packages[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

packages.zip
Size

165.4MB
MD5

443f948920ca7defb1928af72c116796
SHA1

53337c67641b9926b60c8c0ea50486bd7a803211
SHA256

4f97da2fc516305f56f12aa1619092a6cea8f0b0797bb889e7abbe72134a750f
SHA512

12bbd5cd2205287587d07fd7b65a5c9f44208543fb789e29ef7c69914b0bf8e4baaa0d58d218c92cd9dd28966535eb8d76215a902c2d8bd7ae5a40a24a34056d
SSDEEP

3145728:T7uZOUn5TSC0+VJkb5pLq6/brZv6akReTUNRsbpJvcadoqMncbxp0LXmCed3LuHr:T7EOUnx6+HkbfWCblv6akITUNCpJvcaU

Score

1^/10

Malware Config

Signatures

Files

packages.zip
.zip
Set-up.exe
.exe windows:5 windows x86 arch:x86

5b3e6afc3f0e1189239b8b04658ee25a

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:af:3f:68:36:ed:fd:d3:a3:41:3f:3a:c7:2b:e8:71:53:a5:d9:9b:3e:6d:d0:c3:d6:a0:92:df:bb:f6:74:61
Signer

Actual PE Digest

07:af:3f:68:36:ed:fd:d3:a3:41:3f:3a:c7:2b:e8:71:53:a5:d9:9b:3e:6d:d0:c3:d6:a0:92:df:bb:f6:74:61

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

shell32

SHGetPathFromIDListW
SHGetMalloc
ord680
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteExW
ord51
ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW

shlwapi

PathStripToRootW
PathFindFileNameW
PathIsRootW
PathRemoveFileSpecW
PathIsUNCW
PathStripPathW
PathRemoveBackslashW
PathRenameExtensionW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathFileExistsA
PathIsFileSpecW
PathRemoveExtensionW
PathIsNetworkPathW
PathAddExtensionW
PathIsRelativeW
UrlIsW

kernel32

GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
LocalFree
CreateProcessW
GetModuleHandleW
FreeLibrary
FindFirstFileW
FindNextFileW
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
FindClose
WaitForSingleObject
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CopyFileW
GetExitCodeProcess
ReadFile
SetLastError
lstrlenW
LocalAlloc
GetFileAttributesW
FormatMessageW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
GetFileSize
lstrcpyW
lstrcmpiW
lstrcmpW
GetDriveTypeW
InitializeCriticalSectionEx
DecodePointer
DeleteCriticalSection
GetFullPathNameW
HeapSize
HeapReAlloc
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetSystemDirectoryW
SetDllDirectoryW
GetStdHandle
AttachConsole
FreeConsole
GetConsoleWindow
CreateMutexW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
CreateFileMappingA
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateSymbolicLinkW
GetUserDefaultUILanguage
CreateEventW
SetEvent
ResetEvent
TryEnterCriticalSection
CreateDirectoryW
GetFileSizeEx
GetLocalTime
CloseHandle
GetDateFormatW
OpenMutexW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
InterlockedDecrement
QueryPerformanceFrequency
CreateThread
SetFilePointerEx
TerminateThread
ResumeThread
GlobalFree
SizeofResource
LockResource
LoadResource
FindResourceW
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLCID
LCMapStringW
DuplicateHandle
ProcessIdToSessionId
FindResourceExW
GetThreadTimes
QueryFullProcessImageNameW
WaitForMultipleObjects
GetUserDefaultLangID
SetNamedPipeHandleState
CreateNamedPipeW
ConnectNamedPipe
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetTimeZoneInformation
InterlockedFlushSList
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThread
WaitForSingleObjectEx
GetStringTypeW
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
GetComputerNameExW
GetVersionExW
CreateFileW
GetTempPathW
DeviceIoControl
GetCurrentProcess
GetModuleHandleExW
ExitProcess
GetACP
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
RtlUnwind
UnregisterWaitEx
WriteConsoleW
GetTimeFormatW
QueryDepthSList
UnlockFile

user32

GetWindowTextLengthW
GetWindowThreadProcessId
GetWindowLongW
wsprintfW
GetMessageW
DefWindowProcW
CallWindowProcW
PostThreadMessageW
EnumWindows
GetShellWindow
AllowSetForegroundWindow
LoadImageW
SystemParametersInfoW
EnableMenuItem
PostMessageW
GetWindow
GetFocus
DestroyWindow
FillRect
LoadIconW
GetSystemMetrics
GetSystemMenu
GetClassLongW
AppendMenuW
CreateWindowExW
ScreenToClient
SetWindowTextW
RegisterClassExW
GetActiveWindow
ShowWindow
IsWindow
InvalidateRgn
DispatchMessageW
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
AttachThreadInput
GetSysColor
GetForegroundWindow
MoveWindow
CreateAcceleratorTableW
SetFocus
BringWindowToTop
TranslateAcceleratorW
TranslateMessage
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
PostQuitMessage
GetClassInfoExW
GetParent
RegisterWindowMessageW
ReleaseCapture
SetForegroundWindow
InvalidateRect
IsIconic
BeginPaint
EndPaint
GetWindowTextW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
SendMessageW
GetDesktopWindow
ReleaseDC
UnregisterClassW
GetAsyncKeyState
SetClassLongW
CharNextW

gdi32

DeleteDC
GetObjectW
GetStockObject
CreateSolidBrush
GetDeviceCaps
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject

advapi32

EqualSid
LookupAccountSidW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
GetUserNameW
DuplicateTokenEx
ConvertSidToStringSidW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
RegSetValueExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateWellKnownSid
GetTokenInformation
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
RegFlushKey
RegOpenKeyExW
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleLockRunning
CLSIDFromString
OleInitialize
CreateStreamOnHGlobal
CLSIDFromProgID
CoTaskMemAlloc
OleUninitialize
CoGetClassObject
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoCreateGuid
OleRun

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
OleCreateFontIndirect
LoadTypeLi
VariantInit
LoadRegTypeLi
SysAllocStringByteLen
VariantChangeType
VariantCopy
SysStringByteLen
DispCallFunc
SysFreeString
GetErrorInfo

bcrypt

BCryptFinishHash
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty

secur32

GetUserNameExW

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

comctl32

InitCommonControlsEx

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/AAM/IPC/IPC.pima
.zip
AdobeIPCBroker.exe
.exe windows:6 windows x86 arch:x86

b78757e60c78fbd8d0549e7a1e0d29a1

Code Sign

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/10/2018, 00:00

Not After

03/11/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Adobe Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ac:7d:c4:d6:78:b5:cd:0d:da:54:a6:bd:90:ba:4d:9e:d0:98:05:62:5d:95:08:08:69:0a:ff:f1:ac:cd:d5:43
Signer

Actual PE Digest

ac:7d:c4:d6:78:b5:cd:0d:da:54:a6:bd:90:ba:4d:9e:d0:98:05:62:5d:95:08:08:69:0a:ff:f1:ac:cd:d5:43

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htonl
getsockopt
ioctlsocket
connect
closesocket
listen
getsockname
bind
WSAGetLastError
WSASetLastError
WSAStartup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
socket
send
select
recv
ntohs
inet_ntoa
inet_addr
htons
__WSAFDIsSet

kernel32

GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
GetLastError
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
FindFirstFileW
FindNextFileW
InitializeCriticalSectionEx
FindClose
RaiseException
DecodePointer
ReleaseMutex
CreateMutexA
Sleep
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetVersionExA
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
CreateMutexW
FreeLibrary
CreateProcessW
GetProcAddress
CloseHandle
LoadLibraryA
MultiByteToWideChar
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
InitializeCriticalSection
GetThreadPriority
HeapSize
HeapFree
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GetOEMCP
IsValidCodePage
FindNextFileA
SwitchToThread
FreeEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
GetCurrentProcessId
ReadFile
WriteFile
ConnectNamedPipe
GetOverlappedResult
OpenProcess
QueryFullProcessImageNameW
GetNamedPipeServerProcessId
GetLocalTime
GetCurrentThread
GetTickCount
GetEnvironmentStringsW
SetStdHandle
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
FlushFileBuffers
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameW
LockFileEx
SetEndOfFile
SetFilePointerEx
UnlockFile
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
SetEvent
ResetEvent
CreateEventW
GetCurrentProcess
SetThreadPriority
HeapReAlloc
VirtualAlloc
VirtualFree
GetModuleHandleExW
LoadLibraryExW
WaitForMultipleObjects
GetNamedPipeInfo
LocalAlloc
LocalReAlloc
LocalFree
FormatMessageW
LCMapStringW
SetFilePointer
RtlCaptureStackBackTrace
TerminateProcess
GlobalAlloc
GlobalFree
GetSystemTimeAsFileTime
WaitForSingleObjectEx
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
QueryPerformanceCounter
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
GetDriveTypeW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetTimeZoneInformation
ExitProcess
GetCommandLineA
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetFullPathNameA
HeapAlloc
FindFirstFileExA

user32

SetWindowLongW
RegisterClassW
CreateWindowExW
SetTimer
KillTimer
TranslateMessage
DispatchMessageW
PostMessageW
PostQuitMessage
DestroyWindow
MsgWaitForMultipleObjectsEx
GetWindowLongW
GetShellWindow
EnumWindows
GetWindowThreadProcessId
DefWindowProcW
PeekMessageW

advapi32

GetUserNameW
RegCloseKey
CreateProcessWithTokenW
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
OleRun
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

shell32

ShellExecuteExW
SHCreateDirectoryExW
CommandLineToArgvW

Sections

.text
Size: 748KB - Virtual size: 747KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/AdobeIPCBrokerCustomHook.exe
.exe windows:6 windows x86 arch:x86

85aa1a3ec9a324deb93be1db280c6b57

Code Sign

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/10/2018, 00:00

Not After

03/11/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Adobe Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:89:c1:a8:6a:c2:59:11:0f:f3:d0:dd:de:2c:9f:61:14:dd:37:fb:38:82:82:1c:83:5d:79:6e:28:bc:74:54
Signer

Actual PE Digest

45:89:c1:a8:6a:c2:59:11:0f:f3:d0:dd:de:2c:9f:61:14:dd:37:fb:38:82:82:1c:83:5d:79:6e:28:bc:74:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendW

kernel32

RaiseException
HeapSize
TerminateProcess
GetTempPathW
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
Process32FirstW
CloseHandle
CreateFileW
ReadConsoleW
WriteConsoleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
SetEndOfFile
GetLastError
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
SetFilePointerEx
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle

user32

FindWindowExW
PostMessageW

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/AAM/IPC/IPC.pimx
packages/AAM/IPC/IPC.sig
.xml
packages/AAM/P7/P7.pima
.zip
AASIapp.exe
.exe windows:5 windows x86 arch:x86

b1373c2093de8e4c1139ac3e07b3bdca

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

81:00:34:36:b5:50:17:84:cb:60:33:ba:8a:31:d0:db:11:b9:94:14:f7:23:71:c0:95:67:d0:b8:d9:c6:89:a2
Signer

Actual PE Digest

81:00:34:36:b5:50:17:84:cb:60:33:ba:8a:31:d0:db:11:b9:94:14:f7:23:71:c0:95:67:d0:b8:d9:c6:89:a2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

GetModuleFileNameW
LeaveCriticalSection
GetTempPathW
CreateFileW
GlobalAlloc
DeleteFileW
CloseHandle
GlobalLock
GlobalUnlock
lstrcmpW
MulDiv
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
ReleaseMutex
LocalFree
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
MultiByteToWideChar
SetFilePointer
InitializeCriticalSection
ReadFile
GetFileSizeEx
GetLocalTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
OpenMutexW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
GetProcAddress
LoadLibraryExA
SizeofResource
HeapFree
GetCommandLineW
WriteFile
SetEndOfFile
WriteConsoleW
SetStdHandle
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
MoveFileExW
LoadLibraryExW
FreeLibrary
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
CreateEventW
GetStringTypeW
SetLastError
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
SetEvent
GetLastError
Sleep
HeapSize
GetCurrentThreadId

user32

PostThreadMessageW
GetDesktopWindow
TranslateMessage
TranslateAcceleratorW
DispatchMessageW
GetActiveWindow
UnregisterClassW
SendMessageW
GetMessageW
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
LoadImageW
wsprintfW
GetWindowLongW
DefWindowProcW
GetSystemMenu
CallWindowProcW
PostMessageW
GetWindow
GetWindowRect
GetFocus
DestroyWindow
GetDC
SetWindowPos
FillRect
CreateWindowExW
ScreenToClient
GetSystemMetrics
SetWindowTextW
RegisterClassExW
ShowWindow
SetClassLongW
IsWindow
InvalidateRgn
RedrawWindow
DestroyIcon
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
AppendMenuW
GetClassLongW
PostQuitMessage
SystemParametersInfoW
GetClassInfoExW
GetParent
RegisterWindowMessageW
ReleaseCapture
SetForegroundWindow
GetWindowTextLengthW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegFlushKey
RegCloseKey
SystemFunction036

ole32

CoReleaseServerProcess
OleUninitialize
CoCreateInstance
OleInitialize
CoRevokeClassObject
CoGetClassObject
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
OleLockRunning
CoAddRefServerProcess

shell32

SHCreateDirectoryExW
ShellExecuteW
CommandLineToArgvW

oleaut32

LoadRegTypeLi
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysAllocString
DispCallFunc
SysStringLen
SysFreeString
VariantClear
SysAllocStringLen

shlwapi

PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathIsFileSpecW
UrlCanonicalizeW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathAddExtensionW

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
BitBlt
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
GetStockObject
CreateSolidBrush

Sections

.text
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AXFB/AX_SLConfig.xml
.xml
AXFB/AX_application.sif
AXFB/FB_SLConfig.xml
.xml
AXFB/FB_application.sif
IMSLib.dll
.dll windows:5 windows x86 arch:x86

6f00077d7fbede619d116b1254159cd1

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:20:c0:1b:6e:bb:56:1d:77:1b:97:2c:14:e4:9b:70:22:f4:b0:63:aa:8e:a4:7d:79:fb:55:26:17:23:dd:c3
Signer

Actual PE Digest

6d:20:c0:1b:6e:bb:56:1d:77:1b:97:2c:14:e4:9b:70:22:f4:b0:63:aa:8e:a4:7d:79:fb:55:26:17:23:dd:c3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

kernel32

WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
GlobalFree
CloseHandle
CreateThread
ResetEvent
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
GetTempPathW
CreateMutexW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
SetFileAttributesW
Sleep
DeleteFileW
RaiseException
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
SystemTimeToFileTime
CreateProcessW
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetSystemTime
FlushFileBuffers
EnumSystemLocalesW
InterlockedIncrement
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
LoadLibraryW
FreeLibrary
GetLocalTime
GetTimeFormatW
GetDateFormatW
QueryPerformanceCounter
SetFilePointer
GetCurrentThreadId
GetFileSizeEx
OpenMutexW
GetFileAttributesExW
CreateSymbolicLinkW
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
IsValidLocale
GetStdHandle
GetACP
GetCurrentDirectoryW
SetStdHandle
GetUserDefaultLCID
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
InterlockedDecrement
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
EncodePointer
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

wsprintfW

advapi32

GetNamedSecurityInfoW
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
SetEntriesInAclW
CreateWellKnownSid
SetNamedSecurityInfoW

shell32

SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoCreateGuid

oleaut32

VariantChangeType
GetErrorInfo
VariantClear
SysStringLen
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
VariantInit

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsFileSpecW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathRenameExtensionW
PathFindFileNameW

Exports

Exports

IMS_EEPLogin
IMS_createRef
IMS_createRefEx
IMS_createRefExWithXMLParams
IMS_createRefForProductVersion
IMS_deregisterClientFromGroup
IMS_fetchAccessToken
IMS_fetchAccessToken2
IMS_fetchAccounts
IMS_fetchContinueToken
IMS_fetchDefaultUserInfoForClientId
IMS_fetchFeatureFlags
IMS_fetchIDPResponseForKey
IMS_fetchReleaseFlag
IMS_fetchUserProfileData
IMS_getDeviceID
IMS_getProxyCredentialsFromIMSLibSession
IMS_logOutUserForClient
IMS_registerClientToGroup
IMS_releaseData
IMS_releaseRef
IMS_revokeDeviceToken
IMS_setProxyCredentials
IMS_setProxyCredentialsInIMSLibSession
IMS_setRetryAfterResponseHandlingData
IMS_setUserAsDefaultForClientId
IMS_storeDeviceTokenAndUserProfile
IMS_storeDeviceTokenAndUserProfileEx

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OBLRes/ar_AE/ConnectionFAQ.html
.html
OBLRes/ar_AE/LicenseFAQ.html
.html
OBLRes/ar_AE/Main.zdct
OBLRes/bg_BG/ConnectionFAQ.html
.html
OBLRes/bg_BG/LicenseFAQ.html
.html
OBLRes/bg_BG/Main.zdct
OBLRes/bg_BG/oobe_launcher.zdct
OBLRes/cs_CZ/ConnectionFAQ.html
.html
OBLRes/cs_CZ/LicenseFAQ.html
.html
OBLRes/cs_CZ/Main.zdct
OBLRes/cs_CZ/oobe_launcher.zdct
OBLRes/da_DK/ConnectionFAQ.html
.html
OBLRes/da_DK/LicenseFAQ.html
.html
OBLRes/da_DK/Main.zdct
OBLRes/da_DK/oobe_launcher.zdct
OBLRes/de_DE/ConnectionFAQ.html
.html
OBLRes/de_DE/LicenseFAQ.html
.html
OBLRes/de_DE/Main.zdct
OBLRes/de_DE/oobe_launcher.zdct
OBLRes/el_GR/ConnectionFAQ.html
.html
OBLRes/el_GR/LicenseFAQ.html
.html
OBLRes/el_GR/Main.zdct
OBLRes/en_AE/ConnectionFAQ.html
.html
OBLRes/en_AE/LicenseFAQ.html
.html
OBLRes/en_AE/Main.zdct
OBLRes/en_AE/oobe_launcher.zdct
OBLRes/en_GB/ConnectionFAQ.html
.html
OBLRes/en_GB/LicenseFAQ.html
.html
OBLRes/en_GB/Main.zdct
OBLRes/en_GB/oobe_launcher.zdct
OBLRes/en_IL/ConnectionFAQ.html
.html
OBLRes/en_IL/LicenseFAQ.html
.html
OBLRes/en_IL/Main.zdct
OBLRes/en_IL/oobe_launcher.zdct
OBLRes/en_MX/ConnectionFAQ.html
.html
OBLRes/en_MX/LicenseFAQ.html
.html
OBLRes/en_MX/Main.zdct
OBLRes/en_MX/oobe_launcher.zdct
OBLRes/en_US/ConnectionFAQ.html
.html
OBLRes/en_US/LicenseFAQ.html
.html
OBLRes/en_US/Main.zdct
OBLRes/en_US/oobe_launcher.zdct
OBLRes/en_XM/ConnectionFAQ.html
.html
OBLRes/en_XM/LicenseFAQ.html
.html
OBLRes/en_XM/Main.zdct
OBLRes/en_XM/oobe_launcher.zdct
OBLRes/es_ES/ConnectionFAQ.html
.html
OBLRes/es_ES/LicenseFAQ.html
.html
OBLRes/es_ES/Main.zdct
OBLRes/es_ES/oobe_launcher.zdct
OBLRes/es_LA/oobe_launcher.zdct
OBLRes/es_MX/ConnectionFAQ.html
.html
OBLRes/es_MX/LicenseFAQ.html
.html
OBLRes/es_MX/Main.zdct
OBLRes/es_MX/oobe_launcher.zdct
OBLRes/es_NA/oobe_launcher.zdct
OBLRes/et_EE/ConnectionFAQ.html
.html
OBLRes/et_EE/LicenseFAQ.html
.html
OBLRes/et_EE/Main.zdct
OBLRes/et_EE/oobe_launcher.zdct
OBLRes/fi_FI/ConnectionFAQ.html
.html
OBLRes/fi_FI/LicenseFAQ.html
.html
OBLRes/fi_FI/Main.zdct
OBLRes/fi_FI/oobe_launcher.zdct
OBLRes/fr_CA/ConnectionFAQ.html
.html
OBLRes/fr_CA/LicenseFAQ.html
.html
OBLRes/fr_CA/Main.zdct
OBLRes/fr_CA/oobe_launcher.zdct
OBLRes/fr_FR/ConnectionFAQ.html
.html
OBLRes/fr_FR/LicenseFAQ.html
.html
OBLRes/fr_FR/Main.zdct
OBLRes/fr_FR/oobe_launcher.zdct
OBLRes/fr_MA/ConnectionFAQ.html
.html
OBLRes/fr_MA/LicenseFAQ.html
.html
OBLRes/fr_MA/Main.zdct
OBLRes/fr_MA/oobe_launcher.zdct
OBLRes/fr_MX/ConnectionFAQ.html
.html
OBLRes/fr_MX/LicenseFAQ.html
.html
OBLRes/fr_MX/Main.zdct
OBLRes/fr_MX/oobe_launcher.zdct
OBLRes/fr_XM/ConnectionFAQ.html
.html
OBLRes/fr_XM/LicenseFAQ.html
.html
OBLRes/fr_XM/Main.zdct
OBLRes/fr_XM/oobe_launcher.zdct
OBLRes/he_IL/ConnectionFAQ.html
.html
OBLRes/he_IL/LicenseFAQ.html
.html
OBLRes/he_IL/Main.zdct
OBLRes/hr_HR/ConnectionFAQ.html
.html
OBLRes/hr_HR/LicenseFAQ.html
.html
OBLRes/hr_HR/Main.zdct
OBLRes/hr_HR/oobe_launcher.zdct
OBLRes/hu_HU/ConnectionFAQ.html
.html
OBLRes/hu_HU/LicenseFAQ.html
.html
OBLRes/hu_HU/Main.zdct
OBLRes/hu_HU/oobe_launcher.zdct
OBLRes/it_IT/ConnectionFAQ.html
.html
OBLRes/it_IT/LicenseFAQ.html
.html
OBLRes/it_IT/Main.zdct
OBLRes/it_IT/oobe_launcher.zdct
OBLRes/ja_JP/ConnectionFAQ.html
.html
OBLRes/ja_JP/LicenseFAQ.html
.html
OBLRes/ja_JP/Main.zdct
OBLRes/ja_JP/oobe_launcher.zdct
OBLRes/ko_KR/ConnectionFAQ.html
.html
OBLRes/ko_KR/LicenseFAQ.html
.html
OBLRes/ko_KR/Main.zdct
OBLRes/ko_KR/oobe_launcher.zdct
OBLRes/lt_LT/ConnectionFAQ.html
.html
OBLRes/lt_LT/LicenseFAQ.html
.html
OBLRes/lt_LT/Main.zdct
OBLRes/lt_LT/oobe_launcher.zdct
OBLRes/lv_LV/ConnectionFAQ.html
.html
OBLRes/lv_LV/LicenseFAQ.html
.html
OBLRes/lv_LV/Main.zdct
OBLRes/lv_LV/oobe_launcher.zdct
OBLRes/nb_NO/ConnectionFAQ.html
.html
OBLRes/nb_NO/LicenseFAQ.html
.html
OBLRes/nb_NO/Main.zdct
OBLRes/nb_NO/oobe_launcher.zdct
OBLRes/nl_NL/ConnectionFAQ.html
.html
OBLRes/nl_NL/LicenseFAQ.html
.html
OBLRes/nl_NL/Main.zdct
OBLRes/nl_NL/oobe_launcher.zdct
OBLRes/pl_PL/ConnectionFAQ.html
.html
OBLRes/pl_PL/LicenseFAQ.html
.html
OBLRes/pl_PL/Main.zdct
OBLRes/pl_PL/oobe_launcher.zdct
OBLRes/pt_BR/ConnectionFAQ.html
.html
OBLRes/pt_BR/LicenseFAQ.html
.html
OBLRes/pt_BR/Main.zdct
OBLRes/pt_BR/oobe_launcher.zdct
OBLRes/ro_RO/ConnectionFAQ.html
.html
OBLRes/ro_RO/LicenseFAQ.html
.html
OBLRes/ro_RO/Main.zdct
OBLRes/ro_RO/oobe_launcher.zdct
OBLRes/ru_RU/ConnectionFAQ.html
.html
OBLRes/ru_RU/LicenseFAQ.html
.html
OBLRes/ru_RU/Main.zdct
OBLRes/ru_RU/oobe_launcher.zdct
OBLRes/sk_SK/ConnectionFAQ.html
.html
OBLRes/sk_SK/LicenseFAQ.html
.html
OBLRes/sk_SK/Main.zdct
OBLRes/sk_SK/oobe_launcher.zdct
OBLRes/sl_SI/ConnectionFAQ.html
.html
OBLRes/sl_SI/LicenseFAQ.html
.html
OBLRes/sl_SI/Main.zdct
OBLRes/sl_SI/oobe_launcher.zdct
OBLRes/sv_SE/ConnectionFAQ.html
.html
OBLRes/sv_SE/LicenseFAQ.html
.html
OBLRes/sv_SE/Main.zdct
OBLRes/sv_SE/oobe_launcher.zdct
OBLRes/tr_TR/ConnectionFAQ.html
.html
OBLRes/tr_TR/LicenseFAQ.html
.html
OBLRes/tr_TR/Main.zdct
OBLRes/tr_TR/oobe_launcher.zdct
OBLRes/uk_UA/ConnectionFAQ.html
.html
OBLRes/uk_UA/LicenseFAQ.html
.html
OBLRes/uk_UA/Main.zdct
OBLRes/uk_UA/oobe_launcher.zdct
OBLRes/zh_CN/ConnectionFAQ.html
OBLRes/zh_CN/LicenseFAQ.html
OBLRes/zh_CN/Main.zdct
OBLRes/zh_CN/oobe_launcher.zdct
OBLRes/zh_TW/ConnectionFAQ.html
.html
OBLRes/zh_TW/LicenseFAQ.html
.html
OBLRes/zh_TW/Main.zdct
OBLRes/zh_TW/oobe_launcher.zdct
P7Flex.swf
P7Native.dll
.dll windows:5 windows x86 arch:x86

9c0ecca127707bbb9f6d8d44c0861f45

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:c3:23:53:bf:8d:05:2a:4a:57:5d:6a:70:fe:74:89:d1:ce:14:92:c0:29:9f:c7:09:dc:85:00:ce:8a:8c:44
Signer

Actual PE Digest

6b:c3:23:53:bf:8d:05:2a:4a:57:5d:6a:70:fe:74:89:d1:ce:14:92:c0:29:9f:c7:09:dc:85:00:ce:8a:8c:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW

kernel32

InitializeCriticalSectionAndSpinCount
InterlockedDecrement
GetLastError
FindClose
GetSystemInfo
FindFirstFileW
FindNextFileW
GetVersionExW
DecodePointer
GetProcAddress
LocalAlloc
LocalFree
GetCurrentProcess
TerminateProcess
RaiseException
SetLastError
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
Sleep
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
CloseHandle
GetSystemTime
SystemTimeToFileTime
CreateMutexW
CreateEventW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetTempPathW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GetCurrentProcessId
ReleaseSemaphore
CreateSemaphoreW
CreateDirectoryW
FreeLibrary
LoadLibraryW
FindFirstFileExA
ConnectNamedPipe
SetDllDirectoryW
CreateNamedPipeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
HeapReAlloc
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
InterlockedCompareExchange
GetFileSizeEx
lstrlenW
GetACP
CreateSymbolicLinkW
GetCurrentThreadId
GetLocalTime
CompareStringW
GetDateFormatW
OpenMutexW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
TlsFree
TlsSetValue
TlsGetValue
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
TlsAlloc
GetStringTypeW
CreateThread
GetTimeFormatW
GetStdHandle
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCurrentDirectoryW
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer

user32

wsprintfW

advapi32

RegOpenKeyExW
RegQueryValueExW
SystemFunction036
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
GetUserNameW
RegCloseKey

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW

ole32

CoInitializeEx
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
OleRun
CoInitialize

oleaut32

SysAllocStringByteLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantClear
GetErrorInfo

shlwapi

PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
PathIsFileSpecW
PathRemoveFileSpecW
PathStripPathW
PathAppendW
PathRemoveBackslashW
PathRemoveExtensionW
PathAddExtensionW
PathRenameExtensionW
StrToIntExA

Exports

Exports

finalizeApplet
freeMemory
initializeApplet
processMessage

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RNResources/Dictionary/cs_CZ/stringTable.zdct
RNResources/Dictionary/da_DK/stringTable.zdct
RNResources/Dictionary/de_DE/stringTable.zdct
RNResources/Dictionary/en_AE/stringTable.zdct
RNResources/Dictionary/en_GB/stringTable.zdct
RNResources/Dictionary/en_IL/stringTable.zdct
RNResources/Dictionary/en_US/stringTable.zdct
RNResources/Dictionary/es_ES/stringTable.zdct
RNResources/Dictionary/es_LA/stringTable.zdct
RNResources/Dictionary/es_MX/stringTable.zdct
RNResources/Dictionary/es_NA/stringTable.zdct
RNResources/Dictionary/fi_FI/stringTable.zdct
RNResources/Dictionary/fr_CA/stringTable.zdct
RNResources/Dictionary/fr_FR/stringTable.zdct
RNResources/Dictionary/fr_MA/stringTable.zdct
RNResources/Dictionary/fr_XM/stringTable.zdct
RNResources/Dictionary/hr_HR/stringTable.zdct
RNResources/Dictionary/hu_HU/stringTable.zdct
RNResources/Dictionary/it_IT/stringTable.zdct
RNResources/Dictionary/ja_JP/stringTable.zdct
RNResources/Dictionary/ko_KR/stringTable.zdct
RNResources/Dictionary/nb_NO/stringTable.zdct
RNResources/Dictionary/nl_NL/stringTable.zdct
RNResources/Dictionary/pl_PL/stringTable.zdct
RNResources/Dictionary/pt_BR/stringTable.zdct
RNResources/Dictionary/ro_RO/stringTable.zdct
RNResources/Dictionary/ru_RU/stringTable.zdct
RNResources/Dictionary/sk_SK/stringTable.zdct
RNResources/Dictionary/sl_SI/stringTable.zdct
RNResources/Dictionary/sv_SE/stringTable.zdct
RNResources/Dictionary/tr_TR/stringTable.zdct
RNResources/Dictionary/uk_UA/stringTable.zdct
RNResources/Dictionary/zh_CN/stringTable.zdct
RNResources/Dictionary/zh_TW/stringTable.zdct
VulcanBridge.dll
.dll windows:5 windows x86 arch:x86

8519b81977bab0195cdf68f117913b59

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:8f:87:a5:9d:95:6d:1e:46:91:3c:cc:23:80:5a:d5:be:32:7e:d3:51:bc:ed:31:33:52:85:46:53:37:5c:18
Signer

Actual PE Digest

4c:8f:87:a5:9d:95:6d:1e:46:91:3c:cc:23:80:5a:d5:be:32:7e:d3:51:bc:ed:31:33:52:85:46:53:37:5c:18

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

vulcanmessage4

?Create@IVulcanMessageDispatcher@api@vulcan@adobe@@SAPAV1234@PBDPAVIVulcanMessageListener@234@1@Z
?TYPE_PREFIX@SuiteMessage@api@vulcan@adobe@@2QBDB
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBD@Z
??1SuiteMessage@api@vulcan@adobe@@UAE@XZ
??0SuiteMessage@api@vulcan@adobe@@QAE@PBD@Z

vulcanmessage5

?TYPE_PREFIX@SuiteMessage@api5@vulcan@adobe@@2QBDB
?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PBD0@Z
?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAV1234@@Z
?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBD@Z
?SetSource@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
??1SuiteMessage@api5@vulcan@adobe@@UAE@XZ
??0SuiteMessage@api5@vulcan@adobe@@QAE@PBD@Z
??1EndPoint@api5@vulcan@adobe@@UAE@XZ

kernel32

SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
ReleaseMutex
Sleep
GetLastError
CloseHandle
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
FlushFileBuffers
GetTempPathW
MultiByteToWideChar
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSizeEx
GetLocalTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
OpenMutexW
GetOEMCP
IsValidCodePage
GetConsoleCP
SetFilePointerEx
HeapSize
SetEndOfFile
WriteConsoleW
InitializeCriticalSectionAndSpinCount
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
ReadConsoleW
GetConsoleMode
SetStdHandle
GetFullPathNameW
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExW
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW

user32

wsprintfW

advapi32

SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExW

shlwapi

PathIsDirectoryW
PathAppendW
PathIsFileSpecW
PathRenameExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathAddExtensionW

