket
WSAGetLastError
WSAStartup
inet_addr
gethostbyaddr
WSACleanup
gethostbyname
htons
socket
connect
send
recv

kernel32

MultiByteToWideChar
LocalFree
WriteFile
GetStdHandle
FormatMessageA
LoadLibraryA
LocalAlloc
GetModuleHandleA
GetCPInfo
GetStringTypeW
RtlUnwind
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
GetACP
GetOEMCP
GetProcAddress
SetStdHandle
FlushFileBuffers
SetFilePointer
GetStringTypeA
FreeEnvironmentStringsA
GetModuleFileNameA
ReadFile
LCMapStringA
CloseHandle
LCMapStringW
GetLastError
HeapReAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapFree
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter

user32

GetDlgItem
SendMessageA
LoadCursorA
SetCursor
InflateRect
DialogBoxIndirectParamA
GetSysColorBrush
EndDialog
SetWindowTextA

gdi32

SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgA

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SysinternalsSuite-v20081210/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

9d4d88e08c1d255b0605cd7e61edff7c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

db:ac:0b:50:c2:06:95:de:6e:37:01:e9:3a:7c:c8:8a:93:de:7f:c6Signer

Headers

File Characteristics

Imports

netapi32

rpcrt4

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

activeds

wldap32

Sections

.text Size: 264KB - Virtual size: 261KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 32KB - Virtual size: 40KB

.rsrc Size: 44KB - Virtual size: 40KB

d140f11cc65811212afe98adaa36a53a

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

61:14:2c:a7:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

e6:6b:93:35:a4:b0:80:6a:fb:98:bd:67:94:dc:81:9d:e7:2b:78:88Signer

Headers

File Characteristics

Imports

comctl32

ws2_32

rpcrt4

psapi

version

kernel32

user32

gdi32

comdlg32

advapi32

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

db:ac:0b:50:c2:06:95:de:6e:37:01:e9:3a:7c:c8:8a:93:de:7f:c6
Signer

.text
Size: 264KB - Virtual size: 261KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 32KB - Virtual size: 40KB

.rsrc
Size: 44KB - Virtual size: 40KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

e6:6b:93:35:a4:b0:80:6a:fb:98:bd:67:94:dc:81:9d:e7:2b:78:88
Signer

.text
Size: 280KB - Virtual size: 279KB

.rdata
Size: 64KB - Virtual size: 62KB

.data
Size: 84KB - Virtual size: 1.9MB

.rsrc
Size: 584KB - Virtual size: 580KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

bc:e2:6e:0f:15:48:9a:32:45:f6:3b:ef:ad:6d:fc:65:37:59:76:36
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 108KB - Virtual size: 110KB

.rsrc
Size: 12KB - Virtual size: 11KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

f3:81:64:08:47:d9:53:77:0b:c6:6f:6f:a9:7e:88:38:aa:27:1b:e2
Signer

.text
Size: 20KB - Virtual size: 19KB