Exports

Exports

broadcastVulcanEvent
broadcastVulcanEventForLicenseRefresh
broadcastVulcanEventForSignout

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VulcanMessage4.dll
.dll windows:5 windows x86 arch:x86

fc5b54b3753cd053154301e29bc8b0a6

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7c:4b:a8:38:2b:fe:ee:56:63:97:ff:03:93:bd:9f:ee:b3:98:80:33:75:43:aa:50:07:62:ed:fa:68:b9:88:d1
Signer

Actual PE Digest

7c:4b:a8:38:2b:fe:ee:56:63:97:ff:03:93:bd:9f:ee:b3:98:80:33:75:43:aa:50:07:62:ed:fa:68:b9:88:d1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
WideCharToMultiByte
LoadLibraryW
GetProcAddress
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
ExitProcess
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetFullPathNameW
CloseHandle
GetFileInformationByHandle
PeekNamedPipe
GetFileType
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
CompareStringW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile
GetTimeZoneInformation
GetFullPathNameA
WriteConsoleW
SetEnvironmentVariableA

Exports

Exports

??0EndPoint@api@vulcan@adobe@@QAE@ABV0123@@Z
??0EndPoint@api@vulcan@adobe@@QAE@XZ
??0ErrorMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0ErrorMessage@api@vulcan@adobe@@QAE@XZ
??0GetAppPathMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0GetAppPathMessage@api@vulcan@adobe@@QAE@XZ
??0GetTargetSpecifiersMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0GetTargetSpecifiersMessage@api@vulcan@adobe@@QAE@XZ
??0HostMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0HostMessage@api@vulcan@adobe@@QAE@PBD@Z
??0IVulcanMessageDispatcher@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageDispatcher@api@vulcan@adobe@@QAE@XZ
??0IVulcanMessageListener@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageListener@api@vulcan@adobe@@QAE@XZ
??0IsAppInstalledMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IsAppInstalledMessage@api@vulcan@adobe@@QAE@XZ
??0IsAppRunningMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IsAppRunningMessage@api@vulcan@adobe@@QAE@XZ
??0LaunchAppMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0LaunchAppMessage@api@vulcan@adobe@@QAE@XZ
??0SuiteMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0SuiteMessage@api@vulcan@adobe@@QAE@PBD@Z
??0VulcanMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0VulcanMessage@api@vulcan@adobe@@QAE@XZ
??1EndPoint@api@vulcan@adobe@@UAE@XZ
??1ErrorMessage@api@vulcan@adobe@@UAE@XZ
??1GetAppPathMessage@api@vulcan@adobe@@UAE@XZ
??1GetTargetSpecifiersMessage@api@vulcan@adobe@@UAE@XZ
??1HostMessage@api@vulcan@adobe@@UAE@XZ
??1IVulcanMessageDispatcher@api@vulcan@adobe@@UAE@XZ
??1IsAppInstalledMessage@api@vulcan@adobe@@UAE@XZ
??1IsAppRunningMessage@api@vulcan@adobe@@UAE@XZ
??1LaunchAppMessage@api@vulcan@adobe@@UAE@XZ
??1SuiteMessage@api@vulcan@adobe@@UAE@XZ
??1VulcanMessage@api@vulcan@adobe@@UAE@XZ
??4EndPoint@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4ErrorMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetAppPathMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetTargetSpecifiersMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4HostMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageDispatcher@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageListener@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IsAppInstalledMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IsAppRunningMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4LaunchAppMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4MessageUtil@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4SuiteMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4VulcanMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??8EndPoint@api@vulcan@adobe@@QBE_NABV0123@@Z
??9EndPoint@api@vulcan@adobe@@QBE_NABV0123@@Z
??_7EndPoint@api@vulcan@adobe@@6B@
??_7ErrorMessage@api@vulcan@adobe@@6B@
??_7GetAppPathMessage@api@vulcan@adobe@@6B@
??_7GetTargetSpecifiersMessage@api@vulcan@adobe@@6B@
??_7HostMessage@api@vulcan@adobe@@6B@
??_7IVulcanMessageDispatcher@api@vulcan@adobe@@6B@
??_7IVulcanMessageListener@api@vulcan@adobe@@6B@
??_7IsAppInstalledMessage@api@vulcan@adobe@@6B@
??_7IsAppRunningMessage@api@vulcan@adobe@@6B@
??_7LaunchAppMessage@api@vulcan@adobe@@6B@
??_7SuiteMessage@api@vulcan@adobe@@6B@
??_7VulcanMessage@api@vulcan@adobe@@6B@
?APP_NOT_INSTALLED_ERROR@ErrorMessage@api@vulcan@adobe@@2QBDB
?Clone@ErrorMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetAppPathMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@HostMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@IsAppInstalledMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@IsAppRunningMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@LaunchAppMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@SuiteMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Create@EndPoint@api@vulcan@adobe@@SA?AV1234@PBD@Z
?Create@IVulcanMessageDispatcher@api@vulcan@adobe@@SAPAV1234@PBDPAVIVulcanMessageListener@234@1@Z
?CreateMessage@MessageUtil@api@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?CreateMessageByType@MessageUtil@api@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?DESTINATION_UNREACHABLE_ERROR@ErrorMessage@api@vulcan@adobe@@2QBDB
?GetAppId@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?GetAppId@VulcanMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetAppIdSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetAppIdSize@VulcanMessage@api@vulcan@adobe@@QBEIXZ
?GetCmdLine@LaunchAppMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetCmdLineSize@LaunchAppMessage@api@vulcan@adobe@@QBEIXZ
?GetData@ErrorMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@GetAppPathMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@HostMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@IsAppInstalledMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@IsAppRunningMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@LaunchAppMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@SuiteMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetDataSize@ErrorMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@GetAppPathMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@HostMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@IsAppInstalledMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@IsAppRunningMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@LaunchAppMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@SuiteMessage@api@vulcan@adobe@@UBEIXZ
?GetDestinationCount@SuiteMessage@api@vulcan@adobe@@QBEIXZ
?GetDestinations@SuiteMessage@api@vulcan@adobe@@QBEXPAVEndPoint@234@@Z
?GetError@ErrorMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetErrorSize@ErrorMessage@api@vulcan@adobe@@QBEIXZ
?GetFault@ErrorMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetFaultSize@ErrorMessage@api@vulcan@adobe@@QBEIXZ
?GetFocus@LaunchAppMessage@api@vulcan@adobe@@QBE_NXZ
?GetId@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?GetIdSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetPayload@HostMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetPayload@SuiteMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetPayloadSize@HostMessage@api@vulcan@adobe@@QBEIXZ
?GetPayloadSize@SuiteMessage@api@vulcan@adobe@@QBEIXZ
?GetResult@GetAppPathMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetResult@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEXIPAD@Z
?GetResult@IsAppInstalledMessage@api@vulcan@adobe@@QBE_NXZ
?GetResult@IsAppRunningMessage@api@vulcan@adobe@@QBE_NXZ
?GetResult@LaunchAppMessage@api@vulcan@adobe@@QBE_NXZ
?GetResultCount@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEIXZ
?GetResultSize@GetAppPathMessage@api@vulcan@adobe@@QBEIXZ
?GetResultSize@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEII@Z
?GetScope@VulcanMessage@api@vulcan@adobe@@QBE?AW4MessageScope@234@XZ
?GetSource@SuiteMessage@api@vulcan@adobe@@QBE?AVEndPoint@234@XZ
?GetTargetSpecifier@GetAppPathMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@IsAppInstalledMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@IsAppRunningMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@LaunchAppMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifierSize@GetAppPathMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@IsAppInstalledMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@IsAppRunningMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@LaunchAppMessage@api@vulcan@adobe@@QBEIXZ
?GetType@VulcanMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTypeSize@VulcanMessage@api@vulcan@adobe@@QBEIXZ
?GetXmlSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetXmlSize@VulcanMessage@api@vulcan@adobe@@UBEIXZ
?INVALID_ENDPOINT@EndPoint@api@vulcan@adobe@@2V1234@B
?IsHostMessage@HostMessage@api@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?IsSuiteMessage@SuiteMessage@api@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?SetAppId@EndPoint@api@vulcan@adobe@@QAEXPBD@Z
?SetAppId@MessageUtil@api@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetCmdLine@LaunchAppMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetData@ErrorMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@GetAppPathMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@GetTargetSpecifiersMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@HostMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@IsAppInstalledMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@IsAppRunningMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@LaunchAppMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@SuiteMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetDestination@SuiteMessage@api@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetDestinations@SuiteMessage@api@vulcan@adobe@@QAEXPBVEndPoint@234@I@Z
?SetFocus@LaunchAppMessage@api@vulcan@adobe@@QAEX_N@Z
?SetId@EndPoint@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@HostMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@HostMessage@api@vulcan@adobe@@QAEXPBDI@Z
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBDI@Z
?SetSource@SuiteMessage@api@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetTargetSpecifier@GetAppPathMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@IsAppInstalledMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@IsAppRunningMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@LaunchAppMessage@api@vulcan@adobe@@QAEXPBD@Z
?TYPE@ErrorMessage@api@vulcan@adobe@@2QBDB
?TYPE@GetAppPathMessage@api@vulcan@adobe@@2QBDB
?TYPE@GetTargetSpecifiersMessage@api@vulcan@adobe@@2QBDB
?TYPE@IsAppInstalledMessage@api@vulcan@adobe@@2QBDB
?TYPE@IsAppRunningMessage@api@vulcan@adobe@@2QBDB
?TYPE@LaunchAppMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@HostMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@SuiteMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@VulcanMessage@api@vulcan@adobe@@2QBDB
?ToXml@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?ToXml@VulcanMessage@api@vulcan@adobe@@UBEXPAD@Z

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VulcanMessage5.dll
.dll windows:6 windows x86 arch:x86

9612e1d064f9d31b91613782c931ed6c

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:87:a0:d8:1a:51:0a:04:65:7c:d9:40:c7:65:83:9c:25:01:68:1a:1c:44:a6:e8:f4:da:af:f5:c2:e6:8e:28
Signer

Actual PE Digest

75:87:a0:d8:1a:51:0a:04:65:7c:d9:40:c7:65:83:9c:25:01:68:1a:1c:44:a6:e8:f4:da:af:f5:c2:e6:8e:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
send
select
recv
listen
htons
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
ntohs
ntohl
htonl

kernel32

FreeEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
GetCurrentProcessId
RtlCaptureStackBackTrace
GetLocalTime
VerSetConditionMask
GetEnvironmentStringsW
GetStdHandle
SetStdHandle
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameW
LockFileEx
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
UnlockFile
WriteFile
GetTempPathW
DuplicateHandle
GetHandleInformation
SetHandleInformation
CreatePipe
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
DeviceIoControl
SetEvent
ResetEvent
ReleaseMutex
OpenMutexW
CreateEventW
SwitchToThread
GetCurrentProcess
GetExitCodeProcess
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
CreateProcessW
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
PulseEvent
WaitForMultipleObjects
GetNamedPipeInfo
CreateMailslotW
SetDllDirectoryW
CopyFileW
MoveFileExW
CreateHardLinkW
GetComputerNameW
VerifyVersionInfoW
RaiseException
Sleep
GetCurrentThread
GetCurrentThreadId
LocalAlloc
LocalReAlloc
LocalFree
FormatMessageW
LCMapStringW
SetFilePointer
GetSystemTimeAsFileTime
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
GetConsoleWindow
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
OpenSemaphoreW
GetLastError
WaitForSingleObject
CreateMutexW
ReleaseSemaphore
GetFullPathNameA
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
SetEnvironmentVariableA
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
HeapSize
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
ReadConsoleW
OpenEventW
ExitProcess
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
WaitForSingleObjectEx
GetModuleHandleW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
GetTickCount
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetDriveTypeW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

user32

GetWindowThreadProcessId
EnumWindows
GetShellWindow

advapi32

SystemFunction036
CreateProcessWithTokenW
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
StartServiceCtrlDispatcherW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExW
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
SHCreateDirectoryExW
SHFileOperationW
CommandLineToArgvW

Exports

Exports

??0EndPoint@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0EndPoint@api5@vulcan@adobe@@QAE@XZ
??0ErrorMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0ErrorMessage@api5@vulcan@adobe@@QAE@XZ
??0GetEndPointsMessage@impl@vulcan@adobe@@QAE@ABV0123@@Z
??0GetEndPointsMessage@impl@vulcan@adobe@@QAE@XZ
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QAE@XZ
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@$$QAV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@XZ
??0SuiteMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0SuiteMessage@api5@vulcan@adobe@@QAE@PBD@Z
??0VulcanMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0VulcanMessage@api5@vulcan@adobe@@QAE@XZ
??1EndPoint@api5@vulcan@adobe@@UAE@XZ
??1ErrorMessage@api5@vulcan@adobe@@UAE@XZ
??1GetEndPointsMessage@impl@vulcan@adobe@@UAE@XZ
??1IVulcanMessageDispatcher@api5@vulcan@adobe@@UAE@XZ
??1SuiteMessage@api5@vulcan@adobe@@UAE@XZ
??1VulcanMessage@api5@vulcan@adobe@@UAE@XZ
??4EndPoint@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4ErrorMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetEndPointsMessage@impl@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageDispatcher@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QAEAAV0123@$$QAV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QAEAAV0123@$$QAV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4SuiteMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4VulcanMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??8EndPoint@api5@vulcan@adobe@@QBE_NABV0123@@Z
??9EndPoint@api5@vulcan@adobe@@QBE_NABV0123@@Z
??_7EndPoint@api5@vulcan@adobe@@6B@
??_7ErrorMessage@api5@vulcan@adobe@@6B@
??_7GetEndPointsMessage@impl@vulcan@adobe@@6B@
??_7IVulcanMessageDispatcher@api5@vulcan@adobe@@6B@
??_7IVulcanMessageListener@api5@vulcan@adobe@@6B@
??_7SuiteMessage@api5@vulcan@adobe@@6B@
??_7VulcanMessage@api5@vulcan@adobe@@6B@
?Clone@ErrorMessage@api5@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetEndPointsMessage@impl@vulcan@adobe@@UBEPAV1234@XZ
?Clone@SuiteMessage@api5@vulcan@adobe@@UBEPAV1234@XZ
?Create@EndPoint@api5@vulcan@adobe@@SA?AV1234@PBD@Z
?CreateMessage@MessageUtil@api5@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?CreateMessageByType@MessageUtil@api5@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?DESTINATION_UNREACHABLE_ERROR@ErrorMessage@api5@vulcan@adobe@@2QBDB
?GetAppId@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppId@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppIdSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetAppIdSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetAppVersion@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppVersion@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppVersionSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetAppVersionSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAD0@Z
?GetData@ErrorMessage@api5@vulcan@adobe@@UBEXPAD@Z
?GetData@GetEndPointsMessage@impl@vulcan@adobe@@UBEXPAD@Z
?GetData@SuiteMessage@api5@vulcan@adobe@@UBEXPAD@Z
?GetDataSize@ErrorMessage@api5@vulcan@adobe@@UBEIXZ
?GetDataSize@GetEndPointsMessage@impl@vulcan@adobe@@UBEIXZ
?GetDataSize@SuiteMessage@api5@vulcan@adobe@@UBEIXZ
?GetDestinationCount@SuiteMessage@api5@vulcan@adobe@@QBEIXZ
?GetDestinations@SuiteMessage@api5@vulcan@adobe@@QBEXPAVEndPoint@234@@Z
?GetError@ErrorMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetErrorSize@ErrorMessage@api5@vulcan@adobe@@QBEIXZ
?GetFault@ErrorMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetFaultSize@ErrorMessage@api5@vulcan@adobe@@QBEIXZ
?GetId@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetIdSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAV1234@@Z
?GetPayload@SuiteMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetPayloadSize@SuiteMessage@api5@vulcan@adobe@@QBEIXZ
?GetResult@GetEndPointsMessage@impl@vulcan@adobe@@QBEXPAVEndPoint@api5@34@@Z
?GetResultCount@GetEndPointsMessage@impl@vulcan@adobe@@QBEIXZ
?GetScope@VulcanMessage@api5@vulcan@adobe@@QBE?AW4MessageScope@234@XZ
?GetSource@SuiteMessage@api5@vulcan@adobe@@QBE?AVEndPoint@234@XZ
?GetSourceEndPoint@GetEndPointsMessage@impl@vulcan@adobe@@QBE?AVEndPoint@api5@34@XZ
?GetType@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetTypeSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetXmlSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetXmlSize@VulcanMessage@api5@vulcan@adobe@@UBEIXZ
?INVALID_ENDPOINT@EndPoint@api5@vulcan@adobe@@2V1234@B
?IsRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QAE_NXZ
?IsSuiteMessage@SuiteMessage@api5@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ
?SetAppId@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetAppId@MessageUtil@api5@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetAppVersion@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetAppVersion@MessageUtil@api5@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PBD0@Z
?SetData@ErrorMessage@api5@vulcan@adobe@@UAEXPBD@Z
?SetData@GetEndPointsMessage@impl@vulcan@adobe@@UAEXPBD@Z
?SetData@SuiteMessage@api5@vulcan@adobe@@UAEXPBD@Z
?SetDestination@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetDestinations@SuiteMessage@api5@vulcan@adobe@@QAEXPBVEndPoint@234@I@Z
?SetId@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBDI@Z
?SetRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QAEXXZ
?SetSource@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?TYPE@ErrorMessage@api5@vulcan@adobe@@2QBDB
?TYPE@GetEndPointsMessage@impl@vulcan@adobe@@2QBDB
?TYPE_PREFIX@SuiteMessage@api5@vulcan@adobe@@2QBDB
?TYPE_PREFIX@VulcanMessage@api5@vulcan@adobe@@2QBDB
?ToXml@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?ToXml@VulcanMessage@api5@vulcan@adobe@@UBEXPAD@Z

Sections

.text
Size: 726KB - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ZStringResources/FontCustomization.xml
.xml
ZStringResources/cs_CZ/stringtable.xml
.xml .vbs polyglot
ZStringResources/da_DK/stringtable.xml
.xml .vbs polyglot
ZStringResources/de_DE/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_AE/stringtable.xml
.xml .vbs
ZStringResources/en_GB/stringtable.xml
.xml .vbs
ZStringResources/en_IL/stringtable.xml
.xml .vbs
ZStringResources/en_US/stringtable.xml
.xml .vbs
ZStringResources/en_XM/stringtable.xml
.xml .vbs
ZStringResources/es_ES/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_LA/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_MX/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_NA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fi_FI/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_CA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_FR/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_MA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_XM/stringtable.xml
.xml .vbs polyglot
ZStringResources/hr_HR/stringtable.xml
.xml .vbs
ZStringResources/hu_HU/stringtable.xml
.xml .vbs polyglot
ZStringResources/it_IT/stringtable.xml
.xml .vbs polyglot
ZStringResources/ja_JP/stringtable.xml
.xml .vbs polyglot
ZStringResources/ko_KR/stringtable.xml
.xml .vbs polyglot
ZStringResources/nb_NO/stringtable.xml
.xml .vbs polyglot
ZStringResources/nl_NL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pl_PL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pt_BR/stringtable.xml
.xml .vbs polyglot
ZStringResources/ro_RO/stringtable.xml
.xml .vbs
ZStringResources/ru_RU/stringtable.xml
.xml .vbs polyglot
ZStringResources/sk_SK/stringtable.xml
.xml .vbs polyglot
ZStringResources/sl_SI/stringtable.xml
.xml .vbs polyglot
ZStringResources/sv_SE/stringtable.xml
.xml .vbs polyglot
ZStringResources/tr_TR/stringtable.xml
.xml .vbs polyglot
ZStringResources/uk_UA/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_CN/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_TW/stringtable.xml
.xml .vbs polyglot
adobe_licensing_helper.exe
.exe windows:6 windows x86 arch:x86

fa302f894e0247a592a9fee2cda7e53e

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

da:ab:09:60:06:e7:33:99:e5:88:fa:93:24:47:18:26:6c:62:53:4f:51:d9:6d:73:2a:d2:4c:69:bc:bd:2d:d4
Signer

Actual PE Digest

da:ab:09:60:06:e7:33:99:e5:88:fa:93:24:47:18:26:6c:62:53:4f:51:d9:6d:73:2a:d2:4c:69:bc:bd:2d:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen

kernel32

FindFirstFileW
FindNextFileW
GetFileSizeEx
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetFullPathNameW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
DeviceIoControl
GetTempPathW
GetVersionExW
GetComputerNameExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
GetModuleHandleW
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
SetFilePointerEx
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
GetFileType
RtlUnwind
GetStringTypeW
EncodePointer
DecodePointer
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx

advapi32

SystemFunction036
CredFree
CredEnumerateW
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath

ole32

CoCreateGuid
CoTaskMemFree
CoInitialize

shlwapi

PathIsFileSpecW
PathAppendW
PathIsDirectoryW
PathAddExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathRenameExtensionW
PathFileExistsW

bcrypt

BCryptGetProperty
BCryptVerifySignature
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCreateHash

crypt32

CertFreeCertificateContext
CryptHashCertificate2
CryptImportPublicKeyInfoEx2
CertVerifySubjectCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CryptUnprotectData
CryptProtectData
CertCreateCertificateContext

secur32

GetUserNameExW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 514KB - Virtual size: 513KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_lichelper.exe
.exe windows:5 windows x86 arch:x86

e801caf4c85671c360cded0336dd9289

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

db:1c:a9:4f:fe:1d:d6:bb:0a:2e:73:da:79:9c:48:03:f6:bb:05:63:a1:62:70:51:4f:73:b4:c9:41:23:7b:eb
Signer

Actual PE Digest

db:1c:a9:4f:fe:1d:d6:bb:0a:2e:73:da:79:9c:48:03:f6:bb:05:63:a1:62:70:51:4f:73:b4:c9:41:23:7b:eb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
GetVersionExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcessHeap
DeviceIoControl
WaitForSingleObject
ReleaseMutex
OpenMutexW
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
FindNextFileW
FindClose
FormatMessageW
GetCurrentProcess
GetLastError
CloseHandle
CreateFileW
WriteFile
FindResourceW
LoadResource
LockResource
SizeofResource
GetCommandLineW
GetACP
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStdHandle
SetEndOfFile
HeapSize
WriteConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
SetStdHandle
ReadConsoleW
CreateMutexW
ExitProcess
HeapReAlloc
GetModuleHandleExW
ReadFile
GetFileType
FindFirstFileExW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
GetStringTypeW
EncodePointer
DecodePointer
TryEnterCriticalSection
QueryPerformanceCounter
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
IsProcessorFeaturePresent
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind

advapi32

SystemFunction036
CredFree
CredReadW
CredWriteW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
GetUserNameW
CredDeleteW

shell32

SHCreateDirectoryExW

ole32

CoCreateGuid

crypt32

CertDeleteCertificateFromStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSerializeCertificateStoreElement
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CertCreateCertificateContext

secur32

GetUserNameExW

shlwapi

PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathAppendW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
PathRenameExtensionW
PathRemoveFileSpecW

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptHashData

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_licutil.exe
.exe windows:5 windows x86 arch:x86

2fab62f7273fb5ffe22ae4dea31049db

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

87:20:b6:e7:b9:fa:85:2c:4c:ab:12:c0:24:1c:20:68:91:b8:3f:e0:1e:9b:e5:ef:1a:af:27:81:b7:3c:ef:b1
Signer

Actual PE Digest

87:20:b6:e7:b9:fa:85:2c:4c:ab:12:c0:24:1c:20:68:91:b8:3f:e0:1e:9b:e5:ef:1a:af:27:81:b7:3c:ef:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpOpen
WinHttpReadData
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpQueryAuthSchemes
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpSendRequest

setupapi

CM_Get_DevNode_Status
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo

kernel32

HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalFree
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
GetVersionExW
GetLocaleInfoA
SetEnvironmentVariableA
ReadFile
ConnectNamedPipe
CreateProcessW
CreateNamedPipeW
SetEvent
WaitForMultipleObjects
CreateEventW
GetTimeZoneInformation
OutputDebugStringA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
LocalAlloc
ReleaseMutex
LocalFree
GetCurrentProcessId
GetTempPathW
GetLocalTime
GetTimeFormatW
GetDateFormatW
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
FindClose
FindFirstFileW
FindNextFileW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetModuleHandleW
ResetEvent
GetFileSizeEx
OpenMutexW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetLastError
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
DecodePointer
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
ResumeThread
CreateThread
SwitchToThread
IsDBCSLeadByteEx
GetStdHandle
GetFileType
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
CreateSymbolicLinkW
SetLastError
TerminateProcess
OpenProcess
MoveFileExW
CopyFileW
GetExitCodeProcess
SetErrorMode
DebugBreak
DuplicateHandle
CreatePipe
CreateEventA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
GetTempFileNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleMode
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
TzSpecificLocalTimeToSystemTime
SetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateSemaphoreW
CloseHandle
WaitForSingleObject
ReleaseSemaphore
Sleep
MultiByteToWideChar
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetEnvironmentVariableA
GetModuleFileNameW
ReadConsoleInputA
SetConsoleMode
SetStdHandle
GetCommandLineW
GetACP
ReadConsoleW
GetConsoleCP
IsValidLocale
GetFileAttributesA
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetCurrentDirectoryW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
LoadLibraryW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetFullPathNameA
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW

user32

MessageBoxW
wsprintfW
GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW

shell32

ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation

ole32

CoTaskMemFree
CoCreateGuid
StringFromCLSID
CoInitialize
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysStringLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString

shlwapi

PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathFileExistsW
PathIsDirectoryW
PathRenameExtensionW

Exports

Exports

GetAsnVersion
IAL_ActivateLicense
IAL_CheckSubscription
IAL_CloseSession
IAL_CreateSession
IAL_DeactivateLicense
IAL_GetAULData
IAL_GetEntitledSerialData
IAL_GetEntitlementsForLEIDS
IAL_GetLEIDForSerial
IAL_GetPackagePoolData
IAL_GetPackagePools
IAL_GetSLConfigData
IAL_GetType2aOfflineException
IAL_GetVersion
IAL_SendAppUsageData
IAL_SendEnrolTrialRequest
IAL_SetCaller
IAL_SetEULAStatus
IAL_SetLicensingLEID
IAL_SetLoggingMethod
IAL_SetProxyDetails
IAL_ValidateSerial
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 490KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_oobelib.dll
.dll windows:5 windows x86 arch:x86

4b85afd38ba45b63ed52bfca0d06816f

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:79:38:80:8c:cc:21:b9:43:b9:61:b2:9e:7d:1f:86:63:24:53:d2:01:44:40:01:cd:ff:af:29:3e:32:34:44
Signer

Actual PE Digest

78:79:38:80:8c:cc:21:b9:43:b9:61:b2:9e:7d:1f:86:63:24:53:d2:01:44:40:01:cd:ff:af:29:3e:32:34:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders

iphlpapi

GetIfTable

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW

shlwapi

PathIsDirectoryW
PathRemoveBackslashW
PathStripPathW
PathFileExistsW
PathFindFileNameW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW

kernel32

ReleaseSemaphore
WaitForSingleObject
Sleep
LockFileEx
UnlockFileEx
GetFileSize
WriteFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
CloseHandle
CreateSemaphoreW
LoadLibraryW
GetModuleFileNameA
CreateProcessW
SetEnvironmentVariableA
CreateFileW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
CreateThread
ResumeThread
GetModuleFileNameW
WideCharToMultiByte
ReadFile
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GlobalFree
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
SetEvent
OpenEventW
GetVersionExW
WaitForMultipleObjects
CreateEventW
GetTimeZoneInformation
OutputDebugStringA
GetTempPathW
GetEnvironmentVariableA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
FindClose
FindFirstFileW
FindNextFileW
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetFileSizeEx
FileTimeToSystemTime
ReleaseMutex
OpenMutexW
LocalAlloc
GetUserDefaultLangID
GetUserDefaultUILanguage
GetModuleHandleW
ResetEvent
CreateToolhelp32Snapshot
DeleteCriticalSection
Process32FirstW
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
GetStdHandle
GetFileType
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
lstrlenW
CopyFileW
GetACP
CreateSymbolicLinkW
SetLastError
TerminateProcess
MoveFileExW
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeCriticalSection
GetLastError
LocalFree
GetProcAddress
FreeLibrary
PeekNamedPipe
SetFileTime
TzSpecificLocalTimeToSystemTime
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
ReadConsoleW
SetFilePointerEx
Process32NextW
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
FreeEnvironmentStringsW
WriteConsoleW
CreateMutexW
InitializeSListHead
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW

user32

GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW
wsprintfW

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetKnownFolderPath

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoTaskMemFree

oleaut32

VariantClear
SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen

Exports

Exports

Adobe_OOBELib_Activate
Adobe_OOBELib_ActivateForLEIDs
Adobe_OOBELib_BackDoorUpgradeCheck
Adobe_OOBELib_CalculateVC
Adobe_OOBELib_CheckForUpgradeOnline
Adobe_OOBELib_CheckSubscriptionMode
Adobe_OOBELib_CheckSubscriptionValidity
Adobe_OOBELib_CheckSubscriptionValidityOnline
Adobe_OOBELib_CheckWFType
Adobe_OOBELib_CheckforUpgrade
Adobe_OOBELib_CleanUpCachePCD
Adobe_OOBELib_CreateRef
Adobe_OOBELib_Deactivate
Adobe_OOBELib_DeactivateLicense
Adobe_OOBELib_DeactivateLicenseForSerial
Adobe_OOBELib_DeactivateLicensesForUser
Adobe_OOBELib_DisAssociateAll
Adobe_OOBELib_EncryptDecryptSerial
Adobe_OOBELib_EnumerateKeys
Adobe_OOBELib_Generate_OffLineExcpType1_ReqCode
Adobe_OOBELib_GetAdobeId
Adobe_OOBELib_GetChallengeString_UpgradeCheck
Adobe_OOBELib_GetCredentialsForProxy
Adobe_OOBELib_GetCurrentLicenseState
Adobe_OOBELib_GetDetailedActiveLicenseInfo
Adobe_OOBELib_GetDetailedLicenseStatus
Adobe_OOBELib_GetDetailedLicenseStatusEx
Adobe_OOBELib_GetDetailedLicenseStatusExForLEIDs
Adobe_OOBELib_GetEntitlement
Adobe_OOBELib_GetEntitlementsForLEIDS
Adobe_OOBELib_GetLicenseStatus
Adobe_OOBELib_GetLicenseStatusEx
Adobe_OOBELib_GetPackagePoolDetailsForPool
Adobe_OOBELib_GetPackagePoolsForAdminForOrg
Adobe_OOBELib_GetRefID
Adobe_OOBELib_GetSerialInfo
Adobe_OOBELib_GetServiceClaimData
Adobe_OOBELib_GetValueforKeyInSubDomain
Adobe_OOBELib_Get_LegacySeatID
Adobe_OOBELib_Get_OffLineExcpType1_ReqCode
Adobe_OOBELib_Get_ProductLine
Adobe_OOBELib_Get_SeatID
Adobe_OOBELib_Getversion
Adobe_OOBELib_ISOTaggingAtInstall
Adobe_OOBELib_IsLicenseAgreementAccepted
Adobe_OOBELib_LaunchPurchaseWorkFlow
Adobe_OOBELib_LoadActivationGraceLicense
Adobe_OOBELib_LoadDBCSLicenseAndActivate
Adobe_OOBELib_LoadOfflineGraceLicense
Adobe_OOBELib_LoadOnlineTrial
Adobe_OOBELib_LoadTrial
Adobe_OOBELib_ProcessExceptionFile
Adobe_OOBELib_Process_file
Adobe_OOBELib_ProtectedContentCheck
Adobe_OOBELib_QueryLicenses
Adobe_OOBELib_QueryLicensesForUser
Adobe_OOBELib_Record_EulaOnline
Adobe_OOBELib_ReducedTrialSLConfigDownload
Adobe_OOBELib_ReleaseRef
Adobe_OOBELib_RememberAdobeID
Adobe_OOBELib_RemoveKeyInSubDomainInCache
Adobe_OOBELib_RemoveLastLoggedInUser
Adobe_OOBELib_Remove_payload
Adobe_OOBELib_RetrieveLEIDForSerial
Adobe_OOBELib_Retrieve_SerialNumber
Adobe_OOBELib_Retrieve_SerialNumberEx
Adobe_OOBELib_Retryactivation
Adobe_OOBELib_SaveAdobeId
Adobe_OOBELib_SetAdobeId
Adobe_OOBELib_SetAdobeIdExtProfile
Adobe_OOBELib_SetAppXMLData
Adobe_OOBELib_SetCallerID
Adobe_OOBELib_SetClaimStatus
Adobe_OOBELib_SetClaimStatusEx
Adobe_OOBELib_SetCredentialsForProxy
Adobe_OOBELib_SetLEID
Adobe_OOBELib_SetLicenseAgreementInformation
Adobe_OOBELib_SetSerialTypeForSerial
Adobe_OOBELib_SetUniversalCookie
Adobe_OOBELib_SetValueforKeyInSubDomainInCache
Adobe_OOBELib_Set_Eula
Adobe_OOBELib_Set_EulaOnline
Adobe_OOBELib_Set_InstallLocale
Adobe_OOBELib_Set_serialnumber
Adobe_OOBELib_SuppressRegSerialNag
Adobe_OOBELib_SuppressRegistrationNag
Adobe_OOBELib_Suppress_Eula
Adobe_OOBELib_Suppress_Registration
Adobe_OOBELib_UnregisterSerials
Adobe_OOBELib_UpdateLastLoggedInUser
Adobe_OOBELib_UpdateUserSpecificIdentity
Adobe_OOBELib_UpdateUserSpecificLicensing
Adobe_OOBELib_UpgradeCheck
Adobe_OOBELib_UpgradeDoneAtInstallTime
Adobe_OOBELib_ValidateSerialOnline
Adobe_OOBELib_Validate_SerialNumber
Adobe_OOBELib_Verify_OffLineExcpType1_ServerResponseCode
GetAsnVersion
IAL_ActivateLicense
IAL_CheckSubscription
IAL_CloseSession
IAL_CreateSession
IAL_DeactivateLicense
IAL_GetAULData
IAL_GetEntitledSerialData
IAL_GetEntitlementsForLEIDS
IAL_GetLEIDForSerial
IAL_GetPackagePoolData
IAL_GetPackagePools
IAL_GetSLConfigData
IAL_GetType2aOfflineException
IAL_GetVersion
IAL_SendAppUsageData
IAL_SendEnrolTrialRequest
IAL_SetCaller
IAL_SetEULAStatus
IAL_SetLicensingLEID
IAL_SetLoggingMethod
IAL_SetProxyDetails
IAL_ValidateSerial
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_upgrade.dll
.dll windows:6 windows x86 arch:x86

6c25149a5e8f2c94cae853461fe2f8c6

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:97:08:a1:7a:a4:67:49:0f:4a:ad:1d:49:fe:53:e0:3e:61:14:35:66:9c:a6:7d:7d:2e:c4:61:07:cc:c0:95
Signer

Actual PE Digest

46:97:08:a1:7a:a4:67:49:0f:4a:ad:1d:49:fe:53:e0:3e:61:14:35:66:9c:a6:7d:7d:2e:c4:61:07:cc:c0:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

iphlpapi

GetIfTable

shlwapi

PathStripPathW
PathRemoveBackslashW
PathRemoveBackslashA
SHDeleteEmptyKeyA
SHDeleteKeyA
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathAddExtensionW
PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathIsFileSpecW

kernel32

GetLastError
CloseHandle
lstrcmpA
lstrcpyA
lstrcatA
lstrlenA
CreateProcessA
GetStdHandle
GetFileType
WriteFile
GetCurrentThreadId
GetModuleHandleA
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
QueryPerformanceFrequency
GetThreadTimes
GetCurrentThread
WideCharToMultiByte
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetTempPathW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
CreateSemaphoreW
SetFilePointer
CreateFileW
ReadFile
SetEndOfFile
UnlockFileEx
LocalAlloc
SetFileAttributesW
LocalFree
LockFileEx
GetFileSize
FlushFileBuffers
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
Sleep
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVersionExW
GetModuleHandleW
GetModuleHandleExW
CreateEventW
SetEvent
GlobalFree
ResetEvent
HeapFree
GetCurrentProcess
HeapSize
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
GetProcessHeap
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
GetVersionExA
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetComputerNameExW
OpenSemaphoreW
ResumeThread
CreateThread
SwitchToThread
lstrcmpW
lstrlenW
CopyFileW
CopyFileExW
GetVolumeInformationW
GetACP
SetCurrentDirectoryW
SetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
LoadLibraryA
GetProcAddress
FreeLibrary
GetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentDirectoryW
SetConsoleCtrlHandler
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
FileTimeToSystemTime
SetFileTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
GetTimeZoneInformation
ExitProcess
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
ReadConsoleW
SetStdHandle
HeapQueryInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
WaitForMultipleObjects
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
WaitForSingleObjectEx

user32

GetUserObjectInformationW
MessageBoxA
GetDC
ReleaseDC
wsprintfW
UnregisterClassW
GetProcessWindowStation

gdi32

GetObjectA
GetDIBits
GetDeviceCaps
DeleteObject
CreateCompatibleBitmap

advapi32

SystemFunction036
SetNamedSecurityInfoW
GetNamedSecurityInfoW
LookupPrivilegeValueW
GetUserNameW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
SetSecurityInfo
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegUnLoadKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegLoadKeyA
RegFlushKey
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetPathFromIDListW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SetErrorInfo
CreateErrorInfo
SysFreeString
SysAllocString
VariantChangeType
VariantInit
GetErrorInfo
VariantClear
SysAllocStringByteLen
SysStringLen

Exports

Exports

AULAcceptsChallengeResponse
AULCloseSession
AULGetChallengeString
AULGetQualifyingSerialNumbers
AULGetUpgradeStatus
AULIsQualifyingSerialNumberForAnyProduct
AULIsQualifyingSerialNumberForProduct
AULNeedsUpgradeCheck
AULNextProduct
AULOpenSession
AULSetQualifyingSerialNumbers
AULSetUpgradeScenario
GetAsnVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 577KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
asufeatures.xml
.xml
axlibv7.dll
.dll windows:5 windows x86 arch:x86

b051ab715287a73e7ae1fcce3bb57dac

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

92:0f:30:c3:09:bd:5c:9d:e3:5f:31:5f:3e:14:dd:14:a9:2c:8b:ec:66:d7:bc:9d:56:a4:38:3b:96:ed:b1:b0
Signer

Actual PE Digest

92:0f:30:c3:09:bd:5c:9d:e3:5f:31:5f:3e:14:dd:14:a9:2c:8b:ec:66:d7:bc:9d:56:a4:38:3b:96:ed:b1:b0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpQueryAuthSchemes
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest

setupapi

CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW

kernel32

SetFileAttributesW
GetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetFileSizeEx
WriteFile
GetFullPathNameW
CreateFileW
HeapCreate
AreFileApisANSI
InterlockedCompareExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
QueryPerformanceFrequency
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
GetModuleFileNameW
GetCurrentThread
GlobalFree
SetEvent
WaitForMultipleObjects
CreateEventW
GetCurrentThreadId
LocalAlloc
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
ReleaseMutex
OpenMutexW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetModuleHandleW
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
RaiseException
DecodePointer
GetStdHandle
GetFileType
GetModuleHandleA
ResumeThread
CreateThread
SwitchToThread
GlobalMemoryStatus
FlushConsoleInputBuffer
GetConsoleMode
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
MoveFileExW
TzSpecificLocalTimeToSystemTime
lstrlenW
SystemTimeToFileTime
CloseHandle
FindClose
FlushFileBuffers
GetLastError
GetCurrentProcess
LocalFree
HeapFree
ReadConsoleInputA
SetConsoleMode
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleCP
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetDiskFreeSpaceW
SetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
InterlockedFlushSList
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
CreateWellKnownSid
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
EqualSid
GetTokenInformation
OpenThreadToken
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
OpenProcessToken

shell32

SHGetFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysStringLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathStripPathW
PathFindFileNameW
PathRemoveFileSpecW
PathRenameExtensionW
PathIsDirectoryW
PathIsFileSpecW
PathAddExtensionW
PathAppendW
PathRemoveExtensionW

Exports

Exports

AXLibCreateRef
AXLibReleaseRef
GetAsnVersion
IsProductAlreadyLicensed
IsProductWithLEIDLicensedByMagicSN
LoadLicenseForSuiteProducts
LoadLicenseForSuiteProductsForLEIDAndSN
RemoveAdobeIDEntriesForTrial
RemoveEULAEntriesForAXFB
RemoveLicenseForSuiteProducts
RemoveLicenseForSuiteProductsForLEIDAndSN
SetAdobeIDEntriesForTrial
SetEULAEntriesForAXFB
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dispatchtable.xml
.xml
imshelper.dll
.dll windows:6 windows x86 arch:x86

9d0d7f4e28ec16c015171acd0388149a

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

21:c0:f9:10:e3:ac:3f:3b:f0:53:64:34:da:59:9f:6c:c7:42:45:5e:91:b9:76:9e:55:c8:e0:8d:30:44:94:f9
Signer

Actual PE Digest

21:c0:f9:10:e3:ac:3f:3b:f0:53:64:34:da:59:9f:6c:c7:42:45:5e:91:b9:76:9e:55:c8:e0:8d:30:44:94:f9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData

kernel32

GetFileSizeEx
FindClose
CreateFileW
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
DeviceIoControl
GetTempPathW
GetVersionExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
CreateProcessW
GetModuleHandleW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
ReadConsoleW
GetConsoleCP
WriteFile
GetModuleFileNameA
SetStdHandle
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
GetACP
SetFilePointerEx
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapSize
SetEndOfFile
GetConsoleMode
GetFileType
GetStringTypeW
EncodePointer
DecodePointer
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind

advapi32

SystemFunction036
CredFree
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

PathIsDirectoryW
PathAppendW
PathIsFileSpecW
PathRenameExtensionW
PathFileExistsW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathAddExtensionW

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCreateHash

crypt32

CertCloseStore
CryptUnprotectData
CryptProtectData

secur32

GetUserNameExW

Exports

Exports

GetNGLDeviceIdentifier
GetNGLDeviceIdentifierForOSUser

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
royaltyleidtable.xml
.xml
x64/IMSLib.dll
.dll windows:5 windows x64 arch:x64

7e1f3b3faa8abef600c129ed3e5e8671

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:d6:84:9d:4f:8b:d5:0a:36:41:cc:df:8b:38:bf:d7:af:41:7d:47:46:41:f4:84:df:2d:49:50:d9:a9:f4:f6
Signer

Actual PE Digest

a4:d6:84:9d:4f:8b:d5:0a:36:41:cc:df:8b:38:bf:d7:af:41:7d:47:46:41:f4:84:df:2d:49:50:d9:a9:f4:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

kernel32

WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
GlobalFree
CloseHandle
CreateThread
ResetEvent
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
GetTempPathW
CreateMutexW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
SetFileAttributesW
Sleep
DeleteFileW
RaiseException
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
SystemTimeToFileTime
CreateProcessW
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetSystemTime
EnumSystemLocalesW
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
LoadLibraryW
FreeLibrary
GetLocalTime
GetTimeFormatW
GetDateFormatW
QueryPerformanceCounter
SetFilePointer
GetCurrentThreadId
GetFileSizeEx
OpenMutexW
GetFileAttributesExW
CreateSymbolicLinkW
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
IsValidLocale
GetStdHandle
GetACP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetUserDefaultLCID
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
FlushFileBuffers
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
RtlPcToFileHeader
EncodePointer
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

wsprintfW

advapi32

SetEntriesInAclW
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CreateWellKnownSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW

shell32

SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoCreateGuid

oleaut32

VariantChangeType
GetErrorInfo
VariantClear
SysStringLen
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
VariantInit

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsFileSpecW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathRenameExtensionW
PathFindFileNameW

Exports

Exports

IMS_EEPLogin
IMS_createRef
IMS_createRefEx
IMS_createRefExWithXMLParams
IMS_createRefForProductVersion
IMS_deregisterClientFromGroup
IMS_fetchAccessToken
IMS_fetchAccessToken2
IMS_fetchAccounts
IMS_fetchContinueToken
IMS_fetchDefaultUserInfoForClientId
IMS_fetchFeatureFlags
IMS_fetchIDPResponseForKey
IMS_fetchReleaseFlag
IMS_fetchUserProfileData
IMS_getDeviceID
IMS_getProxyCredentialsFromIMSLibSession
IMS_logOutUserForClient
IMS_registerClientToGroup
IMS_releaseData
IMS_releaseRef
IMS_revokeDeviceToken
IMS_setProxyCredentials
IMS_setProxyCredentialsInIMSLibSession
IMS_setRetryAfterResponseHandlingData
IMS_setUserAsDefaultForClientId
IMS_storeDeviceTokenAndUserProfile
IMS_storeDeviceTokenAndUserProfileEx

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/imshelper.dll
.dll windows:6 windows x64 arch:x64

87f4d5e136d1af52234d7de30eb04570

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:7f:02:fd:6d:27:91:a1:2c:bb:25:6b:18:11:94:0f:7c:90:32:16:51:6d:c3:e4:c2:f0:8b:8a:0e:36:a0:b9
Signer

Actual PE Digest

7e:7f:02:fd:6d:27:91:a1:2c:bb:25:6b:18:11:94:0f:7c:90:32:16:51:6d:c3:e4:c2:f0:8b:8a:0e:36:a0:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData

kernel32

GetFileSizeEx
FindClose
CreateFileW
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
DeviceIoControl
GetTempPathW
GetVersionExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
CreateProcessW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetCurrentThreadId
GetDateFormatW
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
ReadConsoleW
FindFirstFileExA
SetStdHandle
GetACP
SetFilePointerEx
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
WriteFile
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapSize
SetEndOfFile
GetTimeFormatW
GetFileType
GetStringTypeW
RtlPcToFileHeader
EncodePointer
DecodePointer
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx

advapi32

SystemFunction036
CredFree
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHGetKnownFolderPath
SHCreateDirectoryExW

ole32

CoCreateGuid
CoTaskMemFree

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFileExistsW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathIsDirectoryW
PathRenameExtensionW

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash

crypt32

CertCloseStore
CryptUnprotectData
CryptProtectData

secur32

GetUserNameExW

Exports

Exports

GetNGLDeviceIdentifier
GetNGLDeviceIdentifierForOSUser

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 691KB - Virtual size: 691KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/AAM/P7/P7.pimx
packages/AAM/P7/P7.sig
.xml
packages/AAM/UWA/UWA.pima
.zip
AAM Updates Notifier.exe
.exe windows:5 windows x86 arch:x86

92a72a0097a19486e99b058450014d9c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:5c:e7:48:48:b1:04:73:47:ca:76:7a:be:02:d6:80:b0:6f:31:23
Signer

Actual PE Digest

7d:5c:e7:48:48:b1:04:73:47:ca:76:7a:be:02:d6:80:b0:6f:31:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRenameExtensionW
PathAddExtensionW
PathIsFileSpecW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsDirectoryW
PathStripPathW
PathRemoveBackslashW
PathAppendW
PathFindFileNameW
PathFileExistsW

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW

user32

LoadAcceleratorsW
LoadIconW
GetCursorPos
CreatePopupMenu
CreateWindowExW
InsertMenuW
MessageBoxW
SendMessageW
UpdateWindow
DestroyMenu
DefWindowProcW
DispatchMessageW
wsprintfW
TranslateMessage
BeginPaint
LoadCursorW
SetForegroundWindow
PostMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
TranslateAcceleratorW
DestroyWindow
EndPaint
RegisterClassExW

ole32

CoInitialize
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleRun
CoTaskMemFree

oleaut32

GetErrorInfo
SysFreeString
VariantInit
VariantCopy
VariantClear
SysAllocString

kernel32

GetModuleHandleExW
ExitProcess
GetStdHandle
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
IsValidCodePage
GetOEMCP
LoadLibraryExW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
EnumSystemLocalesW
InterlockedCompareExchange
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetTimeZoneInformation
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
EncodePointer
GetStringTypeW
OpenMutexW
GetFileSizeEx
FileTimeToSystemTime
IsDBCSLeadByteEx
OpenSemaphoreW
CreateSemaphoreW
ReleaseSemaphore
InterlockedDecrement
InterlockedIncrement
lstrlenA
ReleaseMutex
GetUserDefaultUILanguage
FindNextFileW
DecodePointer
LocalAlloc
SetLastError
RaiseException
lstrcmpW
GetModuleFileNameW
TerminateProcess
GetModuleHandleW
MoveFileExW
SystemTimeToFileTime
GetCurrentProcess
CopyFileW
GetFileAttributesW
CreateFileW
lstrlenW
FlushFileBuffers
GetLastError
GetFileAttributesExW
CloseHandle
LocalFree
SetFileAttributesW
WideCharToMultiByte
GetACP
MultiByteToWideChar
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
GetTempPathW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
ReadFile
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
SetDllDirectoryW
GetCurrentThreadId
SetEvent
CreateEventW
WaitForMultipleObjects
CreateThread
GetDateFormatW
GetTimeFormatW
GetLocalTime
GetSystemDefaultLangID
FindFirstFileW
CreateProcessW

Exports

Exports

??0IVulcanController@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanController@api@vulcan@adobe@@QAE@XZ
??1IVulcanController@api@vulcan@adobe@@UAE@XZ
??4IVulcanController@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanVersion@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??_7IVulcanController@api@vulcan@adobe@@6B@

Sections

.text
Size: 783KB - Virtual size: 782KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AAMLauncher.exe
.exe windows:5 windows x86 arch:x86

13e2edda28c8afc0e6e79c6e96167701

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

74:db:0b:fa:7d:ca:3b:fb:08:6d:77:40:59:75:65:34:eb:7b:58:9c
Signer

Actual PE Digest

74:db:0b:fa:7d:ca:3b:fb:08:6d:77:40:59:75:65:34:eb:7b:58:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

kernel32

OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
OpenMutexW
LoadLibraryExW
ReadConsoleW
SetFilePointerEx
GetCurrentProcess
CloseHandle
InterlockedDecrement
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
GetLocalTime
DecodePointer
DeleteCriticalSection
CreateSemaphoreA
ReleaseSemaphore
SetLastError
CreateMutexA
ReleaseMutex
SetDllDirectoryW
CreateProcessW
GetProcAddress
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
MoveFileExW
LocalFree
GetFileTime
FileTimeToLocalFileTime
CreateDirectoryW
CreateFileW
DeleteFileW
GetACP
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GetLongPathNameW
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
WriteFile
GetCurrentThreadId
GetDateFormatW
GetTimeFormatW
ReadFile
GetFileSizeEx
CreateMutexW
GetConsoleMode
GetStringTypeW
EncodePointer
GetCommandLineW
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
RtlUnwind
GetTimeZoneInformation
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
HeapSize
IsValidCodePage
GetOEMCP
FlushFileBuffers
GetConsoleCP

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHGetMalloc

oleaut32

VariantClear

shlwapi

PathRenameExtensionW
PathAppendW
PathAddExtensionW
PathFindFileNameW
PathFileExistsW
PathIsDirectoryW
PathIsFileSpecW
PathRemoveFileSpecW
PathRemoveExtensionW

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AAMProductUpdate.cer
AAMUpdate.cer
Adobe Application Manager (Updater).exe
.exe windows:5 windows x86 arch:x86

32d16879415af46f423f3702fba5cdbb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:24:d5:73:ab:a9:af:8b:96:67:77:ec:41:cf:c6:07:b7:2f:f2:6c
Signer

Actual PE Digest

86:24:d5:73:ab:a9:af:8b:96:67:77:ec:41:cf:c6:07:b7:2f:f2:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetIfTable

setupapi

SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

msi

ord88
ord141
ord175
ord137

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHFileOperationW
SHGetSpecialFolderLocation
SHCreateDirectoryExW

shlwapi

PathAddExtensionW
PathAppendW
PathFindFileNameW
PathRemoveExtensionW
PathRenameExtensionW
PathStripToRootA
PathRemoveFileSpecW
PathIsFileSpecW
PathFileExistsW
PathIsDirectoryW

winhttp

WinHttpSetOption
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryAuthSchemes

crypt32

CertGetNameStringW
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptImportPublicKeyInfo

kernel32

CreateWaitableTimerA
lstrlenA
ExitThread
SetWaitableTimer
CreateNamedPipeW
SearchPathA
CreateProcessA
CreatePipe
ConnectNamedPipe
WaitForMultipleObjects
OpenEventA
WaitNamedPipeW
GlobalFree
ResumeThread
GetTickCount
CreateEventA
CloseHandle
SetEvent
GetSystemTimeAsFileTime
GetLocalTime
GetFileSize
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetProcessHeap
ReleaseSemaphore
HeapAlloc
HeapFree
WaitForSingleObject
Sleep
FreeLibrary
LoadLibraryW
GetProcAddress
DuplicateHandle
GetCurrentProcess
CreateSemaphoreA
GetCommandLineW
SetDllDirectoryW
LocalFree
CreateProcessW
GetLastError
FindFirstFileW
GetEnvironmentStringsW
GetExitCodeProcess
FindClose
FreeEnvironmentStringsW
FindNextFileW
CreateThread
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
SystemTimeToFileTime
InterlockedDecrement
TerminateThread
GetExitCodeThread
SetLastError
CreateMutexA
ReleaseMutex
SetFilePointer
EncodePointer
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeZoneInformation
FileTimeToLocalFileTime
GetFileType
GetFullPathNameW
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
RtlUnwind
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
SetStdHandle
SetEndOfFile
OutputDebugStringW
WriteConsoleW
FlushFileBuffers
GetFullPathNameA
SetEnvironmentVariableA
InterlockedIncrement
GetFileTime
GetTempFileNameW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
GetVolumeInformationW
GetVersionExW
GetLongPathNameW
GetTempPathW
GetEnvironmentVariableW
InitializeCriticalSection
GetFileSizeEx
CreateMutexW
OpenMutexW
ResetEvent
LocalAlloc
GetSystemTime
CreateFileA
HeapCompact
MapViewOfFile
UnmapViewOfFile
UnlockFile
LockFile
UnlockFileEx
FormatMessageA
FormatMessageW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetTempPathA
DeleteFileA

user32

wsprintfW

advapi32

RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
SetNamedSecurityInfoW
RegCreateKeyExA
CryptVerifySignatureW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
GetUserNameW
RegCloseKey

ole32

CoSetProxyBlanket
CoInitializeEx
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
SysAllocString

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain

wininet

InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFileExA
InternetSetOptionA
InternetSetStatusCallbackA
InternetSetStatusCallbackW
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 122KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AdobeAAM_rootCert.cer
LogSession.dll
.dll windows:5 windows x86 arch:x86

0781023b921ecd3f921837e0e01a84a1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c1:71:51:80:3e:e8:28:dd:dc:c9:40:e8:ac:6c:de:94:10:49:1b:83
Signer

Actual PE Digest

c1:71:51:80:3e:e8:28:dd:dc:c9:40:e8:ac:6c:de:94:10:49:1b:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

WriteFile
CreateFileW
CloseHandle
FindFirstFileW
CreateProcessW
MoveFileExW
CompareFileTime
GetEnvironmentStringsW
LoadLibraryW
CopyFileW
GetDiskFreeSpaceW
FindClose
FreeEnvironmentStringsW
FindNextFileW
GetFileTime
GetFileAttributesExW
GetVersionExA
FileTimeToLocalFileTime
DeleteFileW
GetExitCodeThread
SuspendThread
FindResourceExW
MultiByteToWideChar
LoadResource
SizeofResource
LockResource
GetModuleFileNameW
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
VerLanguageNameW
GetLocaleInfoA
GlobalMemoryStatusEx
GetSystemInfo
SetEndOfFile
SetEnvironmentVariableW
CompareStringW
SetStdHandle
GetACP
WideCharToMultiByte
WriteProcessMemory
VirtualProtect
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetLastError
GetSystemDirectoryA
FreeLibrary
GetProcessHeap
SetEnvironmentVariableA
FindResourceW
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
CreateFileA
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
HeapSize
GetTickCount
GetConsoleMode
GetConsoleCP
SetFilePointer
ReadFile
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
HeapFree
HeapAlloc
GetCPInfo
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
WriteConsoleW
GetFileType
GetStdHandle
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
QueryPerformanceCounter

user32

GetMonitorInfoA
GetSystemMetrics
EnumDisplayMonitors

advapi32

CryptAcquireContextA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW

shell32

SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

PathFileExistsW
PathIsDirectoryW

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

UTAddToGroup
UTAddToSession
UTCloseSession
UTGetDemographic
UTGetNonDefaultDemographic
UTGetOptIn
UTInitialize
UTLogEvent
UTNewDataGroup
UTOptInGet
UTOptInSet
UTSetDemographic
UTSetNonDefaultDemographic
UTSetOptIn
UTSetSerializationState
UTStartSession

Sections

.text
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LogTransport2.exe
.exe windows:5 windows x86 arch:x86

db16a03123d1eb196dbbe74f761cce37

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:11:86:fa:fb:52:09:19:de:d6:19:a6:02:1e:3d:80:e1:aa:52:c6
Signer

Actual PE Digest

4c:11:86:fa:fb:52:09:19:de:d6:19:a6:02:1e:3d:80:e1:aa:52:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
PathIsDirectoryW

wininet

InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
InternetSetStatusCallbackW
InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetQueryDataAvailable
InternetQueryOptionW
InternetOpenW

kernel32

GetACP
MultiByteToWideChar
FindFirstFileW
FreeLibrary
CompareFileTime
GetEnvironmentStringsW
LoadLibraryW
CopyFileW
GetVersionExW
CreateFileW
GetProcAddress
FindClose
FreeEnvironmentStringsW
FindNextFileW
GetFileTime
GetFileAttributesExW
CloseHandle
FileTimeToLocalFileTime
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
GetLastError
ReadFile
GetModuleFileNameW
Sleep
GetCurrentProcess
GetModuleHandleW
HeapAlloc
HeapFree
GetProcessHeap
lstrlenW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
CreateMutexA
ReleaseMutex
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
LocalFree
FormatMessageA
GetModuleFileNameA
GetStringTypeExA
LCMapStringA
LoadLibraryA
GetTimeZoneInformation
HeapSize
DeleteFileW
SetEndOfFile
SetStdHandle
GetCurrentThreadId
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocaleInfoW
GetCPInfo
GetFileType
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
ExitProcess
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
LCMapStringW
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
HeapCreate
HeapDestroy
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW

shell32

SHGetFolderPathW
SHFileOperationW
SHCreateDirectoryExW

ole32

CoTaskMemFree
CoCreateGuid

user32

LoadStringA

Sections

.text
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNResources/Dictionary/cs_CZ/stringTable.zdct
UNResources/Dictionary/da_DK/stringTable.zdct
UNResources/Dictionary/de_DE/stringTable.zdct
UNResources/Dictionary/en_AE/stringTable.zdct
UNResources/Dictionary/en_GB/stringTable.zdct
UNResources/Dictionary/en_IL/stringTable.zdct
UNResources/Dictionary/en_US/stringTable.zdct
UNResources/Dictionary/es_ES/stringTable.zdct
UNResources/Dictionary/es_LA/stringTable.zdct
UNResources/Dictionary/es_MX/stringTable.zdct
UNResources/Dictionary/es_NA/stringTable.zdct
UNResources/Dictionary/fi_FI/stringTable.zdct
UNResources/Dictionary/fr_CA/stringTable.zdct
UNResources/Dictionary/fr_FR/stringTable.zdct
UNResources/Dictionary/fr_MA/stringTable.zdct
UNResources/Dictionary/fr_XM/stringTable.zdct
UNResources/Dictionary/hu_HU/stringTable.zdct
UNResources/Dictionary/it_IT/stringTable.zdct
UNResources/Dictionary/ja_JP/stringTable.zdct
UNResources/Dictionary/ko_KR/stringTable.zdct
UNResources/Dictionary/nb_NO/stringTable.zdct
UNResources/Dictionary/nl_NL/stringTable.zdct
UNResources/Dictionary/pl_PL/stringTable.zdct
UNResources/Dictionary/pt_BR/stringTable.zdct
UNResources/Dictionary/ru_RU/stringTable.zdct
UNResources/Dictionary/sv_SE/stringTable.zdct
UNResources/Dictionary/tr_TR/stringTable.zdct
UNResources/Dictionary/uk_UA/stringTable.zdct
UNResources/Dictionary/zh_CN/stringTable.zdct
UNResources/Dictionary/zh_TW/stringTable.zdct
UWAFlex.swf
UWANative.dll
.dll windows:5 windows x86 arch:x86

cc1d4dbcc6eb896d088f041b7f37d4a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a7:4f:19:63:dc:93:41:75:c9:d7:3e:78:6c:65:17:e6:c0:bc:75:33
Signer

Actual PE Digest

a7:4f:19:63:dc:93:41:75:c9:d7:3e:78:6c:65:17:e6:c0:bc:75:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
CreateThread
GetFileSize
CreateMutexW
FindFirstFileW
CreateProcessW
SystemTimeToFileTime
MoveFileExW
GetCurrentProcess
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetVersionExW
GetFileAttributesW
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
lstrcmpW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
RaiseException
GetLastError
SetLastError
GetProcAddress
FindClose
RemoveDirectoryW
DecodePointer
FindNextFileW
DeleteCriticalSection
ReleaseMutex
DeleteFileW
LocalFree
GetSystemTime
lstrlenA
InterlockedIncrement
InterlockedDecrement
ReleaseSemaphore
CreateSemaphoreW
GetCurrentProcessId
FreeLibrary
LoadLibraryW
Sleep
GetFullPathNameA
HeapReAlloc
CreateFileA
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
FormatMessageW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
IsProcessorFeaturePresent
lstrlenW
GetACP
GetCurrentThreadId
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
GetLocalTime
OpenMutexW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
CloseHandle
GetDiskFreeSpaceExW
OpenEventW
InitializeCriticalSectionAndSpinCount
SetEvent
CreateDirectoryW
GetConsoleCP
LoadLibraryExW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
IsDebuggerPresent
EncodePointer
GetFullPathNameW
GetFileSizeEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
GetCommandLineA
RtlUnwind
GetTimeZoneInformation
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
GetStringTypeW

user32

wsprintfW

advapi32

FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW

shell32

SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExW
SHGetPathFromIDListW

ole32

CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleRun
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
VariantInit
VariantCopy
VariantClear
SysAllocString
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathRemoveFileSpecA
PathIsDirectoryW
PathFileExistsW
PathStripPathW
PathAppendW
PathRemoveBackslashW
PathRemoveExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW
PathFindFileNameW

Exports

Exports

finalizeApplet
freeMemory
initializeApplet
processMessage

Sections

.text
Size: 761KB - Virtual size: 761KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UpdaterInventory.dll
.dll windows:5 windows x86 arch:x86

67c0bda10ceec83518b090bce82f5159

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:27:5f:c9:cd:7a:e7:ec:5f:dd:72:fa:36:d5:b0:87:3a:9a:ef:98
Signer

Actual PE Digest

4c:27:5f:c9:cd:7a:e7:ec:5f:dd:72:fa:36:d5:b0:87:3a:9a:ef:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalAlloc
LocalFree
MultiByteToWideChar
EncodePointer
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetTimeZoneInformation
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetModuleFileNameW
GetProcessHeap
HeapReAlloc
RtlUnwind
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
SetEnvironmentVariableA
GetLongPathNameW
GetTempPathW
HeapFree
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
GetVersionExW
ReadFile
SetEndOfFile
ReadConsoleW
HeapAlloc
CreateThread
DeleteCriticalSection
DecodePointer
GetExitCodeThread
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
TerminateThread
WaitForSingleObject
InterlockedDecrement
CloseHandle
FindNextFileW
FindClose
GetCurrentProcess
FindFirstFileW
LoadLibraryExW

advapi32

CreateWellKnownSid
GetSecurityDescriptorDacl
RegOpenKeyExW
RegSetKeySecurity
SetEntriesInAclW
RegDeleteValueW
RegGetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
SetNamedSecurityInfoW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHFileOperationW

ole32

CoInitializeEx
CoTaskMemFree
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

shlwapi

PathFileExistsW
PathIsDirectoryW
PathIsFileSpecW
PathRemoveFileSpecW

Exports

Exports

UpdaterInventoryAddToMCL
UpdaterInventoryAddToMCLWithIcon
UpdaterInventoryGetLibVersion
UpdaterInventoryIsHigherUpdatePresent
UpdaterInventoryRelease
UpdaterInventoryRemoveFromMCL
UpdaterInventorySuppressUpdates

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ZStringResources/FontCustomization.xml
.xml
ZStringResources/cs_CZ/stringtable.xml
.xml .vbs polyglot
ZStringResources/da_DK/stringtable.xml
.xml .vbs polyglot
ZStringResources/de_DE/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_AE/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_GB/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_IL/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_US/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_XM/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_ES/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_LA/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_MX/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_NA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fi_FI/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_CA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_FR/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_MA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_XM/stringtable.xml
.xml .vbs polyglot
ZStringResources/hu_HU/stringtable.xml
.xml .vbs polyglot
ZStringResources/it_IT/stringtable.xml
.xml .vbs polyglot
ZStringResources/ja_JP/stringtable.xml
.xml .vbs polyglot
ZStringResources/ko_KR/stringtable.xml
.xml .vbs polyglot
ZStringResources/nb_NO/stringtable.xml
.xml .vbs polyglot
ZStringResources/nl_NL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pl_PL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pt_BR/stringtable.xml
.xml .vbs polyglot
ZStringResources/ru_RU/stringtable.xml
.xml .vbs polyglot
ZStringResources/sv_SE/stringtable.xml
.xml .vbs polyglot
ZStringResources/tr_TR/stringtable.xml
.xml .vbs polyglot
ZStringResources/uk_UA/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_CN/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_TW/stringtable.xml
.xml .vbs polyglot
install.sig
.xml
updatercore.dll
.dll windows:5 windows x86 arch:x86

5e639cc30d324b2e1d5aa652e4de89cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:a9:53:2f:d0:a0:a1:5f:ff:da:49:14:b3:74:ea:65:a8:9a:d9:38
Signer

Actual PE Digest

0e:a9:53:2f:d0:a0:a1:5f:ff:da:49:14:b3:74:ea:65:a8:9a:d9:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

GetBestInterface
GetAdaptersInfo
GetIfTable

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

crypt32

CryptImportPublicKeyInfo
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

netapi32

NetWkstaUserGetInfo
NetApiBufferFree

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveExtensionW
PathStripToRootA
PathRemoveFileSpecW
PathIsFileSpecW
PathIsDirectoryW
SHGetValueW
PathStripPathW
PathRemoveBackslashW
PathFileExistsW
PathFindFileNameW
PathRenameExtensionW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW

winhttp

WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpReadData
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpSetOption
WinHttpSetTimeouts

kernel32

ExitThread
SetWaitableTimer
OpenEventA
WaitForMultipleObjects
CreateWaitableTimerA
lstrlenA
GlobalFree
ResumeThread
lstrlenW
DeleteFileA
GetTempPathA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
WideCharToMultiByte
GetACP
MultiByteToWideChar
GetSystemDefaultLangID
GetVersionExW
GetLastError
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
CreateEventA
CloseHandle
SetEvent
GetLocalTime
GetFileSize
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
FreeLibrary
LoadLibraryW
GetProcAddress
GetTickCount
GetProcessHeap
ReleaseSemaphore
DuplicateHandle
HeapAlloc
GetCurrentProcess
HeapFree
CreateSemaphoreA
WaitForSingleObject
Sleep
GetSystemTimeAsFileTime
ConnectNamedPipe
FindFirstFileW
FindClose
FindNextFileW
LocalFree
CreateThread
GetSystemDefaultLCID
RaiseException
DecodePointer
DeleteCriticalSection
SystemTimeToFileTime
InterlockedDecrement
TerminateThread
FileTimeToSystemTime
GetExitCodeThread
SetLastError
CreateMutexA
ReleaseMutex
CreateNamedPipeW
FormatMessageA
EncodePointer
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CreateSemaphoreW
ReadConsoleW
SetFilePointerEx
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
RtlUnwind
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
OutputDebugStringW
SetStdHandle
SetEndOfFile
WriteConsoleW
FlushFileBuffers
GetFullPathNameA
SetEnvironmentVariableA
InterlockedIncrement
GetFileTime
GetTempFileNameW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
GetVolumeInformationW
GetLongPathNameW
GetTempPathW
GetCommandLineW
GetFileSizeEx
InitializeCriticalSection
SetFilePointer
CreateMutexW
OpenMutexW
ResetEvent
LocalAlloc
GetSystemTime
CreateFileA
HeapCompact
MapViewOfFile
UnmapViewOfFile
UnlockFile
LockFile
UnlockFileEx
FormatMessageW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW

user32

wsprintfW

advapi32

CryptReleaseContext
GetTokenInformation
RegCreateKeyExW
EqualSid
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegCloseKey
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
CryptVerifySignatureW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
OpenProcessToken
CryptAcquireContextW
GetUserNameW

ole32

CoCreateInstance
CoUninitialize
CoCreateGuid
StringFromGUID2
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
CLSIDFromString
OleRun
CoInitialize
CLSIDFromProgID

oleaut32

SysStringByteLen
VariantInit
SysAllocStringByteLen
SysFreeString
SysAllocString
SysStringLen
VariantClear
VariantCopy
GetErrorInfo

ws2_32

inet_addr

wininet

HttpQueryInfoA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFileExA
InternetSetOptionA
InternetSetStatusCallbackA
InternetSetStatusCallbackW
HttpOpenRequestA
HttpSendRequestA

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust

Exports

Exports

RegisterAlertUI
UCAddToPreferences
UCCheckForUpdates
UCCheckIfNonRibsPatchPresent
UCCheckUpdatesForProducts
UCDownloadUpdates
UCDownloadUpdatesGivenAAMlauncher
UCFree
UCGetAvailableUpdateStatus
UCGetInstalledChannels
UCGetInstalledUpdates
UCGetLibVersion
UCGetProxyInfo
UCGetUpdateInstallConflictInfo
UCGetUserPreferences
UCGetprogress
UCInitialize
UCInstallUpdates
UCIsOptOutRequired
UCIsSelfUpdateAvailable
UCSendCancelDownloadAnalytics
UCSetOptOption
UCSetProxyInfo
UCSetUpdateInstallConflictInfo
UCSetUserPreferences
UCSetViewedUpdates
UCSuppressUpdates
UCTerminate
UCUseETSAnaytics
UCUserAction

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 489KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
updatercorehelper.exe
.exe windows:5 windows x86 arch:x86

031b360367c72315bba7c50cda6ff65d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8b:d0:78:ad:0a:c6:77:cb:6e:73:93:c6:95:ac:15:4b:3a:fa:84:39
Signer

Actual PE Digest

8b:d0:78:ad:0a:c6:77:cb:6e:73:93:c6:95:ac:15:4b:3a:fa:84:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
GetCommandLineW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CloseHandle
SetFilePointer
WriteFile
CreateFileW
GetTempPathW
GetCurrentThreadId
GetDateFormatW
WideCharToMultiByte
GetTimeFormatW
ReadFile
MultiByteToWideChar
GetFileSizeEx
GetLastError
GetLocalTime
CreateMutexW
WaitForSingleObject
OpenMutexW
ReleaseMutex
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleFileNameW
lstrlenA
InterlockedDecrement
HeapSize
LocalFree
SetEnvironmentVariableA
SetEndOfFile
OutputDebugStringW
WriteConsoleW
SetStdHandle
LoadLibraryExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleHandleExW
ExitProcess
IsDebuggerPresent
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCurrentProcessId
QueryPerformanceCounter
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetProcessHeap
GetFileType
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
MoveFileExW
GetTimeZoneInformation
RaiseException
RtlUnwind
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW

shell32

SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CLSIDFromString
OleRun
CLSIDFromProgID
CoInitialize
CoTaskMemFree

oleaut32

SysFreeString
SysAllocString
GetErrorInfo

shlwapi

PathRemoveExtensionW
PathIsDirectoryW
PathIsFileSpecW
PathFindFileNameW
PathRemoveFileSpecW
PathAddExtensionW
PathRenameExtensionW
PathAppendW
PathFileExistsW

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
updaterstartuputility.exe
.exe windows:5 windows x86 arch:x86

df48a2fc753f88137f1ec9e2418dd33c

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4b:a8:83:f5:79:d3:7c:ef:4b:ee:a7:17:33:2a:96:02:de:65:47:e0:0d:2a:fb:5d:04:b0:e2:4e:93:84:61:c2
Signer

Actual PE Digest

4b:a8:83:f5:79:d3:7c:ef:4b:ee:a7:17:33:2a:96:02:de:65:47:e0:0d:2a:fb:5d:04:b0:e2:4e:93:84:61:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoInitializeEx
CoTaskMemFree
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance

advapi32

FreeSid
OpenProcessToken
GetTokenInformation
EqualSid
AllocateAndInitializeSid
CheckTokenMembership
SetNamedSecurityInfoW

netapi32

NetApiBufferFree
NetWkstaUserGetInfo

kernel32

OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
EncodePointer
LoadLibraryExW
ReadConsoleW
SetFilePointerEx
GetCurrentProcess
CloseHandle
InterlockedDecrement
WaitForSingleObject
TerminateThread
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
GetLocalTime
GetExitCodeThread
DecodePointer
DeleteCriticalSection
CreateThread
MultiByteToWideChar
LocalFree
Sleep
GetCommandLineW
SetDllDirectoryW
CreateProcessW
FreeLibrary
GetProcAddress
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
SetEnvironmentVariableA
MoveFileExW
GetVersionExW
GetFileTime
FileTimeToLocalFileTime
CreateDirectoryW
CreateFileW
DeleteFileW
GetACP
WideCharToMultiByte
InterlockedIncrement
ReleaseMutex
CreateMutexA
GetLongPathNameW
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
WriteFile
GetCurrentThreadId
GetDateFormatW
GetTimeFormatW
ReadFile
GetFileSizeEx
CreateMutexW
OpenMutexW
GetModuleFileNameW
GetStringTypeW
GetConsoleMode
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
RtlUnwind
GetTimeZoneInformation
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
GetProcessHeap
GetStdHandle
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
HeapSize
IsValidCodePage
GetOEMCP
FlushFileBuffers
GetConsoleCP

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW
CommandLineToArgvW

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

shlwapi

PathRenameExtensionW
PathAppendW
PathAddExtensionW
PathFindFileNameW
PathRemoveExtensionW
SHGetValueW
PathFileExistsW
PathIsDirectoryW
PathIsFileSpecW
PathRemoveFileSpecW

Sections

.text
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/AAM/UWA/UWA.pimx
packages/AAM/UWA/UWA.sig
.xml
packages/AAM/core/PDApp.pima
.zip
AAMCustomHook.exe
.exe windows:5 windows x86 arch:x86

62513fd0ddeae64cd4eebb9579b46767

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

29:ec:74:eb:9d:a9:4f:6e:42:98:f3:2b:82:c0:ad:30:67:c9:d8:91
Signer

Actual PE Digest

29:ec:74:eb:9d:a9:4f:6e:42:98:f3:2b:82:c0:ad:30:67:c9:d8:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
ReleaseMutex
SetFileAttributesW
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
DeleteFileW
CloseHandle
RaiseException
ResetEvent
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
DeleteCriticalSection
GetModuleHandleW
CopyFileW
WideCharToMultiByte
FlushFileBuffers
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
LoadLibraryW
FreeLibrary
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
GetUserDefaultLCID
LCMapStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTempPathW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
EncodePointer
TerminateProcess
WriteFile
GetCurrentProcess
FindNextFileW
SetLastError
ReadFile
SetStdHandle
GetConsoleCP
SetEndOfFile
WriteConsoleW
GetStringTypeW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetFileType
EnumSystemLocalesW
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
InitializeSListHead
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
GetLocaleInfoW
GetCPInfo
WaitForSingleObjectEx
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

user32

wsprintfW

advapi32

SystemFunction036

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW

ole32

CoCreateInstance
CLSIDFromProgID
OleRun
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
GetErrorInfo

shlwapi

PathFileExistsW
PathStripPathW
PathFindFileNameW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW

Sections

.text
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AAMLauncherUtil.exe
.exe windows:5 windows x86 arch:x86

3cf0eb9f48cf84928b65685af4671be4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

de:93:28:ac:98:f4:c6:89:0a:14:7b:f7:4b:dd:f1:6c:cc:b6:0a:d6
Signer

Actual PE Digest

de:93:28:ac:98:f4:c6:89:0a:14:7b:f7:4b:dd:f1:6c:cc:b6:0a:d6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
DeleteFileW
CloseHandle
RaiseException
ResetEvent
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
DeleteCriticalSection
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
FlushFileBuffers
InterlockedDecrement
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
FreeLibrary
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetFileSizeEx
CreateFileW
GetTimeFormatW
GetDateFormatW
OpenMutexW
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
HeapFree
SetEndOfFile
WaitForSingleObject
FindClose
CreateMutexW
GetTempPathW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TerminateProcess
WriteFile
GetCurrentProcess
FindNextFileW
SetLastError
ReadFile
SetDllDirectoryW
GetUserDefaultUILanguage
GetUserDefaultLangID
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapAlloc
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
HeapSize
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
GetFileType
Sleep
GetLocalTime
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDBCSLeadByteEx
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleExW

user32

wsprintfW
MessageBoxW

advapi32

SystemFunction036

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

StringFromGUID2
CoCreateInstance
CLSIDFromProgID
OleRun
CLSIDFromString
CoCreateGuid
CoInitialize

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantClear
GetErrorInfo

shlwapi

PathRenameExtensionW
PathAppendW
PathIsFileSpecW
PathRemoveExtensionW
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathAddExtensionW

Sections

.text
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AdobePIM.dll
.dll windows:5 windows x86 arch:x86

aafa9e07cc7cab461d7c6fde9f6f4fd5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5c:3e:9a:97:da:43:60:16:0b:a2:d7:17:1b:1c:9c:f1:20:87:35:5a
Signer

Actual PE Digest

5c:3e:9a:97:da:43:60:16:0b:a2:d7:17:1b:1c:9c:f1:20:87:35:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord147
ord145
ord74

kernel32

CreateMutexW
WaitForSingleObject
LocalAlloc
ReleaseMutex
Sleep
OpenSemaphoreW
CloseHandle
LocalFree
GetCurrentProcessId
CreateSemaphoreW
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
CreateDirectoryW
GetTempPathW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
FindFirstFileW
FindNextFileW
GetModuleFileNameW
FindClose
GetVersionExW
SetFileAttributesW
CreateEventW
SetEvent
GetDiskFreeSpaceExW
ResetEvent
MoveFileExW
CreateProcessW
CopyFileW
MoveFileW
ReadFile
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
RemoveDirectoryW
CreateFileW
GetFileAttributesW
DeleteFileW
GetProcAddress
GetFileSize
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetExitCodeProcess
AreFileApisANSI
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
ReleaseSemaphore
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetProcessHeap
FreeLibrary
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
GetFileSizeEx
lstrlenW
GetACP
QueryPerformanceFrequency
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
EncodePointer
GetUserDefaultLCID
LCMapStringW
GetCurrentThreadId
OpenMutexW
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetFileType
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
SetFilePointerEx
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetStringTypeW
UnmapViewOfFile
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc

user32

wsprintfW

advapi32

FreeSid
SystemFunction036
CreateWellKnownSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetPathFromIDListW

ole32

CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitialize
OleRun
CoCreateInstance

oleaut32

VariantClear
SysStringLen
VariantCopy
SysAllocString
SysFreeString
VariantInit
VariantChangeType
GetErrorInfo

shlwapi

PathIsFileSpecW
PathAddExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFileExistsW
PathRemoveBackslashW
PathAppendW
PathIsDirectoryW
PathFindFileNameW
PathRenameExtensionW
PathStripPathW

Exports

Exports

AAMIU_Uninstall
AAMIU_getDeploymentValidationStatus
AAMIU_preInstallPropertySet
pim_copyPkgsFromACFToCFPath
pim_createLibraryRef
pim_createLibraryRefWithType
pim_createOrUpdateAAMInventory
pim_executeInstallModifersForInstalledPackages
pim_freeLiraryRef
pim_getAppletRegistrationInfo
pim_getCurrentPIMCFPath
pim_getCurrentPackagesVersion
pim_getCurrentPathType
pim_getInstalledPackagesInfo
pim_getPathOfType
pim_getStandardACFPath
pim_getStandardUSFPath
pim_getStandardUSFTempPath
pim_getUpdateStatusAtPath
pim_getUpdateStatusAtPathCInterface
pim_haveEnoughDiskSpaceIfACFLatest
pim_haveEnoughDiskSpaceToInstallPackages
pim_haveEnoughDiskSpaceToInstallPackagesCInterface
pim_installAdobeApplicationManager
pim_installPackage
pim_postInstallPackages
pim_registerProgressTicksCallback
pim_syncFromPathToACF
pim_syncFromPathToPath
pim_syncUSFToACF
pim_uninstallAAMFromAAMCleanerTool
pim_uninstallAAMUsingAAMCleanerTool

Sections

.text
Size: 1008KB - Virtual size: 1007KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.VC90.CRT/Microsoft.VC90.CRT.manifest
Microsoft.VC90.CRT/msvcm90.dll
.dll windows:5 windows x86 arch:x86

2e705c0231c4d814c2d2191566905482

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

97:00:89:57:be:68:32:52:63:21:be:0f:51:fa:f6:bc:8e:b2:43:43
Signer

Actual PE Digest

97:00:89:57:be:68:32:52:63:21:be:0f:51:fa:f6:bc:8e:b2:43:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__setusermatherr
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_query_new_handler@@YAP6AHI@ZXZ
signal
_invalid_parameter
_errno
_set_invalid_parameter_handler
_get_invalid_parameter_handler
?set_terminate@@YAP6AXXZP6AXXZ@Z
_get_terminate
_set_purecall_handler
_get_purecall_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_get_unexpected
_fpieee_flt
_cexit
strcpy_s
strlen
_exit
_XcptFilter
_endthread
_getptd
_freefls
___fls_setvalue@8
___fls_getvalue@4
__get_flsindex
__set_flsgetvalue
_dosmaperr
_initptd
calloc
_encode_pointer
memcpy_s
memcmp
memmove_s
memset
??_V@YAXPAX@Z
___mb_cur_max_func
_invalid_parameter_noinfo
_invoke_watson
_CxxThrowException
??2@YAPAXI@Z
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
abort
fgetc
fputc
ungetc
fflush
setvbuf
fwrite
fgetpos
fseek
fsetpos
fclose
__iob_func
fgetwc
fputwc
ungetwc
realloc
setlocale
sprintf_s
memcpy
___lc_handle_func
__crtGetStringTypeW
__pctype_func
___mb_cur_max_l_func
___lc_codepage_func
__crtLCMapStringW
__crtLCMapStringA
_wfsopen
mbstowcs_s
__uncaught_exception
isupper
islower
towlower
towupper
strcmp
__FrameUnwindFilter
__dllonexit
_unlock
??3@YAXPAX@Z
_ui64toa_s
_create_locale
malloc
_free_locale
_endthreadex
free

kernel32

WideCharToMultiByte
CreateThread
ResumeThread
GetLastError
ExitThread
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId

ole32

CoCreateInstance

mscoree

CorBindToRuntimeEx
_CorDllMain

Exports

Exports

?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?_Addstd@ios_base@std@@SAXPAV12@@Z
?_Atexit@@YAXP6AXXZ@Z
?_BADOFF_func@std@@YAABJXZ
?_Cerr_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cin_func@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@XZ
?_Clocptr_func@_Locimp@locale@std@@CAAAPAV123@XZ
?_Clog_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Cout_func@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Fpz_func@std@@YAAA_JXZ
?_Getcvt@@YA?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Id_cnt_func@id@locale@std@@CAAAHXZ
?_Id_func@?$codecvt@GDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$codecvt@_WDH@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@D@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@G@std@@SAAAVid@locale@2@XZ
?_Id_func@?$ctype@_W@std@@SAAAVid@locale@2@XZ
?_Index_func@ios_base@std@@CAAAHXZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z
?_Lockit_ctor@_Lockit@std@@SAXH@Z
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Mbrtowc@@YAHPAGPBDIPAHPBU_Cvtvec@@@Z
?_Mbrtowc@@YAHPA_WPBDIPAHPBU_Cvtvec@@@Z
?_Mtxdst@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxinit@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mtxunlock@@YAXPAU_RTL_CRITICAL_SECTION@@@Z
?_Mutex_Lock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_Unlock@_Mutex@std@@CAXPAV12@@Z
?_Mutex_ctor@_Mutex@std@@CAXPAV12@@Z
?_Mutex_dtor@_Mutex@std@@CAXPAV12@@Z
?_Nomemory@std@@YAXXZ
?_Once@@YAXPAJP6AXXZ@Z
?_Setgloballocale@locale@std@@CAXPAX@Z
?_Sync_func@ios_base@std@@CAAA_NXZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcerr_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@XZ
?_Wcin_func@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wclog_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@XZ
?_Wcout_func@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@XZ
?_Wcrtomb@@YAHPADGPAHPBU_Cvtvec@@@Z
?_Wcrtomb@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?_Xinvarg@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
?__Wcrtomb_lk@@YAHPAD_WPAHPBU_Cvtvec@@@Z
?__get_default_appdomain@@YAJPAPAUIUnknown@@@Z
?__query_new_handler_m@@YAP6MHI@ZXZ
?__release_appdomain@@YAXPAUIUnknown@@@Z
?_beginthread@@YAIP6MXPAX@ZI0@Z
?_beginthreadex@@YAIPAXIP6MI0@Z0IPAI@Z
?_fpieee_flt@@YAHKPAU_EXCEPTION_POINTERS@@P6MHPAU_FPIEEE_RECORD@@@Z@Z
?_set_invalid_parameter_handler@@YAP6AXPB_W00II@ZH@Z
?_set_invalid_parameter_handler@@YAP6MXPB_W00II@ZP6MX000II@Z@Z
?_set_new_handler@@YAP6MHI@ZP6MHI@Z@Z
?_set_purecall_handler@@YAP6AXXZH@Z
?_set_purecall_handler@@YAP6MXXZP6MXXZ@Z
?_uncaught_exception_m@std@@YA_NXZ
?classic@locale@std@@SAABV12@XZ
?empty@locale@std@@SA?AV12@XZ
?global@locale@std@@SA?AV12@ABV12@@Z
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?set_new_handler@std@@YAP6MXXZP6MXXZ@Z
?set_terminate@@YAP6MXXZP6MXXZ@Z
?set_unexpected@@YAP6MXXZP6MXXZ@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?signal@@YAP6MXH@ZHH@Z
?signal@@YAP6MXH@ZHP6MXH@Z@Z
__setusermatherr_m
towctrans
wctrans
wctype

Sections

.text
Size: 206KB - Virtual size: 206KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.VC90.CRT/msvcp90.dll
.dll windows:5 windows x86 arch:x86

c2219f463c61f3122c87331837e12c34

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e9:c4:fe:36:f3:bd:3e:f2:64:2c:75:13:e1:a7:62:07:ef:2f:ea:bf
Signer

Actual PE Digest

e9:c4:fe:36:f3:bd:3e:f2:64:2c:75:13:e1:a7:62:07:ef:2f:ea:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

fflush
setvbuf
fwrite
??0exception@std@@QAE@XZ
_Getdays
_Getmonths
fgetpos
fseek
fsetpos
fclose
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
__iob_func
_wfsopen
mbstowcs_s
atan2
cos
exp
ldexp
log
pow
sin
sqrt
tan
fgetwc
fputwc
ungetwc
memcpy
_Strftime
strcspn
sprintf_s
abort
??0exception@std@@QAE@ABQBDH@Z
_realloc_crt
setlocale
_malloc_crt
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
fputs
__uncaught_exception
ungetc
towupper
strcmp
_create_locale
_ui64toa_s
_free_locale
__pctype_func
_errno
___mb_cur_max_l_func
___lc_codepage_func
___lc_handle_func
__crtCompareStringA
___lc_collate_cp_func
__crtLCMapStringA
isupper
_calloc_crt
islower
__crtGetStringTypeW
__crtLCMapStringW
__crtCompareStringW
isspace
tolower
strtod
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
fputc
fgetc
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
___mb_cur_max_func
??_V@YAXPAX@Z
_Gettnames
localeconv
free
memset
memchr
strlen
memcmp
wcslen
memmove_s
memcpy_s
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
towlower
??0exception@std@@QAE@ABQBD@Z

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime

Exports

Exports

??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??$?5DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?5GU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAG@Z
??$?5GU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
??$?5GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?5MDU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5MGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5M_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@M@0@@Z
??$?5NDU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5NGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5N_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@N@0@@Z
??$?5ODU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5OGU?$char_traits@G@std@@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5O_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$complex@O@0@@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAC@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAE@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAC@Z
??$?5U?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??$?5_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AA_W@Z
??$?5_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@PA_W@Z
??$?5_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?6GU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@G@Z
??$?6GU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
??$?6GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?6MDU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6MGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6M_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@M@0@@Z
??$?6NDU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6NGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6N_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@N@0@@Z
??$?6ODU?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6OGU?$char_traits@G@std@@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6O_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$complex@O@0@@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@C@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@E@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBC@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBE@Z
??$?6_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@PB_W@Z
??$?6_WU?$char_traits@_W@std@@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@_W@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?8M@std@@YA_NABMABV?$complex@M@0@@Z
??$?8M@std@@YA_NABV?$complex@M@0@0@Z
??$?8M@std@@YA_NABV?$complex@M@0@ABM@Z
??$?8N@std@@YA_NABNABV?$complex@N@0@@Z
??$?8N@std@@YA_NABV?$complex@N@0@0@Z
??$?8N@std@@YA_NABV?$complex@N@0@ABN@Z
??$?8O@std@@YA_NABOABV?$complex@O@0@@Z
??$?8O@std@@YA_NABV?$complex@O@0@0@Z
??$?8O@std@@YA_NABV?$complex@O@0@ABO@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?9M@std@@YA_NABMABV?$complex@M@0@@Z
??$?9M@std@@YA_NABV?$complex@M@0@0@Z
??$?9M@std@@YA_NABV?$complex@M@0@ABM@Z
??$?9N@std@@YA_NABNABV?$complex@N@0@@Z
??$?9N@std@@YA_NABV?$complex@N@0@0@Z
??$?9N@std@@YA_NABV?$complex@N@0@ABN@Z
??$?9O@std@@YA_NABOABV?$complex@O@0@@Z
??$?9O@std@@YA_NABV?$complex@O@0@0@Z
??$?9O@std@@YA_NABV?$complex@O@0@ABO@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?DM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?DM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?DM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?DN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?DN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?DN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?DO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?DO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?DO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?GM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@@Z
??$?GM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?GN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@@Z
??$?GN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?GO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@@Z
??$?GO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?HN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@@Z
??$?HN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?HO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@@Z
??$?HO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@_WABV10@@Z
??$?KM@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$?KM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?KM@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$?KN@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$?KN@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$?KN@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$?KO@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$?KO@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$?KO@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?NDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?NGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?N_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?OGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?PDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??$?PGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?P_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$_Fabs@M@std@@YAMABV?$complex@M@0@PAH@Z
??$_Fabs@N@std@@YANABV?$complex@N@0@PAH@Z
??$_Fabs@O@std@@YAOABV?$complex@O@0@PAH@Z
??$abs@M@std@@YAMABV?$complex@M@0@@Z
??$abs@N@std@@YANABV?$complex@N@0@@Z
??$abs@O@std@@YAOABV?$complex@O@0@@Z
??$arg@M@std@@YAMABV?$complex@M@0@@Z
??$arg@N@std@@YANABV?$complex@N@0@@Z
??$arg@O@std@@YAOABV?$complex@O@0@@Z
??$conj@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$conj@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$conj@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$cos@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$cos@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$cos@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$cosh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$cosh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$cosh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$exp@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$exp@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$exp@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
??$getline@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??$getline@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@G@Z
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@_W@Z
??$imag@M@std@@YAMABV?$complex@M@0@@Z
??$imag@N@std@@YANABV?$complex@N@0@@Z
??$imag@O@std@@YAOABV?$complex@O@0@@Z
??$log10@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$log10@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$log10@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$log@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$log@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$log@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$norm@M@std@@YAMABV?$complex@M@0@@Z
??$norm@N@std@@YANABV?$complex@N@0@@Z
??$norm@O@std@@YAOABV?$complex@O@0@@Z
??$polar@M@std@@YA?AV?$complex@M@0@ABM0@Z
??$polar@M@std@@YA?AV?$complex@M@0@ABM@Z
??$polar@N@std@@YA?AV?$complex@N@0@ABN0@Z
??$polar@N@std@@YA?AV?$complex@N@0@ABN@Z
??$polar@O@std@@YA?AV?$complex@O@0@ABO0@Z
??$polar@O@std@@YA?AV?$complex@O@0@ABO@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABMABV10@@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@ABM@Z
??$pow@M@std@@YA?AV?$complex@M@0@ABV10@H@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABNABV10@@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@0@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@ABN@Z
??$pow@N@std@@YA?AV?$complex@N@0@ABV10@H@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABOABV10@@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@0@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@ABO@Z
??$pow@O@std@@YA?AV?$complex@O@0@ABV10@H@Z
??$real@M@std@@YAMABV?$complex@M@0@@Z
??$real@N@std@@YANABV?$complex@N@0@@Z
??$real@O@std@@YAOABV?$complex@O@0@@Z
??$sin@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sin@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sin@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$sinh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sinh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sinh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$sqrt@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$sqrt@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$sqrt@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$tan@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$tan@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$tan@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??$tanh@M@std@@YA?AV?$complex@M@0@ABV10@@Z
??$tanh@N@std@@YA?AV?$complex@N@0@ABV10@@Z
??$tanh@O@std@@YA?AV?$complex@O@0@ABV10@@Z
??0?$_Complex_base@MU_C_float_complex@@@std@@QAE@ABM0@Z
??0?$_Complex_base@NU_C_double_complex@@@std@@QAE@ABN0@Z
??0?$_Complex_base@OU_C_ldouble_complex@@@std@@QAE@ABO0@Z
??0?$_Mpunct@D@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@D@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@D@std@@QAE@I_N@Z
??0?$_Mpunct@G@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@G@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@G@std@@QAE@I_N@Z
??0?$_Mpunct@_W@std@@IAE@PBDI_N1@Z
??0?$_Mpunct@_W@std@@QAE@ABV_Locinfo@1@I_N1@Z
??0?$_Mpunct@_W@std@@QAE@I_N@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@QAE@ABV01@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@IAE@V?$allocator@G@1@@Z
??0?$_String_val@GV?$allocator@G@std@@@std@@QAE@ABV01@@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@QAE@ABV01@@Z
??0?$allocator@D@std@@QAE@ABV01@@Z
??0?$allocator@D@std@@QAE@XZ
??0?$allocator@G@std@@QAE@ABV01@@Z
??0?$allocator@G@std@@QAE@XZ
??0?$allocator@X@std@@QAE@ABV01@@Z
??0?$allocator@X@std@@QAE@XZ
??0?$allocator@_W@std@@QAE@ABV01@@Z
??0?$allocator@_W@std@@QAE@XZ
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_filebuf@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ifstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@XZ
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PAU_iobuf@@@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PBGHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@1@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@V?$_String_const_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@1@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@IIABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_WABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WIABV?$allocator@_W@1@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$codecvt@DDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@DDH@std@@QAE@I@Z
??0?$codecvt@GDH@std@@IAE@PBDI@Z
??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@GDH@std@@QAE@I@Z
??0?$codecvt@_WDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
??0?$collate@D@std@@IAE@PBDI@Z
??0?$collate@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@D@std@@QAE@I@Z
??0?$collate@G@std@@IAE@PBDI@Z
??0?$collate@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@G@std@@QAE@I@Z
??0?$collate@_W@std@@IAE@PBDI@Z
??0?$collate@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$collate@_W@std@@QAE@I@Z
??0?$complex@M@std@@QAE@ABM0@Z
??0?$complex@M@std@@QAE@ABU_C_double_complex@@@Z
??0?$complex@M@std@@QAE@ABU_C_float_complex@@@Z
??0?$complex@M@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@M@std@@QAE@ABV?$complex@N@1@@Z
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@N@std@@QAE@ABN0@Z
??0?$complex@N@std@@QAE@ABU_C_double_complex@@@Z
??0?$complex@N@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@N@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@N@std@@QAE@ABV?$complex@O@1@@Z
??0?$complex@O@std@@QAE@ABO0@Z
??0?$complex@O@std@@QAE@ABU_C_ldouble_complex@@@Z
??0?$complex@O@std@@QAE@ABV?$complex@M@1@@Z
??0?$complex@O@std@@QAE@ABV?$complex@N@1@@Z
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@D@std@@QAE@PBF_NI@Z
??0?$ctype@G@std@@IAE@PBDI@Z
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@G@std@@QAE@I@Z
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$ctype@_W@std@@QAE@I@Z
??0?$messages@D@std@@IAE@PBDI@Z
??0?$messages@D@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@D@std@@QAE@I@Z
??0?$messages@G@std@@IAE@PBDI@Z
??0?$messages@G@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@G@std@@QAE@I@Z
??0?$messages@_W@std@@IAE@PBDI@Z
??0?$messages@_W@std@@QAE@ABV_Locinfo@1@I@Z
??0?$messages@_W@std@@QAE@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z
??0?$moneypunct@D$00@std@@IAE@PBDI@Z
??0?$moneypunct@D$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@D$00@std@@QAE@I@Z
??0?$moneypunct@D$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@D$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@D$0A@@std@@QAE@I@Z
??0?$moneypunct@G$00@std@@IAE@PBDI@Z
??0?$moneypunct@G$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@G$00@std@@QAE@I@Z
??0?$moneypunct@G$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@G$0A@@std@@QAE@I@Z
??0?$moneypunct@_W$00@std@@IAE@PBDI@Z
??0?$moneypunct@_W$00@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@_W$00@std@@QAE@I@Z
??0?$moneypunct@_W$0A@@std@@IAE@PBDI@Z
??0?$moneypunct@_W$0A@@std@@QAE@ABV_Locinfo@1@I_N@Z
??0?$moneypunct@_W$0A@@std@@QAE@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z

Sections

.text
Size: 521KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.VC90.CRT/msvcr90.dll
.dll windows:5 windows x86 arch:x86

0fda4497453286b1daa098623dfc53ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:a2:0c:d7:08:3c:6d:9c:9c:e7:11:07:12:85:b9:f7:4e:10:16:d8
Signer

Actual PE Digest

4e:a2:0c:d7:08:3c:6d:9c:9c:e7:11:07:12:85:b9:f7:4e:10:16:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetLongPathNameW
GetCurrentThreadId
TlsGetValue
DebugBreak
OutputDebugStringA
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapSize
HeapReAlloc
VirtualAlloc
HeapValidate
HeapCompact
HeapWalk
VirtualProtect
GetSystemInfo
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
CreateFileA
FlushFileBuffers
CreatePipe
CreateFileW
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetEndOfFile
GetFileInformationByHandle
PeekNamedPipe
InterlockedExchange
LockFile
UnlockFile
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetStringTypeA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
GetLocaleInfoW
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
GetModuleHandleA

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_amblksiz
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_sbh_threshold
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32

Sections

.text
Size: 598KB - Virtual size: 598KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NPSWF32.dll
.dll regsvr32 windows:5 windows x86 arch:x86

487a7da859ea36f81e666d2e27cf55f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

69:ce:b3:25:07:6b:6e:7e:d3:70:7c:9c:9a:a7:63:6d:b0:bb:0b:d7
Signer

Actual PE Digest

69:ce:b3:25:07:6b:6e:7e:d3:70:7c:9c:9a:a7:63:6d:b0:bb:0b:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeGetTime
waveInStop
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeKillEvent
waveOutGetPosition
timeSetEvent
waveInOpen
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose

wininet

InternetSetOptionW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpOpenRequestA
InternetConnectA
InternetOpenA

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext
CryptVerifyMessageSignature
CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertCloseStore

rpcrt4

RpcStringFreeA
UuidToStringA

oleaut32

LoadRegTypeLi
UnRegisterTypeLi
SysFreeString
SysAllocString
SysStringLen
LoadTypeLi
RegisterTypeLi

urlmon

CopyStgMedium

dsound

ord8

kernel32

SystemTimeToFileTime
GetSystemTime
GetFileSizeEx
CreateFileW
GetFileAttributesW
CreateDirectoryW
WideCharToMultiByte
DeleteFileA
WriteFile
CreateFileA
GetTempFileNameA
GetCurrentDirectoryA
CreateDirectoryA
GetEnvironmentVariableA
GlobalFree
FreeLibrary
GetProcessTimes
GetCurrentProcess
GlobalUnlock
GlobalLock
GetCurrentProcessId
GlobalSize
GlobalAlloc
GetSystemInfo
GetModuleHandleW
GetUserDefaultUILanguage
MoveFileExW
VirtualQuery
GetUserDefaultLangID
GetVersionExA
SetFilePointer
VerifyVersionInfoW
VerSetConditionMask
CreateProcessA
CreateThread
ReadFile
GetFileSize
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
InterlockedIncrement
FindFirstFileW
GetTimeZoneInformation
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
GetTempPathA
GetFileAttributesA
CreateMutexA
SetFilePointerEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
OutputDebugStringA
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
RtlUnwind
ExitProcess
GetCommandLineA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
SetHandleCount
GetFileType
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
GetModuleFileNameA
FindResourceA
SizeofResource
LoadResource
LockResource
OpenFile
_lwrite
_lclose
FreeResource
LoadLibraryA
GetModuleFileNameW
lstrlenW
LCMapStringW
GetTickCount
GetModuleHandleA
GetCurrentThreadId
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetStartupInfoA
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
CompareStringW
GetCurrencyFormatW
GetNumberFormatW
VirtualFree
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleCP
GetConsoleMode
HeapCreate
HeapDestroy
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
FlushFileBuffers
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateSemaphoreA
WriteConsoleW
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
TlsAlloc
SwitchToThread
DeviceIoControl
GetVersion
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
InterlockedDecrement
CreateEventA

user32

CreateCaret
ShowCaret
DestroyCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
IsWindow
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
InsertMenuItemW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
WaitForInputIdle
GetForegroundWindow
MessageBoxA
DialogBoxParamW
SetWindowTextA
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
GetDlgItem
SetWindowTextW
SendMessageTimeoutW
CreateIconIndirect
SetRectEmpty
GetCursor
DestroyIcon
LoadImageW
GetPropW
SetPropW
SetCaretPos
GetClipboardFormatNameA
RegisterClipboardFormatA
CreateWindowExW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
SetCapture
ReleaseCapture
GetSubMenu
SystemParametersInfoW
ScreenToClient
GetCapture
GetCursorPos
WindowFromPoint
GetParent
PeekMessageW
GetQueueStatus
KillTimer
SetTimer
IsWindowVisible
PostMessageW
SendMessageW
LoadIconW
RegisterClassW
GetFocus
GetTopWindow
GetKeyState
InvalidateRect
LoadCursorW
SetCursor
LoadStringW
MessageBoxW
SetWindowLongW
EnableMenuItem
CheckMenuItem
BeginPaint
GetClientRect
EndPaint
UnregisterClassA
SetFocus
MoveWindow
EnumDisplaySettingsW
GetSystemMetrics
GetWindowInfo
CopyRect
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
MapWindowPoints
RegisterClassA
PostMessageA
RegisterWindowMessageA
SendNotifyMessageW
GetWindowThreadProcessId

gdi32

StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetClipBox
GetSystemPaletteEntries
Rectangle
GetStockObject
StretchDIBits
LPtoDP
RectVisible
CreateSolidBrush
SetBkColor
ExtTextOutW
SelectPalette
RealizePalette
SelectObject
BitBlt
CreateDIBSection
GetICMProfileA
CreateDCA
SetPixel
DeleteDC
CreateCompatibleBitmap
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutA
SetTextColor
GetObjectW
GetDeviceCaps
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
GetDIBits
DeleteObject
CreateFontIndirectW
GdiFlush
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
GetFontData
EnumFontFamiliesExW
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
CreateBitmap
StartPage
EndPage

comdlg32

GetOpenFileNameW
CommDlgExtendedError
PrintDlgW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegOpenKeyA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
SHGetFolderPathW
SHFileOperationW
SHGetDiskFreeSpaceExW

ole32

OleFlushClipboard
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
PropVariantClear
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize

mscms

CloseColorProfile
CreateColorTransformW
OpenColorProfileW
TranslateBitmapBits
DeleteColorTransform

ws2_32

inet_addr
WSACleanup
closesocket
WSAAsyncSelect
WSAGetLastError
WSAIoctl
socket
WSAStartup
setsockopt
recv
send
ntohs
getsockname
htons
WSACloseEvent
gethostbyname
inet_ntoa
htonl
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
recvfrom
WSASetLastError
getservbyport
gethostbyaddr
WSASocketW
getservbyname

Exports

Exports

BrokerMainW
DllRegisterServer
DllUnregisterServer
FlashPlayer_10_3_181_22_FlashPlayer
Flash_DisableLocalSecurity
Flash_EnforceLocalSecurity
Java_ShockwaveFlash_CurrentFrame_stub
Java_ShockwaveFlash_FlashVersion_stub
Java_ShockwaveFlash_FrameLoaded_stub
Java_ShockwaveFlash_GetVariable_stub
Java_ShockwaveFlash_GotoFrame_stub
Java_ShockwaveFlash_IsPlaying_stub
Java_ShockwaveFlash_LoadMovie_stub
Java_ShockwaveFlash_Pan_stub
Java_ShockwaveFlash_PercentLoaded_stub
Java_ShockwaveFlash_Play_stub
Java_ShockwaveFlash_SetVariable_stub
Java_ShockwaveFlash_SetZoomRect_stub
Java_ShockwaveFlash_StopPlay_stub
Java_ShockwaveFlash_TCallFrame_stub
Java_ShockwaveFlash_TCallLabel_stub
Java_ShockwaveFlash_TCurrentFrame_stub
Java_ShockwaveFlash_TCurrentLabel_stub
Java_ShockwaveFlash_TGetProperty_stub
Java_ShockwaveFlash_TGotoFrame_stub
Java_ShockwaveFlash_TGotoLabel_stub
Java_ShockwaveFlash_TPlay_stub
Java_ShockwaveFlash_TSetProperty_stub
Java_ShockwaveFlash_TStopPlay_stub
Java_ShockwaveFlash_TotalFrames_stub
Java_ShockwaveFlash_Zoom_stub
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
native_ShockwaveFlash_CurrentFrame
native_ShockwaveFlash_FlashVersion
native_ShockwaveFlash_FrameLoaded
native_ShockwaveFlash_GetVariable
native_ShockwaveFlash_GotoFrame
native_ShockwaveFlash_IsPlaying
native_ShockwaveFlash_LoadMovie
native_ShockwaveFlash_Pan
native_ShockwaveFlash_PercentLoaded
native_ShockwaveFlash_Play
native_ShockwaveFlash_SetVariable
native_ShockwaveFlash_SetZoomRect
native_ShockwaveFlash_StopPlay
native_ShockwaveFlash_TCallFrame
native_ShockwaveFlash_TCallLabel
native_ShockwaveFlash_TCurrentFrame
native_ShockwaveFlash_TCurrentLabel
native_ShockwaveFlash_TGetProperty
native_ShockwaveFlash_TGotoFrame
native_ShockwaveFlash_TGotoLabel
native_ShockwaveFlash_TPlay
native_ShockwaveFlash_TSetProperty
native_ShockwaveFlash_TStopPlay
native_ShockwaveFlash_TotalFrames
native_ShockwaveFlash_Zoom
register_ShockwaveFlash
unregister_ShockwaveFlash
unuse_ShockwaveFlash
unuse_netscape_plugin_Plugin
use_ShockwaveFlash
use_netscape_plugin_Plugin

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PDAppFlex-app.xml
.xml
PDAppFlex.swf
PDapp.exe
.exe windows:5 windows x86 arch:x86

ab97f8a160b2fe0cd9d6d6814cb87af6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:3a:d5:78:c4:8f:14:a6:68:68:5b:00:0f:57:44:2a:7e:48:58:93
Signer

Actual PE Digest

46:3a:d5:78:c4:8f:14:a6:68:68:5b:00:0f:57:44:2a:7e:48:58:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

adbeape

APEPlayerChangeAttributes
APEPlayerLoadComponent
APEPlayerCallExternalInterface
APEInitialize
APETerminate
APEPlayerFromStageHWND

user32

PostMessageW
CallWindowProcW
SetPropA
DefWindowProcW
GetWindowLongW
PostThreadMessageW
TranslateMessage
DispatchMessageW
GetMessageW
EnableMenuItem
GetClientRect
MoveWindow
SetWindowTextW
GetSystemMenu
DialogBoxParamW
PostQuitMessage
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetWindowTextLengthW
UnhookWindowsHookEx
GetSysColor
GetSysColorBrush
EnableWindow
IsWindowEnabled
GetWindowThreadProcessId
GetLastActivePopup
SetScrollPos
GetScrollPos
GetWindow
IsWindow
CheckDlgButton
GetDlgCtrlID
GetFocus
IsDialogMessageW
PtInRect
GetClassNameW
RealChildWindowFromPoint
DestroyIcon
CharUpperW
PeekMessageW
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
BeginPaint
EndPaint
ScreenToClient
FillRect
GetMessagePos
GetMessageTime
RegisterClassW
GetClassInfoW
GetClassInfoExW
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetCapture
GetMenu
SetMenu
TrackPopupMenu
UpdateWindow
SetActiveWindow
GetForegroundWindow
RedrawWindow
ScrollWindow
SetScrollRange
GetScrollRange
SetFocus
SetPropW
GetPropW
RemovePropW
AdjustWindowRectEx
MapWindowPoints
CopyRect
EqualRect
GetClassLongW
GetTopWindow
SetScrollInfo
GetScrollInfo
WinHelpW
GetWindowRect
GetMonitorInfoW
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
InflateRect
IntersectRect
DestroyMenu
GetMenuItemInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
CreateDialogIndirectParamW
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
ShowOwnedPopups
DeleteMenu
SetTimer
KillTimer
InvalidateRect
TrackMouseEvent
LoadImageW
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
IsWindowVisible
GetPropA
ClientToScreen
SetWindowPos
LoadCursorW
SetCursor
SetWindowLongW
IsZoomed
SystemParametersInfoW
GetParent
RegisterWindowMessageW
SetForegroundWindow
GetAncestor
IsIconic
GetWindowTextW
wsprintfW
CreateWindowExW
GetSystemMetrics
GetActiveWindow
ShowWindow
SetClassLongW
MonitorFromWindow
ShowScrollBar
GetDlgItem
LoadIconW
RegisterClassExW
GetDC
ReleaseDC
GetDesktopWindow
DestroyWindow
MessageBoxW
EnumChildWindows
SendMessageW
EndDialog
MessageBeep

gdi32

SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
GetStockObject
GetDeviceCaps
PtVisible
SetTextAlign
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreateHatchBrush
CreateCompatibleDC
CreateBitmap
BitBlt
DeleteObject
CreateDCW
CopyMetaFileW
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
OffsetRgn
RoundRect
FillRgn
GetSystemPaletteEntries
GetObjectW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePen

wininet

InternetGetConnectedState
InternetCheckConnectionW

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
OleInitialize
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoTaskMemFree

oleaut32

LoadTypeLi
VarBstrFromDate
GetErrorInfo
SysAllocString
VariantClear
VariantChangeType
SysStringLen
VariantCopy
VariantTimeToSystemTime
VariantInit
SysFreeString
SystemTimeToVariantTime
SysAllocStringLen

kernel32

RtlUnwind
HeapQueryInformation
InitializeCriticalSectionAndSpinCount
GetTempPathW
ReadFile
FindFirstFileW
SetLastError
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
GetUserDefaultUILanguage
CreateMutexW
FindClose
WaitForSingleObject
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
SetFileAttributesW
CreateEventW
MultiByteToWideChar
Sleep
GetLastError
SetEvent
DeleteFileW
CloseHandle
RaiseException
ResetEvent
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
DeleteCriticalSection
CreateProcessW
GetModuleHandleW
CopyFileW
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateThread
GetCurrentThreadId
GetCommandLineW
CreateNamedPipeW
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
WriteProcessMemory
ResumeThread
DuplicateHandle
VirtualProtectEx
GetThreadContext
SetCurrentDirectoryW
ExitProcess
FlushInstructionCache
SetThreadContext
GetUserDefaultLangID
LoadLibraryW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
OpenSemaphoreW
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
TerminateThread
GetTimeZoneInformation
GetFileSizeEx
SetFilePointer
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
LoadResource
LockResource
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
FindResourceW
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OutputDebugStringA
GetModuleHandleA
lstrcmpA
GlobalGetAtomNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GlobalFlags
GlobalAddAtomW
GetFullPathNameW
GetVolumeInformationW
LockFile
SetEndOfFile
UnlockFile
LoadLibraryExW
LoadLibraryA
EncodePointer
GetSystemDirectoryW
CompareStringW
GetLocaleInfoW
SetThreadPriority
FreeResource
GlobalDeleteAtom
GlobalFindAtomW
GetFileAttributesExW
GetFileTime
VirtualProtect
GetCurrentDirectoryW
lstrcpyW
FindResourceExW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
GetTickCount
GetProfileIntW
SearchPathW
GetUserDefaultLCID
GetStringTypeW
GetSystemTimeAsFileTime
LCMapStringW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualQuery
QueryPerformanceFrequency
SetStdHandle
GetFileType
GetStdHandle
GetACP
InterlockedPushEntrySList
IsDBCSLeadByteEx
SizeofResource
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetDriveTypeW
FindFirstFileExW
IsValidCodePage
WaitForMultipleObjects
GetOEMCP
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW

advapi32

InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
SystemFunction036

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetSpecialFolderLocation
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHCreateDirectoryExW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
SHGetDesktopFolder
CommandLineToArgvW

shlwapi

PathStripToRootW
PathIsUNCW
PathRenameExtensionW
PathAppendW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
StrRChrW
PathRemoveBackslashW
PathSearchAndQualifyW
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
StrFormatKBSizeW
PathFindFileNameW
PathRemoveFileSpecW

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

uxtheme

GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
DrawThemeText
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
CloseThemeData
DrawThemeBackground
OpenThemeData

crypt32

CertGetNameStringW
CertGetIssuerCertificateFromStore

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

winhttp

WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpSetCredentials
WinHttpSendRequest
WinHttpQueryOption
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetStatusCallback

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RemoveAAM.bin
.exe windows:5 windows x86 arch:x86

84fc0f1ce141a5e46be754473fce3a4d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e3:2d:4e:7e:0a:85:82:59:cd:22:90:42:6c:62:0f:74:4a:28:16:ca
Signer

Actual PE Digest

e3:2d:4e:7e:0a:85:82:59:cd:22:90:42:6c:62:0f:74:4a:28:16:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
GetTempPathW
MultiByteToWideChar
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
WriteProcessMemory
GetCurrentProcess
ResumeThread
DuplicateHandle
DeleteFileW
GetCurrentDirectoryW
VirtualProtectEx
GetThreadContext
GetLastError
CreateProcessW
FlushInstructionCache
SetThreadContext
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSizeEx
GetLocalTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
OpenMutexW
WriteConsoleW
SetEndOfFile
Sleep
ReleaseMutex
WaitForSingleObject
CreateMutexW
ExitProcess
HeapSize
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RaiseException
RtlUnwind
LoadLibraryExW
MoveFileExW
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapFree
GetModuleHandleExW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
ReleaseSemaphore

advapi32

SystemFunction036

shell32

SHCreateDirectoryExW

shlwapi

PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathRenameExtensionW
PathFindFileNameW

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebKit.dll
.dll windows:5 windows x86 arch:x86

206c25a211dd5cd38cac65bb90bae21c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:da:32:0b:0c:59:22:4c:0b:41:b1:6d:6b:cd:38:7e:c9:ad:fb:08
Signer

Actual PE Digest

99:da:32:0b:0c:59:22:4c:0b:41:b1:6d:6b:cd:38:7e:c9:ad:fb:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleW
GetConsoleCP
GetConsoleMode
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
GetFullPathNameW
FlushFileBuffers
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetModuleFileNameA
GetStdHandle
GetFileType
SetStdHandle
CreateDirectoryA
FindFirstFileW
GetDriveTypeW
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
GetDateFormatA
GetTimeFormatA
LoadLibraryA
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetTimeZoneInformation
HeapReAlloc
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
FormatMessageW
LocalFree
GetFileAttributesA
GetVersionExW
GetLocaleInfoW
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryExW
FreeLibrary
LCMapStringW
GetFileAttributesExW
GetModuleHandleA
GetProcAddress
VirtualProtect
CreateFileW
GetFileSize
ReadFile
FoldStringW
InterlockedIncrement
GetCurrentThread
GetThreadTimes
GetSystemInfo
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileA
CreateFileA
SetFilePointer
WriteFile
CloseHandle
VirtualAlloc
VirtualFree
InterlockedDecrement
GetTickCount
IsValidCodePage
CompareStringW

user32

GetFocus
IsChild
GetWindowLongW
SetWindowLongW
GetKeyboardState
SetKeyboardState
ReleaseCapture
SetCapture
CallWindowProcW
SetParent
CreateWindowExW
DefWindowProcA
SetWindowLongA
SetPropW
DestroyWindow
GetWindowRect
SystemParametersInfoW
SetWindowRgn
MoveWindow
UpdateWindow
ShowWindow
SetFocus
GetUpdateRect
IntersectRect
EqualRect
GetWindowRgn
DefWindowProcW
LoadCursorW
RegisterClassExW
GetLastInputInfo
ReleaseDC
GetDC
InvalidateRect
GetPropW
GetClientRect
FillRect
ClientToScreen
PostMessageW

gdi32

DeleteDC
GetDeviceCaps
GetFontData
GetGlyphIndicesW
AddFontMemResourceEx
GetCharWidthI
GetTextMetricsW
GetOutlineTextMetricsW
GetGlyphOutlineW
CreateEnhMetaFileW
CloseEnhMetaFile
EnumEnhMetaFile
DeleteEnhMetaFile
GetFontUnicodeRanges
EnumFontFamiliesExW
SelectObject
GetTextFaceW
CreateFontIndirectW
RemoveFontMemResourceEx
IntersectClipRect
ModifyWorldTransform
RestoreDC
SaveDC
GetObjectW
SetGraphicsMode
GetWorldTransform
SetWorldTransform
GetClipBox
CreateRectRgn
GetRgnBox
DeleteObject
BitBlt
GdiFlush
SetStretchBltMode
StretchDIBits
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateSolidBrush
ExtTextOutW
SetBkMode
SetTextAlign
SetTextColor
GetClipRgn
GetGraphicsMode
SelectClipRgn
ExtSelectClipRgn
ExtCreateRegion
CreateCompatibleBitmap
GetStockObject
SetMapMode
GetCharWidth32W
ExtEscape
SelectClipPath
EndPath
CloseFigure
MoveToEx
BeginPath
LineTo
PolyBezierTo
SetPolyFillMode
WidenPath
StrokePath
ExtCreatePen
SetMiterLimit
FillPath
StretchBlt
CreateCompatibleDC
CreateDIBSection

usp10

ScriptStringFree
ScriptStringOut
ScriptStringAnalyse
ScriptShape
ScriptXtoCP
ScriptPlace
ScriptItemize
ScriptFreeCache

urlmon

FindMimeFromData

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msimg32

GradientFill

winmm

timeEndPeriod
timeBeginPeriod

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoCreateInstance
CoTaskMemFree
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

Exports

Exports

WebKitGetAPI
cairo_append_path
cairo_arc
cairo_arc_negative
cairo_clip
cairo_clip_extents
cairo_clip_preserve
cairo_close_path
cairo_copy_clip_rectangle_list
cairo_copy_page
cairo_copy_path
cairo_copy_path_flat
cairo_create
cairo_curve_to
cairo_destroy
cairo_device_to_user
cairo_device_to_user_distance
cairo_fill
cairo_fill_extents
cairo_fill_preserve
cairo_font_extents
cairo_font_face_destroy
cairo_font_face_get_reference_count
cairo_font_face_get_type
cairo_font_face_get_user_data
cairo_font_face_reference
cairo_font_face_set_user_data
cairo_font_face_status
cairo_font_options_copy
cairo_font_options_create
cairo_font_options_destroy
cairo_font_options_equal
cairo_font_options_get_antialias
cairo_font_options_get_hint_metrics
cairo_font_options_get_hint_style
cairo_font_options_get_subpixel_order
cairo_font_options_hash
cairo_font_options_merge
cairo_font_options_set_antialias
cairo_font_options_set_hint_metrics
cairo_font_options_set_hint_style
cairo_font_options_set_subpixel_order
cairo_font_options_status
cairo_format_stride_for_width
cairo_get_antialias
cairo_get_current_point
cairo_get_dash
cairo_get_dash_count
cairo_get_fill_rule
cairo_get_font_face
cairo_get_font_matrix
cairo_get_font_options
cairo_get_group_target
cairo_get_line_cap
cairo_get_line_join
cairo_get_line_width
cairo_get_matrix
cairo_get_miter_limit
cairo_get_operator
cairo_get_reference_count
cairo_get_scaled_font
cairo_get_source
cairo_get_target
cairo_get_tolerance
cairo_get_user_data
cairo_glyph_allocate
cairo_glyph_extents
cairo_glyph_free
cairo_glyph_path
cairo_has_current_point
cairo_identity_matrix
cairo_image_surface_create
cairo_image_surface_create_for_data
cairo_image_surface_create_from_png
cairo_image_surface_create_from_png_stream
cairo_image_surface_get_data
cairo_image_surface_get_format
cairo_image_surface_get_height
cairo_image_surface_get_stride
cairo_image_surface_get_width
cairo_in_fill
cairo_in_stroke
cairo_line_to
cairo_mask
cairo_mask_surface
cairo_matrix_init
cairo_matrix_init_identity
cairo_matrix_init_rotate
cairo_matrix_init_scale
cairo_matrix_init_translate
cairo_matrix_invert
cairo_matrix_multiply
cairo_matrix_rotate
cairo_matrix_scale
cairo_matrix_transform_distance
cairo_matrix_transform_point
cairo_matrix_translate
cairo_move_to
cairo_new_path
cairo_new_sub_path
cairo_paint
cairo_paint_with_alpha
cairo_path_destroy
cairo_path_extents
cairo_pattern_add_color_stop_rgb
cairo_pattern_add_color_stop_rgba
cairo_pattern_create_for_surface
cairo_pattern_create_linear
cairo_pattern_create_radial
cairo_pattern_create_rgb
cairo_pattern_create_rgba
cairo_pattern_destroy
cairo_pattern_get_color_stop_count
cairo_pattern_get_color_stop_rgba
cairo_pattern_get_extend
cairo_pattern_get_filter
cairo_pattern_get_linear_points
cairo_pattern_get_matrix
cairo_pattern_get_radial_circles
cairo_pattern_get_reference_count
cairo_pattern_get_rgba
cairo_pattern_get_surface
cairo_pattern_get_type
cairo_pattern_get_user_data
cairo_pattern_reference
cairo_pattern_set_extend
cairo_pattern_set_filter
cairo_pattern_set_matrix
cairo_pattern_set_user_data
cairo_pattern_status
cairo_pop_group
cairo_pop_group_to_source
cairo_push_group
cairo_push_group_with_content
cairo_rectangle
cairo_rectangle_list_destroy
cairo_reference
cairo_rel_curve_to
cairo_rel_line_to
cairo_rel_move_to
cairo_reset_clip
cairo_restore
cairo_rotate
cairo_save
cairo_scale
cairo_scaled_font_create
cairo_scaled_font_destroy
cairo_scaled_font_extents
cairo_scaled_font_get_ctm
cairo_scaled_font_get_font_face
cairo_scaled_font_get_font_matrix
cairo_scaled_font_get_font_options
cairo_scaled_font_get_reference_count
cairo_scaled_font_get_scale_matrix
cairo_scaled_font_get_type
cairo_scaled_font_get_user_data
cairo_scaled_font_glyph_extents
cairo_scaled_font_reference
cairo_scaled_font_set_user_data
cairo_scaled_font_status
cairo_scaled_font_text_extents
cairo_scaled_font_text_to_glyphs
cairo_select_font_face
cairo_set_antialias
cairo_set_dash
cairo_set_fill_rule
cairo_set_font_face
cairo_set_font_matrix
cairo_set_font_options
cairo_set_font_size
cairo_set_line_cap
cairo_set_line_join
cairo_set_line_width
cairo_set_matrix
cairo_set_miter_limit
cairo_set_operator
cairo_set_scaled_font
cairo_set_source
cairo_set_source_rgb
cairo_set_source_rgba
cairo_set_source_surface
cairo_set_tolerance
cairo_set_user_data
cairo_show_glyphs
cairo_show_page
cairo_show_text
cairo_show_text_glyphs
cairo_status
cairo_status_to_string
cairo_stroke
cairo_stroke_extents
cairo_stroke_preserve
cairo_surface_copy_page
cairo_surface_create_similar
cairo_surface_destroy
cairo_surface_finish
cairo_surface_flush
cairo_surface_get_content
cairo_surface_get_device_offset
cairo_surface_get_fallback_resolution
cairo_surface_get_font_options
cairo_surface_get_reference_count
cairo_surface_get_type
cairo_surface_get_user_data
cairo_surface_has_show_text_glyphs
cairo_surface_mark_dirty
cairo_surface_mark_dirty_rectangle
cairo_surface_reference
cairo_surface_set_device_offset
cairo_surface_set_fallback_resolution
cairo_surface_set_user_data
cairo_surface_show_page
cairo_surface_status
cairo_surface_write_to_png
cairo_surface_write_to_png_stream
cairo_text_cluster_allocate
cairo_text_cluster_free
cairo_text_extents
cairo_text_path
cairo_toy_font_face_create
cairo_toy_font_face_get_family
cairo_toy_font_face_get_slant
cairo_toy_font_face_get_weight
cairo_transform
cairo_translate
cairo_user_font_face_create
cairo_user_font_face_get_init_func
cairo_user_font_face_get_render_glyph_func
cairo_user_font_face_get_text_to_glyphs_func
cairo_user_font_face_get_unicode_to_glyph_func
cairo_user_font_face_set_init_func
cairo_user_font_face_set_render_glyph_func
cairo_user_font_face_set_text_to_glyphs_func
cairo_user_font_face_set_unicode_to_glyph_func
cairo_user_to_device
cairo_user_to_device_distance
cairo_version
cairo_version_string
cairo_win32_font_face_create_for_hfont
cairo_win32_font_face_create_for_logfontw
cairo_win32_font_face_create_for_logfontw_hfont
cairo_win32_printing_surface_create
cairo_win32_scaled_font_done_font
cairo_win32_scaled_font_get_device_to_logical
cairo_win32_scaled_font_get_logical_to_device
cairo_win32_scaled_font_get_metrics_factor
cairo_win32_scaled_font_select_font
cairo_win32_surface_create
cairo_win32_surface_create_with_ddb
cairo_win32_surface_create_with_dib
cairo_win32_surface_get_dc
cairo_win32_surface_get_image

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 675KB - Virtual size: 674KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.unwante
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ZStringResources/cs_CZ/stringtable.xml
.xml .vbs polyglot
ZStringResources/da_DK/stringtable.xml
.xml .vbs polyglot
ZStringResources/de_DE/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_AE/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_GB/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_IL/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_US/stringtable.xml
.xml .vbs polyglot
ZStringResources/en_XM/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_ES/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_LA/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_MX/stringtable.xml
.xml .vbs polyglot
ZStringResources/es_NA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fi_FI/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_CA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_FR/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_MA/stringtable.xml
.xml .vbs polyglot
ZStringResources/fr_XM/stringtable.xml
.xml .vbs polyglot
ZStringResources/hu_HU/stringtable.xml
.xml .vbs polyglot
ZStringResources/it_IT/stringtable.xml
.xml .vbs polyglot
ZStringResources/ja_JP/stringtable.xml
.xml .vbs polyglot
ZStringResources/ko_KR/stringtable.xml
.xml .vbs polyglot
ZStringResources/nb_NO/stringtable.xml
.xml .vbs polyglot
ZStringResources/nl_NL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pl_PL/stringtable.xml
.xml .vbs polyglot
ZStringResources/pt_BR/stringtable.xml
.xml .vbs polyglot
ZStringResources/ro_RO/stringtable.xml
.xml .vbs polyglot
ZStringResources/ru_RU/stringtable.xml
.xml .vbs polyglot
ZStringResources/sv_SE/stringtable.xml
.xml .vbs polyglot
ZStringResources/tr_TR/stringtable.xml
.xml .vbs polyglot
ZStringResources/uk_UA/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_CN/stringtable.xml
.xml .vbs polyglot
ZStringResources/zh_TW/stringtable.xml
.xml .vbs polyglot
adbeape.dll
.dll windows:5 windows x86 arch:x86

ed704381e719a67092c3315a8f25cb3c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

be:02:6f:ac:7b:d6:3c:25:9f:86:0e:69:fe:ee:9a:45:2b:f6:6b:ff
Signer

Actual PE Digest

be:02:6f:ac:7b:d6:3c:25:9f:86:0e:69:fe:ee:9a:45:2b:f6:6b:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

shell32

SHGetFolderPathW

msvcr90

__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
??2@YAPAXI@Z
memset
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
memmove_s
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
strlen

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

APEAtomCoerce
APEAtomFromBool
APEAtomFromDouble
APEAtomFromHostObject
APEAtomFromInt32
APEAtomFromUTF16
APEAtomFromUTF8
APEAtomGetCanonical
APEAtomGetKind
APEAtomIsNull
APEAtomToBool
APEAtomToDouble
APEAtomToHostObject
APEAtomToInt32
APEAtomToUTF16
APEAtomToUTF8
APEAtomWatch
APEByteArrayCreate
APEByteArrayGetBuffer
APEChangeLogLevel
APEGetBuildBranch
APEGetBuildDate
APEGetBuildVersion
APEGetLogLevel
APEGetVersion
APEInitialize
APEObjectAddEventListener
APEObjectCreate
APEObjectDeleteProperty
APEObjectDisconnect
APEObjectEnumerate
APEObjectGetClassName
APEObjectGetClassObject
APEObjectGetProperty
APEObjectGetPropertyFlags
APEObjectGetRoot
APEObjectInvokeMethod
APEObjectLock
APEObjectPutProperty
APEObjectRemoveEventListener
APEPlayerAddPluginObjectModel
APEPlayerCallExternalInterface
APEPlayerChangeAttributes
APEPlayerDisconnectObjectModelExtension
APEPlayerExtendObjectModel
APEPlayerFromStageHWND
APEPlayerGetAttributes
APEPlayerInstallComponent
APEPlayerLoadComponent
APEPlayerLoadContent
APEPlayerLoadSWF
APEPlayerRetrieveException
APEPlayerSetException
APEPlayerSetStandardException
APEPlayerSuspendResumeAtomCacheFlushing
APERegisterMemoryStatusCallback
APEStreamClose
APEStreamWrite
APETerminate
APEUnregisterMemoryStatusCallback
APEYieldToRuntime

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adbeapecore.dll
.dll windows:5 windows x86 arch:x86

bf5478708c7bfbe7f773b159b1fee879

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f0:85:05:1c:e1:75:29:f6:4e:f4:b6:62:0a:cf:a2:64:d4:fd:f9:c0
Signer

Actual PE Digest

f0:85:05:1c:e1:75:29:f6:4e:f4:b6:62:0a:cf:a2:64:d4:fd:f9:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdiplus

GdipGraphicsClear
GdipDeleteGraphics
GdipCreateFromHDC

kernel32

GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
VerSetConditionMask
VerifyVersionInfoW
GetLastError
GetModuleHandleW
LoadLibraryW
GetSystemDirectoryW
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
SetLastError
GlobalLock
GlobalUnlock
GetModuleFileNameW
lstrlenW
FreeLibrary
TerminateProcess
InterlockedCompareExchange
Sleep
RaiseException
LoadLibraryA
InterlockedExchange
LocalAlloc
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
UnhandledExceptionFilter

user32

TranslateMessage
DispatchMessageW
GetKeyState
DestroyWindow
RegisterWindowMessageW
DeleteMenu
GetSystemMenu
LoadCursorW
FlashWindowEx
IsIconic
IsZoomed
IsWindowVisible
GetActiveWindow
SetWindowTextW
GetWindowTextW
MoveWindow
WindowFromPoint
TrackMouseEvent
SetRectEmpty
InvalidateRect
SetCapture
GetMessageTime
ReleaseDC
GetDC
ReleaseCapture
UnregisterClassW
RegisterClassExW
GetClassInfoExW
IsRectEmpty
EndPaint
BeginPaint
RegisterClipboardFormatW
RemovePropA
SetPropA
SetWindowPos
GetAncestor
GetCapture
ShowWindow
GetCursorPos
GetWindowThreadProcessId
CallWindowProcW
GetClientRect
ScreenToClient
ClientToScreen
PostMessageW
GetParent
SetFocus
GetFocus
SetWindowLongW
GetWindowRect
SendMessageW
GetWindowLongW
GetPropA
SetTimer
KillTimer
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW

gdi32

DeleteObject
GetStockObject
SetICMMode
CreateDIBSection

ole32

ReleaseStgMedium
OleInitialize
OleUninitialize
CoCreateInstance
RevokeDragDrop
RegisterDragDrop
DoDragDrop

msvcp90

?allocate@?$allocator@G@std@@QAEPAGI@Z
?deallocate@?$allocator@G@std@@QAEXPAGI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

msvcr90

??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBDH@Z
wcslen
??0exception@std@@QAE@XZ
_purecall
memset
memcmp
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
wcscmp
floor
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
ceil
wcscpy_s
??_V@YAXPAX@Z
__RTDynamicCast
??8type_info@@QBE_NABV0@@Z
malloc
free
strcpy_s
strlen
memcpy
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_CxxThrowException
memmove_s

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z
APEAtomCoerce
APEAtomFromBool
APEAtomFromDouble
APEAtomFromHostObject
APEAtomFromInt32
APEAtomFromUTF16
APEAtomFromUTF8
APEAtomGetCanonical
APEAtomGetKind
APEAtomIsNull
APEAtomToBool
APEAtomToDouble
APEAtomToHostObject
APEAtomToInt32
APEAtomToUTF16
APEAtomToUTF8
APEAtomWatch
APEByteArrayCreate
APEByteArrayGetBuffer
APEChangeLogLevel
APEGetBuildBranch
APEGetBuildDate
APEGetBuildVersion
APEGetLogLevel
APEGetVersion
APEInitialize
APEObjectAddEventListener
APEObjectCreate
APEObjectDeleteProperty
APEObjectDisconnect
APEObjectEnumerate
APEObjectGetClassName
APEObjectGetClassObject
APEObjectGetProperty
APEObjectGetPropertyFlags
APEObjectGetRoot
APEObjectInvokeMethod
APEObjectLock
APEObjectPutProperty
APEObjectRemoveEventListener
APEPlayerAddPluginObjectModel
APEPlayerCallExternalInterface
APEPlayerChangeAttributes
APEPlayerDisconnectObjectModelExtension
APEPlayerExtendObjectModel
APEPlayerFromStageHWND
APEPlayerGetAttributes
APEPlayerInstallComponent
APEPlayerLoadComponent
APEPlayerLoadContent
APEPlayerLoadSWF
APEPlayerRetrieveException
APEPlayerSetException
APEPlayerSetStandardException
APEPlayerSuspendResumeAtomCacheFlushing
APERegisterMemoryStatusCallback
APEStreamClose
APEStreamWrite
APETerminate
APEUnregisterMemoryStatusCallback
APEYieldToRuntime
_DllMain@12

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adbeapeengine.dll
.dll regsvr32 windows:5 windows x86 arch:x86

5b0d2beb36df955f9267173534edeb7a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:50:44:ab:f0:c7:bc:8e:9c:f1:8f:2e:a6:48:4b:33:8b:2c:48:0f
Signer

Actual PE Digest

61:50:44:ab:f0:c7:bc:8e:9c:f1:8f:2e:a6:48:4b:33:8b:2c:48:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FormatMessageA
CreateEventA
ConnectNamedPipe
CreateNamedPipeA
FlushFileBuffers
AreFileApisANSI
UnlockFile
LockFile
LockFileEx
GetFullPathNameA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetNumberFormatW
GetCurrencyFormatW
GetDateFormatW
GetTimeFormatW
SizeofResource
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersionExA
GetVersion
SwitchToThread
SetNamedPipeHandleState
FileTimeToSystemTime
SetStdHandle
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
PeekNamedPipe
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetThreadAffinityMask
CreateFileMappingA
MapViewOfFile
ReleaseMutex
UnmapViewOfFile
CreateProcessW
GetModuleHandleA
SetHandleInformation
GetExitCodeProcess
GenerateConsoleCtrlEvent
GetProcessHeap
GetOverlappedResult
CancelIo
CreateNamedPipeW
DebugBreak
GetLocalTime
CreateSemaphoreW
ReleaseSemaphore
LocalFree
WaitForMultipleObjects
GetDriveTypeW
SetThreadPriority
ResetEvent
lstrlenA
lstrcpyA
GetSystemDirectoryA
CreateEventW
SetEvent
GetProcessTimes
TerminateThread
GetSystemTime
CompareFileTime
SetEndOfFile
GetFileSizeEx
SetFilePointerEx
CreateDirectoryW
GetTempPathA
GetTempFileNameA
OutputDebugStringA
DeviceIoControl
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetFullPathNameW
GetTempFileNameW
GetLongPathNameW
RemoveDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
GetVolumeInformationW
GetLogicalDriveStringsW
CreateMutexA
FormatMessageW
VirtualProtect
DeleteFileA
Sleep
CreateDirectoryA
GetFileAttributesA
lstrlenW
FlushInstructionCache
GetSystemDirectoryW
SleepEx
GetCurrentDirectoryW
SetCurrentDirectoryW
OpenThread
QueueUserAPC
GlobalSize
QueryPerformanceFrequency
GlobalLock
GlobalUnlock
IsDBCSLeadByte
GlobalAlloc
FindResourceExW
FindResourceExA
LoadResource
LockResource
CreateProcessA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSize
ReadFile
SetFilePointer
GetUserDefaultUILanguage
GetUserDefaultLangID
ExitThread
CreateThread
WaitForSingleObject
VirtualQuery
MoveFileExW
LoadLibraryW
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
CreateFileW
GetTempPathW
CloseHandle
GetVersionExW
GetSystemInfo
InitializeCriticalSection
RaiseException
GlobalFree
GetFileAttributesW
SystemTimeToFileTime
GetModuleFileNameW
IsProcessorFeaturePresent
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
LoadLibraryA
FreeLibrary
WriteFile
HeapReAlloc
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
HeapFree
GetCurrentThread
InterlockedDecrement
GetLastError
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
GetCommandLineA
GetCurrentThreadId
InterlockedExchange
InterlockedCompareExchange
EnumSystemLocalesW

oleaut32

UnRegisterTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
LoadTypeLi
RegisterTypeLi
SysFreeString

ole32

OleUninitialize
CoUninitialize
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
PropVariantClear
OleFlushClipboard
ReleaseStgMedium
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
OleInitialize
CreateBindCtx
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize

oleacc

AccessibleObjectFromWindow

shell32

SHGetFolderPathA
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
SHBrowseForFolderW
ord4
ord2
ShellExecuteExW
SHGetFileInfoW
SHGetPathFromIDListW
SHAppBarMessage
SHGetDiskFreeSpaceExW

user32

CreateCaret
ShowCaret
GetCursorPos
BeginPaint
EndPaint
DestroyCaret
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
GetMenuInfo
CreateMenu
SetMenuInfo
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
GetWindowTextLengthW
CreateIconIndirect
FillRect
DialogBoxParamW
GetDlgItemTextW
SetDlgItemTextW
GetClientRect
MoveWindow
DialogBoxIndirectParamW
EndDialog
GetWindowRect
GetDesktopWindow
SetWindowPos
EnumDisplaySettingsW
EnumDisplayMonitors
GetKeyboardLayout
RegisterClipboardFormatA
GetClipboardFormatNameA
SetCaretPos
GetClassInfoExW
LoadIconW
GetDlgItem
SetWindowTextW
SetFocus
GetParent
SendMessageTimeoutW
DestroyIcon
GetPropW
SetPropW
ClientToScreen
MonitorFromWindow
GetMonitorInfoW
SendInput
PostQuitMessage
CallWindowProcW
RegisterClassExW
DispatchMessageW
MessageBoxW
PostThreadMessageW
SystemParametersInfoW
ScreenToClient
GetQueueStatus
SetTimer
InvalidateRect
CreateWindowExW
DefWindowProcW
SetRectEmpty
GetDC
ReleaseDC
LoadStringA
MessageBoxA
LoadStringW
LoadCursorW
SetCursor
GetWindowLongW
SetWindowLongW
SendMessageW
PostMessageW
PeekMessageW
PtInRect
GetDoubleClickTime
SetRect
GetSystemMetrics
InflateRect
GetKeyState
IsWindow
DestroyWindow
GetFocus
KillTimer
CopyRect
GetWindowInfo
GetWindowTextW
GetForegroundWindow
WaitForInputIdle
SetWindowRgn
MapVirtualKeyW
InsertMenuItemW
SetMenuItemInfoW
RemoveMenu
GetMenuItemInfoW
UpdateLayeredWindow
GetWindowThreadProcessId
GetLastInputInfo
TranslateMessage
GetAsyncKeyState
PostMessageA
RegisterWindowMessageA
MsgWaitForMultipleObjects
GetCursor
UnregisterClassA

gdi32

GetTextCharacterExtra
GetTextExtentPoint32A
CreatePen
GetWorldTransform
SetGraphicsMode
SetWorldTransform
EnumFontFamiliesW
GetBkColor
GetCurrentObject
GetTextExtentPoint32W
DPtoLP
SetTextCharacterExtra
SetDIBitsToDevice
GetBkMode
GetTextAlign
CreateRectRgn
GetClipRgn
CreateFontIndirectA
SetTextColor
ExtTextOutA
SelectClipRgn
EnumFontFamiliesA
GetTextMetricsW
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
ExtTextOutW
GetFontData
EnumFontFamiliesExW
GetTextColor
CreateCompatibleBitmap
GetDIBits
CreateRectRgnIndirect
GetSystemPaletteEntries
GetDeviceCaps
RealizePalette
SelectPalette
DeleteDC
GetICMProfileA
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
GetObjectW
GetStockObject
CreateFontIndirectW
SetPixel
CreateBitmap
CreateDIBSection
CreatePalette
GetClipBox
GdiFlush
StartPage
EndPage
BeginPath
EndPath
SetPolyFillMode
MoveToEx
LineTo
PolyBezierTo
SelectClipPath
SaveDC
RestoreDC
CreateDCW
ResetDCW
CreateICW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
AbortDoc
LPtoDP
StartDocW
StretchDIBits
SetBkMode
SetTextAlign
IntersectClipRect

advapi32

RegOpenKeyExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
OpenProcessToken
SetEntriesInAclW
GetTokenInformation
MakeSelfRelativeSD
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
RegEnumKeyExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
RegOpenKeyA
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyKey
RegQueryValueExW

shlwapi

StrDupW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
PrintDlgW
PageSetupDlgW

winmm

timeGetTime
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetNumDevs
waveInGetNumDevs
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutOpen
waveOutReset
waveOutClose
waveInStart
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent
timeKillEvent
waveOutWrite
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveOutGetPosition
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails

msimg32

AlphaBlend

ws2_32

send
WSAStartup
select
ioctlsocket
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
htons
WSACleanup
closesocket
WSAGetLastError
WSAIoctl
WSAAsyncSelect
socket
accept
listen
ntohl
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
recvfrom
getpeername
connect
WSACloseEvent
getsockname
WSASocketW
recv
setsockopt
gethostname
WSASetLastError
getservbyport
ntohs
gethostbyaddr

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

crypt32

CryptFindLocalizedName
CertOpenStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertAddEncodedCertificateToStore
CertDuplicateCertificateContext
CryptImportPublicKeyInfo
CertFindCertificateInStore
CertCreateCertificateContext
CryptProtectData
CertCloseStore
CryptUnprotectData
CertGetCertificateChain
CertFreeCertificateChain
CryptVerifyMessageSignature
CryptGetMessageCertificates

wininet

InternetGetCookieW
InternetSetCookieW
InternetErrorDlg

rpcrt4

UuidToStringA
RpcStringFreeA

msi

ord70

urlmon

CopyStgMedium

comctl32

ImageList_Draw
ImageList_GetIconSize

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

dsound

ord8

iphlpapi

GetAdaptersAddresses

dnsapi

DnsRecordListFree
DnsQuery_UTF8

winspool.drv

EnumPrintersW
OpenPrinterW
GetPrinterW
ClosePrinter

Exports

Exports

APXGetHostAPI
DllRegisterServer
DllUnregisterServer
SWFLPlayer_Initialize

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 247KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/Dictionary/cs_CZ/stringTable.zdct
resources/Dictionary/da_DK/stringTable.zdct
resources/Dictionary/de_DE/stringTable.zdct
resources/Dictionary/en_AE/stringTable.zdct
resources/Dictionary/en_IL/stringTable.zdct
resources/Dictionary/en_US/stringTable.zdct
resources/Dictionary/es_ES/stringTable.zdct
resources/Dictionary/es_LA/stringTable.zdct
resources/Dictionary/es_MX/stringTable.zdct
resources/Dictionary/es_NA/stringTable.zdct
resources/Dictionary/fi_FI/stringTable.zdct
resources/Dictionary/fr_CA/stringTable.zdct
resources/Dictionary/fr_FR/stringTable.zdct
resources/Dictionary/fr_MA/stringTable.zdct
resources/Dictionary/fr_XM/stringTable.zdct
resources/Dictionary/hu_HU/stringTable.zdct
resources/Dictionary/it_IT/stringTable.zdct
resources/Dictionary/ja_JP/stringTable.zdct
resources/Dictionary/ko_KR/stringTable.zdct
resources/Dictionary/nb_NO/stringTable.zdct
resources/Dictionary/nl_NL/stringTable.zdct
resources/Dictionary/pl_PL/stringTable.zdct
resources/Dictionary/pt_BR/stringTable.zdct
resources/Dictionary/ro_RO/stringTable.zdct
resources/Dictionary/ru_RU/stringTable.zdct
resources/Dictionary/sv_SE/stringTable.zdct
resources/Dictionary/tr_TR/stringTable.zdct
resources/Dictionary/uk_UA/stringTable.zdct
resources/Dictionary/zh_CN/stringTable.zdct
resources/Dictionary/zh_TW/stringTable.zdct
resources/contents/General.utxt
switcher/CCM_UI.dll
.dll windows:5 windows x86 arch:x86

e8cb2d9dab932fe9a786708f94a291df

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:c8:f4:f4:1d:02:0e:ca:ae:49:6a:e6:e9:10:f7:66:25:92:05:31
Signer

Actual PE Digest

48:c8:f4:f4:1d:02:0e:ca:ae:49:6a:e6:e9:10:f7:66:25:92:05:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathRemoveFileSpecW
PathFileExistsW
StrCpyW

advapi32

SystemFunction036

shell32

SHGetSpecialFolderPathW
ShellExecuteW

kernel32

SetFilePointerEx
WriteConsoleW
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
GetLastError
CloseHandle
GetProcAddress
CreateProcessW
FreeLibrary
WideCharToMultiByte
SetStdHandle
HeapReAlloc
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
EncodePointer
RaiseException
InterlockedFlushSList
CreateFileW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize

user32

MessageBoxW

Exports

Exports

aam_switchAppletVersion

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
switcher/DWA_UI.dll
.dll windows:5 windows x86 arch:x86

165c19d260ebebeb20e867a77ff05dea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3f:9c:63:b8:52:6e:32:11:87:1d:e9:00:6f:df:bc:65:4f:3b:cf:23
Signer

Actual PE Digest

3f:9c:63:b8:52:6e:32:11:87:1d:e9:00:6f:df:bc:65:4f:3b:cf:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLastError
GetModuleFileNameW
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
SetUnhandledExceptionFilter
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
DecodePointer
CreateFileW
RaiseException
UnhandledExceptionFilter

advapi32

SystemFunction036

Exports

Exports

aam_switchAppletVersion

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
switcher/LWA_UI.dll
.dll windows:5 windows x86 arch:x86

bdb11c6227956d0a0e3b5852a556c4b3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:4e:6f:35:b1:aa:2a:af:52:a7:2e:36:9e:d0:c0:9f:6a:d3:45:6b
Signer

Actual PE Digest

23:4e:6f:35:b1:aa:2a:af:52:a7:2e:36:9e:d0:c0:9f:6a:d3:45:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

CM_Get_DevNode_Status
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW

kernel32

InitializeCriticalSectionAndSpinCount
GetTempPathW
CreateMutexW
FindClose
WaitForSingleObject
CreateFileW
ReleaseMutex
SetFileAttributesW
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
DeleteFileW
CloseHandle
RaiseException
ResetEvent
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
GetModuleFileNameW
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
QueryPerformanceCounter
SetEndOfFile
UnlockFileEx
LockFileEx
FreeLibrary
LoadLibraryW
WriteConsoleW
TerminateProcess
WriteFile
GetCurrentProcess
SetLastError
ReadFile
HeapReAlloc
HeapAlloc
HeapFree
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetFullPathNameW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
HeapSize
GetConsoleCP
SetStdHandle
GetCurrentDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
GetFileAttributesExW
GetTimeZoneInformation
InterlockedFlushSList
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent

user32

wsprintfW

advapi32

SystemFunction036
SetSecurityInfo
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor

shell32

SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
OleRun
CoInitialize

oleaut32

GetErrorInfo
SysFreeString
SysAllocStringByteLen
SysAllocString
SysStringLen
VariantClear

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW
PathFileExistsW

Exports

Exports

GetAsnVersion
aam_switchAppletVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 426KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
switcher/UWA_UI.dll
.dll windows:5 windows x86 arch:x86

800ad4a8b1ca0bc597ca35c37c835928

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c3:ed:45:66:16:3e:27:9d:27:84:c9:9f:ff:d7:87
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2015, 00:00

Not After

28/10/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9d:83:c7:a6:b6:f3:28:c2:5e:11:e8:a9:26:76:85:a7:8a:80:81:47
Signer

Actual PE Digest

9d:83:c7:a6:b6:f3:28:c2:5e:11:e8:a9:26:76:85:a7:8a:80:81:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindNextFileA
AreFileApisANSI
ReadFile
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
IsValidCodePage
GetTickCount
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
GetModuleFileNameW
FindClose
SetFileAttributesW
CopyFileW
GetCurrentProcess
TerminateProcess
OpenProcess
CreateEventW
GlobalAlloc
GlobalFree
CreateProcessW
GetModuleHandleW
LCMapStringW
lstrlenW
GetACP
FindFirstFileExA
GetFileType
GetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
WriteConsoleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTimeZoneInformation
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
GetCPInfo
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
UnhandledExceptionFilter

user32

EnumWindows
GetShellWindow
GetWindowThreadProcessId
AllowSetForegroundWindow

advapi32

AdjustTokenPrivileges
EqualSid
SystemFunction036
AllocateAndInitializeSid
OpenProcessToken
FreeSid
DuplicateTokenEx
GetTokenInformation
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetFolderLocation

ole32

CLSIDFromProgID
OleRun
CoCreateInstance
CLSIDFromString
CoCreateGuid
StringFromGUID2
CoUninitialize
CoInitialize
CoTaskMemFree

oleaut32

SysFreeString
SysStringLen
GetErrorInfo
SysAllocString

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathFileExistsA
PathAppendW
PathIsDirectoryW
PathRemoveBackslashW
PathStripPathW

Exports

Exports

aam_switchAppletVersion

Sections

.text
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/AAM/core/PDApp.pimx
.xml
packages/AAM/core/PDApp.sig
.xml
packages/AAM/install.sig
.xml
packages/ADC/Core/Core.pima
.zip
AdobePIM.dll
.dll windows:5 windows x86 arch:x86

3744c6d9645a0d65440bab171494dbbf

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:26:f7:da:97:ce:f8:8a:49:0e:20:92:0a:16:8e:33:91:a4:c4:64:a5:01:fd:67:b8:3c:43:49:ef:8e:18:b8
Signer

Actual PE Digest

91:26:f7:da:97:ce:f8:8a:49:0e:20:92:0a:16:8e:33:91:a4:c4:64:a5:01:fd:67:b8:3c:43:49:ef:8e:18:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord145
ord74
ord147

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

shlwapi

PathAddExtensionW
PathIsFileSpecW
PathRemoveFileSpecA
PathIsDirectoryA
PathIsDirectoryEmptyW
PathIsSystemFolderW
PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathRemoveBackslashW
PathStripPathW
PathAppendA
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathIsRootW
PathFileExistsA
PathRemoveExtensionW

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
ord680
ord51
SHCreateItemFromParsingName

winhttp

WinHttpSetTimeouts
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption

kernel32

GetCPInfo
GetLocaleInfoW
CompareStringW
TlsFree
IsDebuggerPresent
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW
TlsSetValue
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
LocalAlloc
ReleaseMutex
Sleep
OpenSemaphoreW
CloseHandle
LocalFree
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
GetTempPathW
MultiByteToWideChar
SetEvent
ResetEvent
GetCommandLineW
CreateProcessW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
FindFirstFileW
FindNextFileW
InterlockedDecrement
TerminateProcess
RemoveDirectoryW
FindClose
GetVersionExW
SetEnvironmentVariableA
CreateEventW
GetDiskFreeSpaceExW
CreateThread
CopyFileW
lstrcmpiW
lstrcmpW
GetExitCodeProcess
AreFileApisANSI
ReadFile
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetCurrentProcess
GetFileSizeEx
lstrlenW
GetACP
SizeofResource
GetModuleFileNameW
LockResource
LoadResource
FindResourceW
MoveFileExW
GetCurrentThreadId
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
SetLastError
DuplicateHandle
ProcessIdToSessionId
TerminateThread
GlobalAlloc
GlobalFree
FindResourceExW
lstrcpyW
QueryFullProcessImageNameW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
FileTimeToSystemTime
OpenMutexW
GetUserDefaultLCID
LCMapStringW
GetUserDefaultLangID
GetUserDefaultUILanguage
SetFilePointerEx
ResumeThread
SetStdHandle
WriteConsoleW
QueryPerformanceFrequency
SetFileAttributesW
GetTickCount

user32

wsprintfW
AllowSetForegroundWindow
EnumWindows
GetShellWindow
GetWindowThreadProcessId

advapi32

InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
RegQueryValueExW
RegDeleteValueW
FreeSid
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
LookupAccountSidW
CreateWellKnownSid
EqualSid
GetTokenInformation
DuplicateTokenEx
GetUserNameW
ConvertSidToStringSidW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CLSIDFromProgID
OleRun
CLSIDFromString

oleaut32

VariantCopy
SysStringLen
VariantChangeType
VariantInit
SysFreeString
SysAllocString
VariantClear
GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

Exports

Exports

AAMIU_Uninstall
AAMIU_getDeploymentValidationStatus
AAMIU_preInstallPropertySet
pim_createLibraryRef
pim_freeLibraryRef
pim_freeLiraryRef
pim_freeString
pim_getAppletAndPackageInfo
pim_getAppletRegistrationInfo
pim_getAppletRelationshipInfo
pim_getCurrentCCVersion
pim_getCurrentPackagesVersion
pim_getInstallStatus
pim_getInstalledPackagesInfo
pim_launchACCCUninstallerExecutableAsAdmin
pim_selfUpdateCheck
pim_selfUpdateCheckWithData
pim_startWorkflow
pim_startWorkflowWithData
pim_syncFromPathToACF
pim_syncFromPathToPath
pim_syncUSFToACF
pim_uninstallAAMFromAAMCleanerTool
pim_uninstallAAMUsingAAMCleanerTool
pim_uninstallACCCFromACCCCleanerTool
pim_uninstallADCUsingADCCleanerTool

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Core.dll
.dll windows:5 windows x86 arch:x86

bb6ca2f15142da5ae6cf50660b2e1efe

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:a2:6f:e6:59:f1:f6:da:02:ae:83:29:be:16:a5:4e:4d:91:99:97:7c:c4:67:8a:39:b9:17:be:e0:5b:01:24
Signer

Actual PE Digest

62:a2:6f:e6:59:f1:f6:da:02:ae:83:29:be:16:a5:4e:4d:91:99:97:7c:c4:67:8a:39:b9:17:be:e0:5b:01:24

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

kernel32

DeleteCriticalSection
WaitForSingleObject
GetCurrentThreadId
CloseHandle
CreateThread
GetThreadId
ReadFile
WriteFile
CreateNamedPipeW
CreateFileW
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
FindClose
DeleteFileW
LocalFree
FlushFileBuffers
CreateMutexW
ReleaseMutex
Sleep
WideCharToMultiByte
DecodePointer
LCMapStringW
CreateEventW
SetEvent
ResetEvent
HeapFree
SetLastError
GetCurrentProcess
TerminateProcess
HeapSize
HeapReAlloc
HeapAlloc
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
OutputDebugStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
GetStringTypeW
InitializeSListHead
GetSystemTimeAsFileTime
RaiseException
GetLastError
InitializeCriticalSectionEx
GetCommandLineW
ExitProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
SetStdHandle
GetConsoleCP
SetEndOfFile
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetFileType
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx

user32

LoadCursorW
SetCursor
GetMessageW
CreateDialogParamW
PostMessageW
SendMessageW
ShowWindow
TranslateMessage
PostThreadMessageW
DispatchMessageW

advapi32

GetUserNameW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID
OleRun
CLSIDFromString
CoCreateGuid
StringFromGUID2

oleaut32

GetErrorInfo
VariantInit
SysFreeString
VariantClear
VariantChangeType
SysStringLen
VariantCopy
SysAllocString

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW

Exports

Exports

finalize
initialize
processMessage

Sections

.text
Size: 263KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADC/Core/Core.pimx
packages/ADC/Core/Core.sig
.xml
packages/ADC/HDBox/HDBox.pima
.zip
Adobe Update Helper.exe
.exe windows:5 windows x86 arch:x86

6f24c9c2865773b8ab45a5269dc67e84

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:f5:78:be:4a:df:3d:8d:87:90:9a:78:8e:e6:bb:fa:88:f6:06:15:4b:88:61:f9:01:3f:2c:2e:8a:0f:bd:b4
Signer

Actual PE Digest

b6:f5:78:be:4a:df:3d:8d:87:90:9a:78:8e:e6:bb:fa:88:f6:06:15:4b:88:61:f9:01:3f:2c:2e:8a:0f:bd:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetCanonicalizeUrlW

kernel32

RaiseException
DecodePointer
DeleteCriticalSection
ReadFile
FindFirstFileW
SetLastError
FindNextFileW
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
DeleteFileW
CloseHandle
LocalFree
MoveFileExW
GetFileSize
lstrcmpW
GetCurrentProcess
WaitForSingleObject
GetProcAddress
CreateProcessW
GetModuleHandleW
GetVersionExW
SizeofResource
GetFullPathNameW
WriteFile
LockResource
LoadResource
FindResourceW
FlushFileBuffers
LoadLibraryW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetCurrentProcessId
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
HeapFree
TerminateProcess
OpenProcess
HeapSize
CreateEventW
Sleep
GetLastError
GlobalAlloc
GlobalFree
HeapReAlloc
ResetEvent
HeapAlloc
HeapDestroy
GetProcessHeap
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
VerSetConditionMask
VerifyVersionInfoW
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WaitForSingleObjectEx
GetTickCount
GetACP
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
GetStdHandle
GetTimeZoneInformation
GetFileType
LoadLibraryExW
RtlUnwind
GetStartupInfoW
InitializeCriticalSectionEx
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleCP
WriteConsoleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
SetEvent
QueryPerformanceCounter
InitializeSListHead
UnhandledExceptionFilter

user32

GetShellWindow
MessageBoxW
AllowSetForegroundWindow
EnumWindows
GetWindowThreadProcessId

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
DuplicateTokenEx
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EqualSid
OpenProcessToken
GetTokenInformation

ole32

OleRun
CLSIDFromProgID
CoTaskMemFree
CoInitialize
CLSIDFromString
CoCreateGuid
CoUninitialize
StringFromGUID2
CoCreateInstance

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW

oleaut32

GetErrorInfo
SysAllocString
SysStringLen
VariantClear
SysFreeString

shlwapi

PathFindFileNameW
PathFileExistsW
PathIsRootW
PathRenameExtensionW
PathRemoveFileSpecW
PathFileExistsA
PathAppendW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathIsFileSpecW

Sections

.text
Size: 792KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HDHelper.exe
.exe windows:5 windows x86 arch:x86

2ac8416ebb402ac1e8a4286553a080ad

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:5c:24:01:f7:65:b3:a2:4d:2d:e8:a2:1c:3a:e5:6b:51:d9:4e:6b:8f:5d:20:c0:9f:4d:50:b8:76:a6:73:56
Signer

Actual PE Digest

08:5c:24:01:f7:65:b3:a2:4d:2d:e8:a2:1c:3a:e5:6b:51:d9:4e:6b:8f:5d:20:c0:9f:4d:50:b8:76:a6:73:56

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

LocalFree
MoveFileExW
lstrcpyW
lstrcmpiW
lstrcmpW
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetCurrentProcess
WaitForSingleObject
GetProcAddress
GetModuleHandleW
GetExitCodeProcess
GetVersionExW
Sleep
HeapFree
LoadLibraryW
HeapAlloc
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
CreateEventW
VerSetConditionMask
VerifyVersionInfoW
WriteFile
FlushFileBuffers
FreeLibrary
TerminateProcess
OpenProcess
HeapSize
CloseHandle
Process32NextW
SetEvent
Process32FirstW
HeapReAlloc
ResetEvent
GetCurrentProcessId
GetUserDefaultLCID
LCMapStringW
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetUserDefaultLangID
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
GetUserDefaultUILanguage
GetConsoleMode
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetACP
GetCommandLineW
DeleteFileW
GetLastError
FormatMessageW
CreateFileW
LocalAlloc
FindClose
GetTempPathW
GetModuleFileNameW
TlsAlloc
FindNextFileW
SetLastError
FindFirstFileW
ReadFile
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleCP
WriteConsoleW
SetEndOfFile
InitializeCriticalSectionAndSpinCount
EncodePointer
CreateToolhelp32Snapshot
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetStdHandle
GetTimeZoneInformation
GetFileType
LoadLibraryExW
RtlUnwind
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
GetLocaleInfoW
GetStringTypeW

user32

AllowSetForegroundWindow

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
CreateProcessAsUserW
ConvertSidToStringSidW
GetUserNameW
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
RegGetKeySecurity
RegCloseKey
RegCreateKeyExW
RegSetKeySecurity
RegSetValueExW
InitializeSecurityDescriptor
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetEntriesInAclW
OpenProcessToken
GetTokenInformation
CreateWellKnownSid

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CLSIDFromProgID
CoUninitialize
OleRun
CLSIDFromString
CoInitialize
CoCreateInstance

oleaut32

VariantCopy
VariantInit
SysFreeString
SysAllocString
VariantClear
GetErrorInfo

shlwapi

PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathStripPathW
PathFileExistsW
PathFindFileNameW
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW
PathRenameExtensionW

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HDIM.dll
.dll windows:5 windows x86 arch:x86

364b44c7c801c27546505caff5d07a1d

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:a0:85:dc:d5:31:7e:fb:75:61:f1:15:74:f9:d3:37:a8:d2:5c:1e:91:ea:a5:26:6e:0e:85:4a:91:0b:54:86
Signer

Actual PE Digest

b7:a0:85:dc:d5:31:7e:fb:75:61:f1:15:74:f9:d3:37:a8:d2:5c:1e:91:ea:a5:26:6e:0e:85:4a:91:0b:54:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

FindNextFileW
WriteFile
GetTempPathW
FindClose
CreateFileW
DeleteFileW
CloseHandle
LocalFree
MoveFileExW
lstrcmpW
FlushFileBuffers
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
SetFilePointer
GetCurrentThreadId
GetUserDefaultLCID
LCMapStringW
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
WaitForSingleObject
FindFirstFileW
OpenMutexW
GetCurrentProcess
GetVersionExW
CreateEventW
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
GetUserDefaultLangID
GetUserDefaultUILanguage
HeapFree
SetLastError
TerminateProcess
HeapSize
SetEvent
HeapReAlloc
ResetEvent
HeapAlloc
GetProcessHeap
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetFileType
GetStdHandle
GetACP
ReadFile
OutputDebugStringW
DeleteCriticalSection
TlsAlloc
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
SetEndOfFile
WriteConsoleW
InitializeCriticalSectionAndSpinCount
EncodePointer
ReleaseMutex
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
GetStringTypeW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFolderLocation
SHCreateDirectoryExW

ole32

CLSIDFromProgID
OleRun
CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantCopy
VariantClear
GetErrorInfo

shlwapi

PathFileExistsW
PathFindFileNameW
PathRenameExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW

Exports

Exports

ccim_GetInformation
ccim_UserAction
ccim_endWorkflow
ccim_startWorkflow
ccim_startWorkflowWithMode
hdimSetLoggerFnPtr

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HDPIM.dll
.dll windows:5 windows x86 arch:x86

cf3ec14bd99196df470dea25b0b39ba7

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:39:cd:d9:8a:05:1a:4a:66:c7:9c:be:65:1b:7f:5f:52:52:47:31:21:4d:cb:09:b2:97:79:45:c8:58:e4:1f
Signer

Actual PE Digest

bd:39:cd:d9:8a:05:1a:4a:66:c7:9c:be:65:1b:7f:5f:52:52:47:31:21:4d:cb:09:b2:97:79:45:c8:58:e4:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathIsDirectoryW
PathRenameExtensionW
PathRemoveBackslashW
PathIsSameRootW
PathFindExtensionW
PathStripPathW
PathIsUNCW
PathIsRelativeW
PathIsRootW
PathIsDirectoryEmptyW
PathStripToRootW
PathFileExistsA
PathAddExtensionW
PathRemoveExtensionW
PathIsFileSpecW
PathRemoveFileSpecW
PathGetCharTypeW
PathAppendW
PathFileExistsW
PathAddBackslashW
PathFindFileNameW
PathMakePrettyW

shell32

SHCreateItemFromParsingName
SHGetKnownFolderPath
ord51
SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
SHSetLocalizedName
ord709
ord680
SHCreateDirectoryExW
ord75
SHGetSpecialFolderPathW

winhttp

WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleBaseNameW
EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

kernel32

TlsSetValue
TlsFree
TlsGetValue
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
ReadFile
FindFirstFileW
SetLastError
FindNextFileW
lstrlenW
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
GetLastError
GetDiskFreeSpaceExW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
MoveFileExW
GetFileSize
CopyFileW
lstrcpyW
lstrcmpiW
lstrcmpW
GetDriveTypeW
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetTempFileNameW
GetCurrentProcess
GetUserDefaultLangID
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryFullProcessImageNameW
GetFullPathNameW
GetVersionExW
Sleep
VerSetConditionMask
VerifyVersionInfoW
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate
HeapFree
EnterCriticalSection
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFileType
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
WaitForSingleObject
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
LoadLibraryW
EncodePointer
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
LCMapStringA
GetStringTypeExA
GetUserDefaultLCID
LCMapStringW
SetFileTime
CreateThread
SetFilePointerEx
GetFileSizeEx
TerminateThread
ResumeThread
GlobalFree
CopyFileExW
GetACP
CreateSymbolicLinkW
GetCurrentThreadId
TerminateProcess
GetUserDefaultUILanguage
ReleaseMutex
CreateEventW
SetEvent
ResetEvent
CreateDirectoryW
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
ReleaseSemaphore
CreateSemaphoreW
PeekNamedPipe
SizeofResource
GetFinalPathNameByHandleW
LockResource
LoadResource
FindResourceW
Thread32Next
Thread32First
DuplicateHandle
ProcessIdToSessionId
GlobalAlloc
FindResourceExW
GetThreadTimes
OpenThread
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetPhysicallyInstalledSystemMemory
GetLogicalDriveStringsW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
IsValidLocale
EnumSystemLocalesW
GetStdHandle
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
GetLocaleInfoW
HeapAlloc
TlsAlloc
SetEnvironmentVariableA
WriteConsoleW
LeaveCriticalSection
QueryPerformanceFrequency

user32

PostMessageW
GetDC
LoadStringA
GetDesktopWindow
ReleaseDC
GetWindowThreadProcessId
AllowSetForegroundWindow
GetShellWindow
EnumWindows
PostThreadMessageW
wsprintfW

gdi32

GetDeviceCaps
AddFontResourceW
RemoveFontResourceW

advapi32

RegGetKeySecurity
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges
OpenProcessToken
CreateWellKnownSid
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
FreeSid
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
AllocateAndInitializeSid
GetUserNameW
LookupAccountSidW
EqualSid
DuplicateTokenEx
ConvertSidToStringSidW
CreateProcessAsUserW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
RegOpenKeyExW
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
GetTokenInformation
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
RegQueryValueExW
RegDeleteValueW
InitializeSecurityDescriptor
RegSetKeySecurity

ole32

StringFromGUID2
CoSetProxyBlanket
CoInitializeEx
CLSIDFromProgID
OleRun
CLSIDFromString
CoCreateGuid
CoTaskMemFree
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
SysStringLen
VariantChangeType
VariantCopy
SafeArrayAccessData
SafeArrayCreateVector
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayDestroy
GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

Exports

Exports

hdpimAreUpdatesEnabled
hdpimCheckAndReportConflictingProcess
hdpimCheckForUpdate
hdpimControlProgress
hdpimCreateSession
hdpimDownloadProduct
hdpimGetAvailableUpdateInfo
hdpimGetInstalledProductsList
hdpimGetProductInstallDirIsMoved
hdpimGetProductInstallStatus
hdpimGetProductInstalledVersions
hdpimGetProductLaunchPath
hdpimGetProductReferenceInfo
hdpimInstallProduct
hdpimInstallUpdate
hdpimLaunchProduct
hdpimRepairProduct
hdpimSetLogger
hdpimSetLoggerFnPtr
hdpimTerminateSession
hdpimUnInstallProduct

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 504KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HDUWP.dll
.dll windows:5 windows x86 arch:x86

825526b9154a5f1e6797ddcb1cbb360f

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:79:ec:d7:af:5f:2a:bd:50:54:3c:c0:9c:93:8d:71:12:25:97:88:27:3b:12:95:a4:23:e6:6a:38:3f:44:4d
Signer

Actual PE Digest

25:79:ec:d7:af:5f:2a:bd:50:54:3c:c0:9c:93:8d:71:12:25:97:88:27:3b:12:95:a4:23:e6:6a:38:3f:44:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventExW
PackageFullNameFromId
SetEvent
WaitForSingleObject
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
LoadLibraryExW
GetProcAddress
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DecodePointer

ole32

CoInitialize
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree

vccorlib140

?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z
?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z
?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0OutOfBoundsException@Platform@@Q$AAA@XZ
??0ChangedStateException@Platform@@Q$AAA@XZ
??0OutOfMemoryException@Platform@@Q$AAA@XZ
??0FailureException@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXI@Z
??0Delegate@Platform@@Q$AAA@XZ
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?InitializeData@Details@Platform@@YAJH@Z
?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z
?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z
?AllocateException@Heap@Details@Platform@@SAPAXII@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
??0Object@Platform@@Q$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YGP$AAVString@Platform@@_NP$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
?__abi_translateCurrentException@@YGJ_N@Z
?UninitializeData@Details@Platform@@YAXH@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
?FlushFactoryCache@@YGXXZ

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-core-winrt-l1-1-0

RoInitialize

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoFailFastWithErrorContext

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsCreateString

vcruntime140

__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
_except_handler4_common
memset
memmove
memcpy
_purecall
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_seh_filter_dll
terminate
_register_onexit_function
_initterm
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

_wcsdup
wcslen

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

Exports

Exports

hduwpGetInstalledPackageUsers
hduwpGetPackageFullName
hduwpInstallPackage
hduwpIsPackageInstalledForAnyUser
hduwpIsPackageInstalledForCurrentUser
hduwpLaunchPackage
hduwpRegisterPackage
hduwpUninstallPackage

Sections

.text
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 581B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HDZIP.dll
.dll windows:5 windows x86 arch:x86

9649f6006dee90453fe1f072775c9921

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:de:29:8c:c9:b7:02:9c:56:89:56:cc:f5:8a:a8:e4:a2:91:75:79:40:26:18:29:d4:31:47:4e:d6:3e:a1:4d
Signer

Actual PE Digest

da:de:29:8c:c9:b7:02:9c:56:89:56:cc:f5:8a:a8:e4:a2:91:75:79:40:26:18:29:d4:31:47:4e:d6:3e:a1:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CreateFileA
CloseHandle
GetFileSize
VirtualFree
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
CreateDirectoryW
lstrlenW
SetFileTime
GetFileAttributesW
SetFileAttributesW
MultiByteToWideChar
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
FindFirstFileW
GetFullPathNameW
FindNextFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSectionEx
FormatMessageW
RaiseException
DecodePointer
LocalFree
WideCharToMultiByte
GetTempPathW
DeleteFileW
FlushFileBuffers
CreateFileW
GetUserDefaultLCID
LCMapStringW
FreeLibrary
HeapFree
SetLastError
GetCurrentProcess
TerminateProcess
HeapSize
HeapReAlloc
CreateThread
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetACP
GetStdHandle
EnumSystemLocalesW
IsValidLocale
ReadConsoleW
GetConsoleMode
GetConsoleCP
WaitForSingleObjectEx
WriteFile
ReadFile
SetEndOfFile
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetModuleFileNameA
ExitProcess
SetFilePointerEx
GetFileType
SetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
OutputDebugStringW
GetCPInfo
GetLocaleInfoW
TlsFree
TlsSetValue
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
EncodePointer
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter

ole32

StringFromGUID2
CoCreateGuid

oleaut32

VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathIsDirectoryW

Exports

Exports

hdzipCompressFolder
hdzipDecompressFile
hdzipSetLogger

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HUM.dll
.dll windows:5 windows x86 arch:x86

ccba440bf4737236f64682c916fc6176

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:90:85:52:be:52:2e:95:62:74:a5:b7:96:70:e0:8d:5f:3a:3e:0e:fd:a9:eb:dd:ed:5a:ac:14:af:16:45:a5
Signer

Actual PE Digest

66:90:85:52:be:52:2e:95:62:74:a5:b7:96:70:e0:8d:5f:3a:3e:0e:fd:a9:eb:dd:ed:5a:ac:14:af:16:45:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

shlwapi

PathFindFileNameW
PathAddExtensionW
PathFileExistsW
PathIsRootW
PathStripPathW
PathRenameExtensionW
PathIsDirectoryW
PathRemoveFileSpecW
PathAppendW
PathFileExistsA
PathRemoveExtensionW
PathIsFileSpecW

shell32

SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetSpecialFolderPathW
ord680

winhttp

WinHttpSendRequest
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpGetProxyForUrl

kernel32

EnumSystemLocalesW
IsValidLocale
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
GetFileType
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
InitializeSListHead
GetCurrentThreadId
GetStartupInfoW
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW
GetConsoleMode
ReadConsoleW
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
ReadFile
FindFirstFileW
SetLastError
FindNextFileW
lstrlenW
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
DeleteFileW
CloseHandle
LocalFree
MoveFileExW
GetFileSize
lstrcmpiW
lstrcmpW
GetCurrentProcess
WaitForSingleObject
GetProcAddress
GetModuleHandleW
GetVersionExW
Sleep
GetConsoleCP
GetFullPathNameW
WriteFile
FlushFileBuffers
LoadLibraryW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
LoadLibraryA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
HeapFree
TerminateProcess
OpenProcess
HeapSize
CreateToolhelp32Snapshot
CreateEventW
ProcessIdToSessionId
Process32NextW
SetEvent
TerminateThread
Process32FirstW
GlobalFree
HeapReAlloc
CreateThread
ResetEvent
HeapAlloc
HeapDestroy
GetProcessHeap
GetUserDefaultLangID
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
SetFilePointerEx
ResumeThread
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
CreateDirectoryW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
VerSetConditionMask
VerifyVersionInfoW
ReleaseMutex
OpenMutexW
GetUserDefaultUILanguage
QueryPerformanceFrequency
LCMapStringW
OutputDebugStringA

user32

wsprintfW

advapi32

ImpersonateLoggedOnUser
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
LookupAccountSidW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
CreateWellKnownSid
ConvertStringSidToSidW
RevertToSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW

ole32

CoCreateInstance
StringFromGUID2
CoUninitialize
CoTaskMemFree
CoCreateGuid
CLSIDFromString
OleRun
CLSIDFromProgID
CoInitialize

oleaut32

SysStringLen
VariantChangeType
VariantClear
SysFreeString
VariantInit
VariantCopy
SysAllocString
GetErrorInfo

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

Exports

Exports

humCreateSession
humDownloadProductFFC
humGetAllProducts
humGetLatestApplicableUpdates
humGetLatestProducts
humGetLatestUpdates
humParseProductFFC
humSetLoggerFnPtr
humTerminateSession

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Set-up.exe
.exe windows:5 windows x86 arch:x86

5b3e6afc3f0e1189239b8b04658ee25a

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:0f:56:ea:b4:fc:81:36:9f:01:78:7b:ad:5b:dc:d1:f8:44:8c:eb:55:da:00:bf:25:28:25:a6:47:b7:fa:ce
Signer

Actual PE Digest

53:0f:56:ea:b4:fc:81:36:9f:01:78:7b:ad:5b:dc:d1:f8:44:8c:eb:55:da:00:bf:25:28:25:a6:47:b7:fa:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

shell32

SHGetPathFromIDListW
SHGetMalloc
ord680
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteExW
ord51
ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW

shlwapi

PathStripToRootW
PathFindFileNameW
PathIsRootW
PathRemoveFileSpecW
PathIsUNCW
PathStripPathW
PathRemoveBackslashW
PathRenameExtensionW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathFileExistsA
PathIsFileSpecW
PathRemoveExtensionW
PathIsNetworkPathW
PathAddExtensionW
PathIsRelativeW
UrlIsW

kernel32

GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
LocalFree
CreateProcessW
GetModuleHandleW
FreeLibrary
FindFirstFileW
FindNextFileW
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
FindClose
WaitForSingleObject
OpenProcess
SetFileAttributesW
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CopyFileW
GetExitCodeProcess
ReadFile
SetLastError
lstrlenW
LocalAlloc
GetFileAttributesW
FormatMessageW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
GetFileSize
lstrcpyW
lstrcmpiW
lstrcmpW
GetDriveTypeW
InitializeCriticalSectionEx
DecodePointer
DeleteCriticalSection
GetFullPathNameW
HeapSize
HeapReAlloc
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetSystemDirectoryW
SetDllDirectoryW
GetStdHandle
AttachConsole
FreeConsole
GetConsoleWindow
CreateMutexW
ReleaseMutex
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
CreateFileMappingA
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateSymbolicLinkW
GetUserDefaultUILanguage
CreateEventW
SetEvent
ResetEvent
TryEnterCriticalSection
CreateDirectoryW
GetFileSizeEx
GetLocalTime
CloseHandle
GetDateFormatW
OpenMutexW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
InterlockedDecrement
QueryPerformanceFrequency
CreateThread
SetFilePointerEx
TerminateThread
ResumeThread
GlobalFree
SizeofResource
LockResource
LoadResource
FindResourceW
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLCID
LCMapStringW
DuplicateHandle
ProcessIdToSessionId
FindResourceExW
GetThreadTimes
QueryFullProcessImageNameW
WaitForMultipleObjects
GetUserDefaultLangID
SetNamedPipeHandleState
CreateNamedPipeW
ConnectNamedPipe
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetTimeZoneInformation
InterlockedFlushSList
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThread
WaitForSingleObjectEx
GetStringTypeW
EncodePointer
LoadLibraryExA
VirtualQuery
VirtualProtect
GetComputerNameExW
GetVersionExW
CreateFileW
GetTempPathW
DeviceIoControl
GetCurrentProcess
GetModuleHandleExW
ExitProcess
GetACP
IsValidLocale
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
RtlUnwind
UnregisterWaitEx
WriteConsoleW
GetTimeFormatW
QueryDepthSList
UnlockFile

user32

GetWindowTextLengthW
GetWindowThreadProcessId
GetWindowLongW
wsprintfW
GetMessageW
DefWindowProcW
CallWindowProcW
PostThreadMessageW
EnumWindows
GetShellWindow
AllowSetForegroundWindow
LoadImageW
SystemParametersInfoW
EnableMenuItem
PostMessageW
GetWindow
GetFocus
DestroyWindow
FillRect
LoadIconW
GetSystemMetrics
GetSystemMenu
GetClassLongW
AppendMenuW
CreateWindowExW
ScreenToClient
SetWindowTextW
RegisterClassExW
GetActiveWindow
ShowWindow
IsWindow
InvalidateRgn
DispatchMessageW
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
AttachThreadInput
GetSysColor
GetForegroundWindow
MoveWindow
CreateAcceleratorTableW
SetFocus
BringWindowToTop
TranslateAcceleratorW
TranslateMessage
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
PostQuitMessage
GetClassInfoExW
GetParent
RegisterWindowMessageW
ReleaseCapture
SetForegroundWindow
InvalidateRect
IsIconic
BeginPaint
EndPaint
GetWindowTextW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
SendMessageW
GetDesktopWindow
ReleaseDC
UnregisterClassW
GetAsyncKeyState
SetClassLongW
CharNextW

gdi32

DeleteDC
GetObjectW
GetStockObject
CreateSolidBrush
GetDeviceCaps
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject

advapi32

EqualSid
LookupAccountSidW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
GetUserNameW
DuplicateTokenEx
ConvertSidToStringSidW
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
RegSetValueExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateWellKnownSid
GetTokenInformation
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
RegFlushKey
RegOpenKeyExW
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleLockRunning
CLSIDFromString
OleInitialize
CreateStreamOnHGlobal
CLSIDFromProgID
CoTaskMemAlloc
OleUninitialize
CoGetClassObject
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoCreateGuid
OleRun

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
OleCreateFontIndirect
LoadTypeLi
VariantInit
LoadRegTypeLi
SysAllocStringByteLen
VariantChangeType
VariantCopy
SysStringByteLen
DispCallFunc
SysFreeString
GetErrorInfo

bcrypt

BCryptFinishHash
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty

secur32

GetUserNameExW

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust

comctl32

InitCommonControlsEx

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Setup.exe
.exe windows:5 windows x86 arch:x86

42b7d24e9e1ea6da5c1a272cc65fa67f

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:a6:4f:0f:41:09:9a:f1:5d:bb:c2:f5:00:e9:79:92:81:85:bf:bc:60:c7:d8:d6:d3:95:70:1b:a2:88:5d:5c
Signer

Actual PE Digest

49:a6:4f:0f:41:09:9a:f1:5d:bb:c2:f5:00:e9:79:92:81:85:bf:bc:60:c7:d8:d6:d3:95:70:1b:a2:88:5d:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

SetDllDirectoryW
OutputDebugStringW
ReadFile
FindFirstFileW
GetFullPathNameW
FindNextFileW
WriteFile
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
DeleteFileW
CloseHandle
LocalFree
MoveFileExW
lstrcmpW
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
SetFilePointer
GetCurrentThreadId
WaitForSingleObject
Sleep
CreateThread
LoadLibraryW
GetProcAddress
FreeLibrary
CreateEventW
SetEvent
ResetEvent
GetUserDefaultLCID
GetConsoleWindow
LCMapStringW
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
GetCurrentProcess
GetVersionExW
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
GetUserDefaultLangID
GetUserDefaultUILanguage
HeapFree
SetLastError
TerminateProcess
HeapSize
HeapReAlloc
HeapAlloc
GetProcessHeap
GetModuleHandleExW
GetCPInfo
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
DeleteCriticalSection
DecodePointer
FreeConsole
RaiseException
AttachConsole
GetLastError
InitializeCriticalSectionEx
GetStdHandle
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
SetEnvironmentVariableA
SetEnvironmentVariableW
RtlUnwind
SetStdHandle
GetConsoleCP
GetFileType
GetTimeZoneInformation
WriteConsoleW
SetEndOfFile
ExitProcess
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetACP
GetCommandLineW
GetCommandLineA

user32

SendMessageW
wsprintfW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFolderLocation
SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemFree
CLSIDFromProgID
OleRun
CLSIDFromString

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
VariantCopy
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathRenameExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
PathFindFileNameW
PathAppendW
PathFileExistsW

Sections

.text
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TokenResolverx64.exe
.exe windows:6 windows x64 arch:x64

9b4961bf94e6691abd64f76d734bcff9

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:78:45:3c:8e:42:3e:15:4e:60:a6:60:47:e3:7e:55:09:a6:64:da:a8:a7:d5:26:7b:7c:72:ee:8f:8c:ff:63
Signer

Actual PE Digest

ea:78:45:3c:8e:42:3e:15:4e:60:a6:60:47:e3:7e:55:09:a6:64:da:a8:a7:d5:26:7b:7c:72:ee:8f:8c:ff:63

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteFile
CreateFileW
GetLastError
CloseHandle
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetACP
HeapFree
HeapAlloc
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation

ole32

CoTaskMemFree

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstaller.exe
.exe windows:5 windows x86 arch:x86

e7f14cac547405ab51b9e27a5d333baa

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:72:63:84:1f:73:67:d0:f2:ee:8f:4e:50:bf:7b:7b:87:26:ea:89:a4:e4:84:6e:1f:2a:9b:22:f6:b4:be:d8
Signer

Actual PE Digest

ab:72:63:84:1f:73:67:d0:f2:ee:8f:4e:50:bf:7b:7b:87:26:ea:89:a4:e4:84:6e:1f:2a:9b:22:f6:b4:be:d8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetVersionExW
CreateEventW
GetProcAddress
GetModuleHandleW
ReadFile
GetFullPathNameW
FindNextFileW
WriteFile
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
GetFileAttributesW
DeleteFileW
GetFileSize
FlushFileBuffers
HeapFree
SetLastError
TerminateProcess
WaitForSingleObject
OpenProcess
HeapSize
DeleteCriticalSection
GlobalAlloc
GlobalFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetCurrentProcessId
GetProcessHeap
CreateProcessW
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
LoadLibraryW
FreeLibrary
LoadLibraryA
LCMapStringW
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LocalFree
DecodePointer
GetSystemTime
RaiseException
CloseHandle
GetLastError
InitializeCriticalSectionEx
CreateNamedPipeW
GetOEMCP
GetCommandLineA
GetCommandLineW
DeleteFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetSystemInfo
SetStdHandle
GetConsoleCP
HeapCompact
UnlockFile
WriteConsoleW
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTimeAsFileTime
Sleep
GetVersionExA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
InterlockedCompareExchange
EnterCriticalSection
InitializeSListHead
GetCurrentThreadId
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW
GetACP
lstrlenW
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
InitializeCriticalSectionAndSpinCount
AreFileApisANSI
HeapCreate

user32

EnumWindows
GetWindowThreadProcessId
AllowSetForegroundWindow
GetShellWindow

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
EqualSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
GetUserNameW

shell32

SHCreateDirectoryExW
SHGetFolderLocation
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetPathFromIDListW

ole32

CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoInitialize
StringFromGUID2

oleaut32

SysStringLen
VariantChangeType
VariantInit
SysFreeString
SysAllocString
VariantClear
GetErrorInfo

shlwapi

PathRemoveBackslashW
PathStripPathW
PathIsDirectoryW
PathAppendW
PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW

Sections

.text
Size: 622KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/HDCoreCustomHook.exe
.exe windows:5 windows x86 arch:x86

e6e514d44c8094043d81ce1265a03713

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:17:f5:69:e5:62:8b:ca:83:fc:52:5e:fc:52:53:1c:46:53:d8:7b:70:c0:44:e3:3a:8b:ad:75:93:a2:60:3d
Signer

Actual PE Digest

f0:17:f5:69:e5:62:8b:ca:83:fc:52:5e:fc:52:53:1c:46:53:d8:7b:70:c0:44:e3:3a:8b:ad:75:93:a2:60:3d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

LocalFree
MoveFileExW
GetFileSize
lstrcmpW
GetCurrentProcess
WaitForSingleObject
GetProcAddress
GetModuleHandleW
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetVersionExW
HeapFree
LoadLibraryW
HeapAlloc
GetProcessHeap
InitializeCriticalSectionAndSpinCount
Sleep
AreFileApisANSI
HeapCreate
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
CloseHandle
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetUserDefaultLCID
LCMapStringW
GetCurrentThreadId
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
ReleaseMutex
OpenMutexW
TerminateProcess
CreateEventW
SetEvent
GetModuleHandleExW
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLangID
GetUserDefaultUILanguage
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
DeleteFileW
GetLastError
FormatMessageW
GetFileAttributesW
CreateFileW
LocalAlloc
FindClose
GetTempPathW
GetModuleFileNameW
FindNextFileW
SetLastError
FindFirstFileW
ReadFile
FindFirstFileExW
RtlUnwind
IsValidCodePage
LoadLibraryExW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleCP
WriteConsoleW
GetTimeZoneInformation
ExitProcess
GetCurrentProcessId
ResetEvent
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW
GetStdHandle
GetCommandLineA
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetACP
GetCommandLineW

advapi32

SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
RegGetKeySecurity
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetKeySecurity
RegSetValueExW
InitializeSecurityDescriptor
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetEntriesInAclW
CreateWellKnownSid

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW

ole32

CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID
OleRun
CLSIDFromString
CoTaskMemFree

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit
VariantCopy
GetErrorInfo

shlwapi

PathIsDirectoryW
PathAppendW
PathAddExtensionW
PathIsFileSpecW
PathFileExistsA
PathRemoveFileSpecW
PathRenameExtensionW
PathFindFileNameW
PathFileExistsW
PathRemoveExtensionW

Sections

.text
Size: 721KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADC/HDBox/HDBox.pimx
packages/ADC/HDBox/HDBox.sig
.xml
packages/ADC/LCC/LCC.pima
.zip
IMSLib.dll
.dll windows:5 windows x86 arch:x86

6f00077d7fbede619d116b1254159cd1

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:cb:10:1a:57:ec:85:91:64:a5:04:5f:d8:c5:db:4f:10:53:15:d0:71:a3:af:5b:03:1a:cb:fa:8f:d9:6d:cb
Signer

Actual PE Digest

43:cb:10:1a:57:ec:85:91:64:a5:04:5f:d8:c5:db:4f:10:53:15:d0:71:a3:af:5b:03:1a:cb:fa:8f:d9:6d:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

kernel32

WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
GlobalFree
CloseHandle
CreateThread
ResetEvent
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
GetTempPathW
CreateMutexW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
SetFileAttributesW
Sleep
DeleteFileW
RaiseException
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
SystemTimeToFileTime
CreateProcessW
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetSystemTime
FlushFileBuffers
EnumSystemLocalesW
InterlockedIncrement
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
LoadLibraryW
FreeLibrary
GetLocalTime
GetTimeFormatW
GetDateFormatW
QueryPerformanceCounter
SetFilePointer
GetCurrentThreadId
GetFileSizeEx
OpenMutexW
GetFileAttributesExW
CreateSymbolicLinkW
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
IsValidLocale
GetStdHandle
GetACP
GetCurrentDirectoryW
SetStdHandle
GetUserDefaultLCID
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
InterlockedDecrement
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
EncodePointer
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

wsprintfW

advapi32

GetNamedSecurityInfoW
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
SetEntriesInAclW
CreateWellKnownSid
SetNamedSecurityInfoW

shell32

SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoCreateGuid

oleaut32

VariantChangeType
GetErrorInfo
VariantClear
SysStringLen
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
VariantInit

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsFileSpecW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathRenameExtensionW
PathFindFileNameW

Exports

Exports

IMS_EEPLogin
IMS_createRef
IMS_createRefEx
IMS_createRefExWithXMLParams
IMS_createRefForProductVersion
IMS_deregisterClientFromGroup
IMS_fetchAccessToken
IMS_fetchAccessToken2
IMS_fetchAccounts
IMS_fetchContinueToken
IMS_fetchDefaultUserInfoForClientId
IMS_fetchFeatureFlags
IMS_fetchIDPResponseForKey
IMS_fetchReleaseFlag
IMS_fetchUserProfileData
IMS_getDeviceID
IMS_getProxyCredentialsFromIMSLibSession
IMS_logOutUserForClient
IMS_registerClientToGroup
IMS_releaseData
IMS_releaseRef
IMS_revokeDeviceToken
IMS_setProxyCredentials
IMS_setProxyCredentialsInIMSLibSession
IMS_setRetryAfterResponseHandlingData
IMS_setUserAsDefaultForClientId
IMS_storeDeviceTokenAndUserProfile
IMS_storeDeviceTokenAndUserProfileEx

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
P7Native.dll
.dll windows:5 windows x86 arch:x86

9c0ecca127707bbb9f6d8d44c0861f45

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:7b:25:52:4b:89:14:47:eb:84:63:ed:cd:28:78:ae:ca:d2:51:5d:b5:8c:07:08:9b:53:06:4d:5f:42:e8:9a
Signer

Actual PE Digest

85:7b:25:52:4b:89:14:47:eb:84:63:ed:cd:28:78:ae:ca:d2:51:5d:b5:8c:07:08:9b:53:06:4d:5f:42:e8:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW

kernel32

InitializeCriticalSectionAndSpinCount
InterlockedDecrement
GetLastError
FindClose
GetSystemInfo
FindFirstFileW
FindNextFileW
GetVersionExW
DecodePointer
GetProcAddress
LocalAlloc
LocalFree
GetCurrentProcess
TerminateProcess
RaiseException
SetLastError
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
Sleep
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
CloseHandle
GetSystemTime
SystemTimeToFileTime
CreateMutexW
CreateEventW
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
GetTempPathW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GetCurrentProcessId
ReleaseSemaphore
CreateSemaphoreW
CreateDirectoryW
FreeLibrary
LoadLibraryW
FindFirstFileExA
ConnectNamedPipe
SetDllDirectoryW
CreateNamedPipeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
HeapReAlloc
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
InterlockedCompareExchange
GetFileSizeEx
lstrlenW
GetACP
CreateSymbolicLinkW
GetCurrentThreadId
GetLocalTime
CompareStringW
GetDateFormatW
OpenMutexW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
TlsFree
TlsSetValue
TlsGetValue
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
TlsAlloc
GetStringTypeW
CreateThread
GetTimeFormatW
GetStdHandle
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCurrentDirectoryW
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer

user32

wsprintfW

advapi32

RegOpenKeyExW
RegQueryValueExW
SystemFunction036
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
GetUserNameW
RegCloseKey

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHGetFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW

ole32

CoInitializeEx
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
OleRun
CoInitialize

oleaut32

SysAllocStringByteLen
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantClear
GetErrorInfo

shlwapi

PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
PathIsFileSpecW
PathRemoveFileSpecW
PathStripPathW
PathAppendW
PathRemoveBackslashW
PathRemoveExtensionW
PathAddExtensionW
PathRenameExtensionW
StrToIntExA

Exports

Exports

finalizeApplet
freeMemory
initializeApplet
processMessage

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VulcanBridge.dll
.dll windows:5 windows x86 arch:x86

8519b81977bab0195cdf68f117913b59

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:07:00:64:77:b7:82:fe:7c:df:38:e9:70:8b:4b:84:d5:6d:99:0e:71:48:1a:a1:db:82:5f:d8:14:cb:a9:a5
Signer

Actual PE Digest

60:07:00:64:77:b7:82:fe:7c:df:38:e9:70:8b:4b:84:d5:6d:99:0e:71:48:1a:a1:db:82:5f:d8:14:cb:a9:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

vulcanmessage4

?Create@IVulcanMessageDispatcher@api@vulcan@adobe@@SAPAV1234@PBDPAVIVulcanMessageListener@234@1@Z
?TYPE_PREFIX@SuiteMessage@api@vulcan@adobe@@2QBDB
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBD@Z
??1SuiteMessage@api@vulcan@adobe@@UAE@XZ
??0SuiteMessage@api@vulcan@adobe@@QAE@PBD@Z

vulcanmessage5

?TYPE_PREFIX@SuiteMessage@api5@vulcan@adobe@@2QBDB
?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PBD0@Z
?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAV1234@@Z
?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBD@Z
?SetSource@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
??1SuiteMessage@api5@vulcan@adobe@@UAE@XZ
??0SuiteMessage@api5@vulcan@adobe@@QAE@PBD@Z
??1EndPoint@api5@vulcan@adobe@@UAE@XZ

kernel32

SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
ReleaseSemaphore
CreateMutexW
WaitForSingleObject
ReleaseMutex
Sleep
GetLastError
CloseHandle
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
FlushFileBuffers
GetTempPathW
MultiByteToWideChar
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSizeEx
GetLocalTime
GetTimeFormatW
WideCharToMultiByte
GetDateFormatW
OpenMutexW
GetOEMCP
IsValidCodePage
GetConsoleCP
SetFilePointerEx
HeapSize
SetEndOfFile
WriteConsoleW
InitializeCriticalSectionAndSpinCount
FindNextFileA
FindFirstFileExA
FindClose
GetProcessHeap
ReadConsoleW
GetConsoleMode
SetStdHandle
GetFullPathNameW
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExW
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW

user32

wsprintfW

advapi32

SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExW

shlwapi

PathIsDirectoryW
PathAppendW
PathIsFileSpecW
PathRenameExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathAddExtensionW

Exports

Exports

broadcastVulcanEvent
broadcastVulcanEventForLicenseRefresh
broadcastVulcanEventForSignout

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VulcanMessage4.dll
.dll windows:5 windows x86 arch:x86

fc5b54b3753cd053154301e29bc8b0a6

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:4b:a8:38:2b:fe:ee:56:63:97:ff:03:93:bd:9f:ee:b3:98:80:33:75:43:aa:50:07:62:ed:fa:68:b9:88:d1
Signer

Actual PE Digest

7c:4b:a8:38:2b:fe:ee:56:63:97:ff:03:93:bd:9f:ee:b3:98:80:33:75:43:aa:50:07:62:ed:fa:68:b9:88:d1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
WideCharToMultiByte
LoadLibraryW
GetProcAddress
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
ExitProcess
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetFullPathNameW
CloseHandle
GetFileInformationByHandle
PeekNamedPipe
GetFileType
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
CompareStringW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile
GetTimeZoneInformation
GetFullPathNameA
WriteConsoleW
SetEnvironmentVariableA

Exports

Exports

??0EndPoint@api@vulcan@adobe@@QAE@ABV0123@@Z
??0EndPoint@api@vulcan@adobe@@QAE@XZ
??0ErrorMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0ErrorMessage@api@vulcan@adobe@@QAE@XZ
??0GetAppPathMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0GetAppPathMessage@api@vulcan@adobe@@QAE@XZ
??0GetTargetSpecifiersMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0GetTargetSpecifiersMessage@api@vulcan@adobe@@QAE@XZ
??0HostMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0HostMessage@api@vulcan@adobe@@QAE@PBD@Z
??0IVulcanMessageDispatcher@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageDispatcher@api@vulcan@adobe@@QAE@XZ
??0IVulcanMessageListener@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageListener@api@vulcan@adobe@@QAE@XZ
??0IsAppInstalledMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IsAppInstalledMessage@api@vulcan@adobe@@QAE@XZ
??0IsAppRunningMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0IsAppRunningMessage@api@vulcan@adobe@@QAE@XZ
??0LaunchAppMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0LaunchAppMessage@api@vulcan@adobe@@QAE@XZ
??0SuiteMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0SuiteMessage@api@vulcan@adobe@@QAE@PBD@Z
??0VulcanMessage@api@vulcan@adobe@@QAE@ABV0123@@Z
??0VulcanMessage@api@vulcan@adobe@@QAE@XZ
??1EndPoint@api@vulcan@adobe@@UAE@XZ
??1ErrorMessage@api@vulcan@adobe@@UAE@XZ
??1GetAppPathMessage@api@vulcan@adobe@@UAE@XZ
??1GetTargetSpecifiersMessage@api@vulcan@adobe@@UAE@XZ
??1HostMessage@api@vulcan@adobe@@UAE@XZ
??1IVulcanMessageDispatcher@api@vulcan@adobe@@UAE@XZ
??1IsAppInstalledMessage@api@vulcan@adobe@@UAE@XZ
??1IsAppRunningMessage@api@vulcan@adobe@@UAE@XZ
??1LaunchAppMessage@api@vulcan@adobe@@UAE@XZ
??1SuiteMessage@api@vulcan@adobe@@UAE@XZ
??1VulcanMessage@api@vulcan@adobe@@UAE@XZ
??4EndPoint@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4ErrorMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetAppPathMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetTargetSpecifiersMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4HostMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageDispatcher@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageListener@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IsAppInstalledMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IsAppRunningMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4LaunchAppMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4MessageUtil@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4SuiteMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4VulcanMessage@api@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??8EndPoint@api@vulcan@adobe@@QBE_NABV0123@@Z
??9EndPoint@api@vulcan@adobe@@QBE_NABV0123@@Z
??_7EndPoint@api@vulcan@adobe@@6B@
??_7ErrorMessage@api@vulcan@adobe@@6B@
??_7GetAppPathMessage@api@vulcan@adobe@@6B@
??_7GetTargetSpecifiersMessage@api@vulcan@adobe@@6B@
??_7HostMessage@api@vulcan@adobe@@6B@
??_7IVulcanMessageDispatcher@api@vulcan@adobe@@6B@
??_7IVulcanMessageListener@api@vulcan@adobe@@6B@
??_7IsAppInstalledMessage@api@vulcan@adobe@@6B@
??_7IsAppRunningMessage@api@vulcan@adobe@@6B@
??_7LaunchAppMessage@api@vulcan@adobe@@6B@
??_7SuiteMessage@api@vulcan@adobe@@6B@
??_7VulcanMessage@api@vulcan@adobe@@6B@
?APP_NOT_INSTALLED_ERROR@ErrorMessage@api@vulcan@adobe@@2QBDB
?Clone@ErrorMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetAppPathMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@HostMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@IsAppInstalledMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@IsAppRunningMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@LaunchAppMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Clone@SuiteMessage@api@vulcan@adobe@@UBEPAV1234@XZ
?Create@EndPoint@api@vulcan@adobe@@SA?AV1234@PBD@Z
?Create@IVulcanMessageDispatcher@api@vulcan@adobe@@SAPAV1234@PBDPAVIVulcanMessageListener@234@1@Z
?CreateMessage@MessageUtil@api@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?CreateMessageByType@MessageUtil@api@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?DESTINATION_UNREACHABLE_ERROR@ErrorMessage@api@vulcan@adobe@@2QBDB
?GetAppId@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?GetAppId@VulcanMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetAppIdSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetAppIdSize@VulcanMessage@api@vulcan@adobe@@QBEIXZ
?GetCmdLine@LaunchAppMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetCmdLineSize@LaunchAppMessage@api@vulcan@adobe@@QBEIXZ
?GetData@ErrorMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@GetAppPathMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@HostMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@IsAppInstalledMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@IsAppRunningMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@LaunchAppMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetData@SuiteMessage@api@vulcan@adobe@@UBEXPAD@Z
?GetDataSize@ErrorMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@GetAppPathMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@GetTargetSpecifiersMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@HostMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@IsAppInstalledMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@IsAppRunningMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@LaunchAppMessage@api@vulcan@adobe@@UBEIXZ
?GetDataSize@SuiteMessage@api@vulcan@adobe@@UBEIXZ
?GetDestinationCount@SuiteMessage@api@vulcan@adobe@@QBEIXZ
?GetDestinations@SuiteMessage@api@vulcan@adobe@@QBEXPAVEndPoint@234@@Z
?GetError@ErrorMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetErrorSize@ErrorMessage@api@vulcan@adobe@@QBEIXZ
?GetFault@ErrorMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetFaultSize@ErrorMessage@api@vulcan@adobe@@QBEIXZ
?GetFocus@LaunchAppMessage@api@vulcan@adobe@@QBE_NXZ
?GetId@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?GetIdSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetPayload@HostMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetPayload@SuiteMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetPayloadSize@HostMessage@api@vulcan@adobe@@QBEIXZ
?GetPayloadSize@SuiteMessage@api@vulcan@adobe@@QBEIXZ
?GetResult@GetAppPathMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetResult@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEXIPAD@Z
?GetResult@IsAppInstalledMessage@api@vulcan@adobe@@QBE_NXZ
?GetResult@IsAppRunningMessage@api@vulcan@adobe@@QBE_NXZ
?GetResult@LaunchAppMessage@api@vulcan@adobe@@QBE_NXZ
?GetResultCount@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEIXZ
?GetResultSize@GetAppPathMessage@api@vulcan@adobe@@QBEIXZ
?GetResultSize@GetTargetSpecifiersMessage@api@vulcan@adobe@@QBEII@Z
?GetScope@VulcanMessage@api@vulcan@adobe@@QBE?AW4MessageScope@234@XZ
?GetSource@SuiteMessage@api@vulcan@adobe@@QBE?AVEndPoint@234@XZ
?GetTargetSpecifier@GetAppPathMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@IsAppInstalledMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@IsAppRunningMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifier@LaunchAppMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTargetSpecifierSize@GetAppPathMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@IsAppInstalledMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@IsAppRunningMessage@api@vulcan@adobe@@QBEIXZ
?GetTargetSpecifierSize@LaunchAppMessage@api@vulcan@adobe@@QBEIXZ
?GetType@VulcanMessage@api@vulcan@adobe@@QBEXPAD@Z
?GetTypeSize@VulcanMessage@api@vulcan@adobe@@QBEIXZ
?GetXmlSize@EndPoint@api@vulcan@adobe@@QBEIXZ
?GetXmlSize@VulcanMessage@api@vulcan@adobe@@UBEIXZ
?INVALID_ENDPOINT@EndPoint@api@vulcan@adobe@@2V1234@B
?IsHostMessage@HostMessage@api@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?IsSuiteMessage@SuiteMessage@api@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?SetAppId@EndPoint@api@vulcan@adobe@@QAEXPBD@Z
?SetAppId@MessageUtil@api@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetCmdLine@LaunchAppMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetData@ErrorMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@GetAppPathMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@GetTargetSpecifiersMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@HostMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@IsAppInstalledMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@IsAppRunningMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@LaunchAppMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetData@SuiteMessage@api@vulcan@adobe@@UAEXPBD@Z
?SetDestination@SuiteMessage@api@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetDestinations@SuiteMessage@api@vulcan@adobe@@QAEXPBVEndPoint@234@I@Z
?SetFocus@LaunchAppMessage@api@vulcan@adobe@@QAEX_N@Z
?SetId@EndPoint@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@HostMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@HostMessage@api@vulcan@adobe@@QAEXPBDI@Z
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api@vulcan@adobe@@QAEXPBDI@Z
?SetSource@SuiteMessage@api@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetTargetSpecifier@GetAppPathMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@IsAppInstalledMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@IsAppRunningMessage@api@vulcan@adobe@@QAEXPBD@Z
?SetTargetSpecifier@LaunchAppMessage@api@vulcan@adobe@@QAEXPBD@Z
?TYPE@ErrorMessage@api@vulcan@adobe@@2QBDB
?TYPE@GetAppPathMessage@api@vulcan@adobe@@2QBDB
?TYPE@GetTargetSpecifiersMessage@api@vulcan@adobe@@2QBDB
?TYPE@IsAppInstalledMessage@api@vulcan@adobe@@2QBDB
?TYPE@IsAppRunningMessage@api@vulcan@adobe@@2QBDB
?TYPE@LaunchAppMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@HostMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@SuiteMessage@api@vulcan@adobe@@2QBDB
?TYPE_PREFIX@VulcanMessage@api@vulcan@adobe@@2QBDB
?ToXml@EndPoint@api@vulcan@adobe@@QBEXPAD@Z
?ToXml@VulcanMessage@api@vulcan@adobe@@UBEXPAD@Z

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VulcanMessage5.dll
.dll windows:6 windows x86 arch:x86

9612e1d064f9d31b91613782c931ed6c

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:87:a0:d8:1a:51:0a:04:65:7c:d9:40:c7:65:83:9c:25:01:68:1a:1c:44:a6:e8:f4:da:af:f5:c2:e6:8e:28
Signer

Actual PE Digest

75:87:a0:d8:1a:51:0a:04:65:7c:d9:40:c7:65:83:9c:25:01:68:1a:1c:44:a6:e8:f4:da:af:f5:c2:e6:8e:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
socket
shutdown
setsockopt
send
select
recv
listen
htons
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
ntohs
ntohl
htonl

kernel32

FreeEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
GetCurrentProcessId
RtlCaptureStackBackTrace
GetLocalTime
VerSetConditionMask
GetEnvironmentStringsW
GetStdHandle
SetStdHandle
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameW
LockFileEx
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
UnlockFile
WriteFile
GetTempPathW
DuplicateHandle
GetHandleInformation
SetHandleInformation
CreatePipe
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
DeviceIoControl
SetEvent
ResetEvent
ReleaseMutex
OpenMutexW
CreateEventW
SwitchToThread
GetCurrentProcess
GetExitCodeProcess
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
CreateProcessW
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
PulseEvent
WaitForMultipleObjects
GetNamedPipeInfo
CreateMailslotW
SetDllDirectoryW
CopyFileW
MoveFileExW
CreateHardLinkW
GetComputerNameW
VerifyVersionInfoW
RaiseException
Sleep
GetCurrentThread
GetCurrentThreadId
LocalAlloc
LocalReAlloc
LocalFree
FormatMessageW
LCMapStringW
SetFilePointer
GetSystemTimeAsFileTime
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
GetConsoleWindow
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
OpenSemaphoreW
GetLastError
WaitForSingleObject
CreateMutexW
ReleaseSemaphore
GetFullPathNameA
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
SetEnvironmentVariableA
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
HeapSize
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
ReadConsoleW
OpenEventW
ExitProcess
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
WaitForSingleObjectEx
GetModuleHandleW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
GetTickCount
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetDriveTypeW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

user32

GetWindowThreadProcessId
EnumWindows
GetShellWindow

advapi32

SystemFunction036
CreateProcessWithTokenW
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
StartServiceCtrlDispatcherW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExW
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
SHCreateDirectoryExW
SHFileOperationW
CommandLineToArgvW

Exports

Exports

??0EndPoint@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0EndPoint@api5@vulcan@adobe@@QAE@XZ
??0ErrorMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0ErrorMessage@api5@vulcan@adobe@@QAE@XZ
??0GetEndPointsMessage@impl@vulcan@adobe@@QAE@ABV0123@@Z
??0GetEndPointsMessage@impl@vulcan@adobe@@QAE@XZ
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageDispatcher@api5@vulcan@adobe@@QAE@XZ
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@$$QAV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0IVulcanMessageListener@api5@vulcan@adobe@@QAE@XZ
??0SuiteMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0SuiteMessage@api5@vulcan@adobe@@QAE@PBD@Z
??0VulcanMessage@api5@vulcan@adobe@@QAE@ABV0123@@Z
??0VulcanMessage@api5@vulcan@adobe@@QAE@XZ
??1EndPoint@api5@vulcan@adobe@@UAE@XZ
??1ErrorMessage@api5@vulcan@adobe@@UAE@XZ
??1GetEndPointsMessage@impl@vulcan@adobe@@UAE@XZ
??1IVulcanMessageDispatcher@api5@vulcan@adobe@@UAE@XZ
??1SuiteMessage@api5@vulcan@adobe@@UAE@XZ
??1VulcanMessage@api5@vulcan@adobe@@UAE@XZ
??4EndPoint@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4ErrorMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4GetEndPointsMessage@impl@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageDispatcher@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QAEAAV0123@$$QAV0123@@Z
??4IVulcanMessageListener@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QAEAAV0123@$$QAV0123@@Z
??4MessageUtil@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4SuiteMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??4VulcanMessage@api5@vulcan@adobe@@QAEAAV0123@ABV0123@@Z
??8EndPoint@api5@vulcan@adobe@@QBE_NABV0123@@Z
??9EndPoint@api5@vulcan@adobe@@QBE_NABV0123@@Z
??_7EndPoint@api5@vulcan@adobe@@6B@
??_7ErrorMessage@api5@vulcan@adobe@@6B@
??_7GetEndPointsMessage@impl@vulcan@adobe@@6B@
??_7IVulcanMessageDispatcher@api5@vulcan@adobe@@6B@
??_7IVulcanMessageListener@api5@vulcan@adobe@@6B@
??_7SuiteMessage@api5@vulcan@adobe@@6B@
??_7VulcanMessage@api5@vulcan@adobe@@6B@
?Clone@ErrorMessage@api5@vulcan@adobe@@UBEPAV1234@XZ
?Clone@GetEndPointsMessage@impl@vulcan@adobe@@UBEPAV1234@XZ
?Clone@SuiteMessage@api5@vulcan@adobe@@UBEPAV1234@XZ
?Create@EndPoint@api5@vulcan@adobe@@SA?AV1234@PBD@Z
?CreateMessage@MessageUtil@api5@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?CreateMessageByType@MessageUtil@api5@vulcan@adobe@@SAPAVVulcanMessage@234@PBD@Z
?DESTINATION_UNREACHABLE_ERROR@ErrorMessage@api5@vulcan@adobe@@2QBDB
?GetAppId@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppId@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppIdSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetAppIdSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetAppVersion@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppVersion@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetAppVersionSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetAppVersionSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAD0@Z
?GetData@ErrorMessage@api5@vulcan@adobe@@UBEXPAD@Z
?GetData@GetEndPointsMessage@impl@vulcan@adobe@@UBEXPAD@Z
?GetData@SuiteMessage@api5@vulcan@adobe@@UBEXPAD@Z
?GetDataSize@ErrorMessage@api5@vulcan@adobe@@UBEIXZ
?GetDataSize@GetEndPointsMessage@impl@vulcan@adobe@@UBEIXZ
?GetDataSize@SuiteMessage@api5@vulcan@adobe@@UBEIXZ
?GetDestinationCount@SuiteMessage@api5@vulcan@adobe@@QBEIXZ
?GetDestinations@SuiteMessage@api5@vulcan@adobe@@QBEXPAVEndPoint@234@@Z
?GetError@ErrorMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetErrorSize@ErrorMessage@api5@vulcan@adobe@@QBEIXZ
?GetFault@ErrorMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetFaultSize@ErrorMessage@api5@vulcan@adobe@@QBEIXZ
?GetId@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?GetIdSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PAPAV1234@@Z
?GetPayload@SuiteMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetPayloadSize@SuiteMessage@api5@vulcan@adobe@@QBEIXZ
?GetResult@GetEndPointsMessage@impl@vulcan@adobe@@QBEXPAVEndPoint@api5@34@@Z
?GetResultCount@GetEndPointsMessage@impl@vulcan@adobe@@QBEIXZ
?GetScope@VulcanMessage@api5@vulcan@adobe@@QBE?AW4MessageScope@234@XZ
?GetSource@SuiteMessage@api5@vulcan@adobe@@QBE?AVEndPoint@234@XZ
?GetSourceEndPoint@GetEndPointsMessage@impl@vulcan@adobe@@QBE?AVEndPoint@api5@34@XZ
?GetType@VulcanMessage@api5@vulcan@adobe@@QBEXPAD@Z
?GetTypeSize@VulcanMessage@api5@vulcan@adobe@@QBEIXZ
?GetXmlSize@EndPoint@api5@vulcan@adobe@@QBEIXZ
?GetXmlSize@VulcanMessage@api5@vulcan@adobe@@UBEIXZ
?INVALID_ENDPOINT@EndPoint@api5@vulcan@adobe@@2V1234@B
?IsRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QAE_NXZ
?IsSuiteMessage@SuiteMessage@api5@vulcan@adobe@@SA_NABVVulcanMessage@234@@Z
?ReleaseInstance@IVulcanMessageDispatcher@api5@vulcan@adobe@@SAXXZ
?SetAppId@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetAppId@MessageUtil@api5@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetAppVersion@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetAppVersion@MessageUtil@api5@vulcan@adobe@@SAXAAVVulcanMessage@234@PBD@Z
?SetConfig@IVulcanMessageDispatcher@api5@vulcan@adobe@@SA?AW4VulcanMessageErrorCode@@PBD0@Z
?SetData@ErrorMessage@api5@vulcan@adobe@@UAEXPBD@Z
?SetData@GetEndPointsMessage@impl@vulcan@adobe@@UAEXPBD@Z
?SetData@SuiteMessage@api5@vulcan@adobe@@UAEXPBD@Z
?SetDestination@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?SetDestinations@SuiteMessage@api5@vulcan@adobe@@QAEXPBVEndPoint@234@I@Z
?SetId@EndPoint@api5@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBD@Z
?SetPayload@SuiteMessage@api5@vulcan@adobe@@QAEXPBDI@Z
?SetRefreshEndPoints@GetEndPointsMessage@impl@vulcan@adobe@@QAEXXZ
?SetSource@SuiteMessage@api5@vulcan@adobe@@QAEXABVEndPoint@234@@Z
?TYPE@ErrorMessage@api5@vulcan@adobe@@2QBDB
?TYPE@GetEndPointsMessage@impl@vulcan@adobe@@2QBDB
?TYPE_PREFIX@SuiteMessage@api5@vulcan@adobe@@2QBDB
?TYPE_PREFIX@VulcanMessage@api5@vulcan@adobe@@2QBDB
?ToXml@EndPoint@api5@vulcan@adobe@@QBEXPAD@Z
?ToXml@VulcanMessage@api5@vulcan@adobe@@UBEXPAD@Z

Sections

.text
Size: 726KB - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_licensing_helper.exe
.exe windows:6 windows x86 arch:x86

d701106a108d6c69b6d92c482d6b2cb6

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:a9:cc:8b:35:63:70:61:30:e2:f9:5f:73:03:de:17:39:07:54:88:61:c0:37:42:e2:37:a0:6a:98:a1:91:1d
Signer

Actual PE Digest

bc:a9:cc:8b:35:63:70:61:30:e2:f9:5f:73:03:de:17:39:07:54:88:61:c0:37:42:e2:37:a0:6a:98:a1:91:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpOpen
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl

kernel32

FindFirstFileW
FindNextFileW
GetFileSizeEx
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetFullPathNameW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
DeviceIoControl
GetTempPathW
GetVersionExW
GetComputerNameExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
GetModuleHandleW
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
SetFilePointerEx
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
GetFileType
RtlUnwind
GetStringTypeW
TryEnterCriticalSection
EncodePointer
DecodePointer
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx

advapi32

SystemFunction036
CredFree
CredEnumerateW
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath

ole32

CoCreateGuid
CoTaskMemFree
CoInitialize

shlwapi

PathIsFileSpecW
PathAppendW
PathIsDirectoryW
PathAddExtensionW
UrlEscapeW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathRenameExtensionW
PathFileExistsW

bcrypt

BCryptGetProperty
BCryptVerifySignature
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCreateHash

crypt32

CertFreeCertificateContext
CryptHashCertificate2
CryptImportPublicKeyInfoEx2
CertVerifySubjectCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CryptUnprotectData
CryptProtectData
CertCreateCertificateContext

secur32

GetUserNameExW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_oobelib.dll
.dll windows:5 windows x86 arch:x86

4b85afd38ba45b63ed52bfca0d06816f

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b5:e5:cf:47:86:68:d4:4f:bd:27:7d:75:44:d2:01:60:da:b9:c0:31:1e:d1:9a:cc:1d:8d:ad:71:ca:92:9f:a3
Signer

Actual PE Digest

b5:e5:cf:47:86:68:d4:4f:bd:27:7d:75:44:d2:01:60:da:b9:c0:31:1e:d1:9a:cc:1d:8d:ad:71:ca:92:9f:a3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders

iphlpapi

GetIfTable

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW

shlwapi

PathIsDirectoryW
PathRemoveBackslashW
PathStripPathW
PathFileExistsW
PathFindFileNameW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveExtensionW

kernel32

ReleaseSemaphore
WaitForSingleObject
Sleep
LockFileEx
UnlockFileEx
GetFileSize
WriteFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
CloseHandle
CreateSemaphoreW
LoadLibraryW
GetModuleFileNameA
CreateProcessW
SetEnvironmentVariableA
CreateFileW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
CreateThread
ResumeThread
GetModuleFileNameW
WideCharToMultiByte
ReadFile
GetSystemTime
SystemTimeToFileTime
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GlobalFree
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
SetEvent
OpenEventW
GetVersionExW
WaitForMultipleObjects
CreateEventW
GetTimeZoneInformation
OutputDebugStringA
GetTempPathW
GetEnvironmentVariableA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
FindClose
FindFirstFileW
FindNextFileW
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetFileSizeEx
FileTimeToSystemTime
ReleaseMutex
OpenMutexW
LocalAlloc
GetUserDefaultLangID
GetUserDefaultUILanguage
GetModuleHandleW
ResetEvent
CreateToolhelp32Snapshot
DeleteCriticalSection
Process32FirstW
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
GetStdHandle
GetFileType
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
lstrlenW
CopyFileW
GetACP
CreateSymbolicLinkW
SetLastError
TerminateProcess
MoveFileExW
GetFileInformationByHandle
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeCriticalSection
GetLastError
LocalFree
GetProcAddress
FreeLibrary
PeekNamedPipe
SetFileTime
TzSpecificLocalTimeToSystemTime
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
ReadConsoleW
SetFilePointerEx
Process32NextW
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
FreeEnvironmentStringsW
WriteConsoleW
CreateMutexW
InitializeSListHead
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW

user32

GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW
wsprintfW

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyA
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreateWellKnownSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetKnownFolderPath

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoTaskMemFree

oleaut32

VariantClear
SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen

Exports

Exports

Adobe_OOBELib_Activate
Adobe_OOBELib_ActivateForLEIDs
Adobe_OOBELib_BackDoorUpgradeCheck
Adobe_OOBELib_CalculateVC
Adobe_OOBELib_CheckForUpgradeOnline
Adobe_OOBELib_CheckSubscriptionMode
Adobe_OOBELib_CheckSubscriptionValidity
Adobe_OOBELib_CheckSubscriptionValidityOnline
Adobe_OOBELib_CheckWFType
Adobe_OOBELib_CheckforUpgrade
Adobe_OOBELib_CleanUpCachePCD
Adobe_OOBELib_CreateRef
Adobe_OOBELib_Deactivate
Adobe_OOBELib_DeactivateLicense
Adobe_OOBELib_DeactivateLicenseForSerial
Adobe_OOBELib_DeactivateLicensesForUser
Adobe_OOBELib_DisAssociateAll
Adobe_OOBELib_EncryptDecryptSerial
Adobe_OOBELib_EnumerateKeys
Adobe_OOBELib_Generate_OffLineExcpType1_ReqCode
Adobe_OOBELib_GetAdobeId
Adobe_OOBELib_GetChallengeString_UpgradeCheck
Adobe_OOBELib_GetCredentialsForProxy
Adobe_OOBELib_GetCurrentLicenseState
Adobe_OOBELib_GetDetailedActiveLicenseInfo
Adobe_OOBELib_GetDetailedLicenseStatus
Adobe_OOBELib_GetDetailedLicenseStatusEx
Adobe_OOBELib_GetDetailedLicenseStatusExForLEIDs
Adobe_OOBELib_GetEntitlement
Adobe_OOBELib_GetEntitlementsForLEIDS
Adobe_OOBELib_GetLicenseStatus
Adobe_OOBELib_GetLicenseStatusEx
Adobe_OOBELib_GetPackagePoolDetailsForPool
Adobe_OOBELib_GetPackagePoolsForAdminForOrg
Adobe_OOBELib_GetRefID
Adobe_OOBELib_GetSerialInfo
Adobe_OOBELib_GetServiceClaimData
Adobe_OOBELib_GetValueforKeyInSubDomain
Adobe_OOBELib_Get_LegacySeatID
Adobe_OOBELib_Get_OffLineExcpType1_ReqCode
Adobe_OOBELib_Get_ProductLine
Adobe_OOBELib_Get_SeatID
Adobe_OOBELib_Getversion
Adobe_OOBELib_ISOTaggingAtInstall
Adobe_OOBELib_IsLicenseAgreementAccepted
Adobe_OOBELib_LaunchPurchaseWorkFlow
Adobe_OOBELib_LoadActivationGraceLicense
Adobe_OOBELib_LoadDBCSLicenseAndActivate
Adobe_OOBELib_LoadOfflineGraceLicense
Adobe_OOBELib_LoadOnlineTrial
Adobe_OOBELib_LoadTrial
Adobe_OOBELib_ProcessExceptionFile
Adobe_OOBELib_Process_file
Adobe_OOBELib_ProtectedContentCheck
Adobe_OOBELib_QueryLicenses
Adobe_OOBELib_QueryLicensesForUser
Adobe_OOBELib_Record_EulaOnline
Adobe_OOBELib_ReducedTrialSLConfigDownload
Adobe_OOBELib_ReleaseRef
Adobe_OOBELib_RememberAdobeID
Adobe_OOBELib_RemoveKeyInSubDomainInCache
Adobe_OOBELib_RemoveLastLoggedInUser
Adobe_OOBELib_Remove_payload
Adobe_OOBELib_RetrieveLEIDForSerial
Adobe_OOBELib_Retrieve_SerialNumber
Adobe_OOBELib_Retrieve_SerialNumberEx
Adobe_OOBELib_Retryactivation
Adobe_OOBELib_SaveAdobeId
Adobe_OOBELib_SetAdobeId
Adobe_OOBELib_SetAdobeIdExtProfile
Adobe_OOBELib_SetAppXMLData
Adobe_OOBELib_SetCallerID
Adobe_OOBELib_SetClaimStatus
Adobe_OOBELib_SetClaimStatusEx
Adobe_OOBELib_SetCredentialsForProxy
Adobe_OOBELib_SetLEID
Adobe_OOBELib_SetLicenseAgreementInformation
Adobe_OOBELib_SetSerialTypeForSerial
Adobe_OOBELib_SetUniversalCookie
Adobe_OOBELib_SetValueforKeyInSubDomainInCache
Adobe_OOBELib_Set_Eula
Adobe_OOBELib_Set_EulaOnline
Adobe_OOBELib_Set_InstallLocale
Adobe_OOBELib_Set_serialnumber
Adobe_OOBELib_SuppressRegSerialNag
Adobe_OOBELib_SuppressRegistrationNag
Adobe_OOBELib_Suppress_Eula
Adobe_OOBELib_Suppress_Registration
Adobe_OOBELib_UnregisterSerials
Adobe_OOBELib_UpdateLastLoggedInUser
Adobe_OOBELib_UpdateUserSpecificIdentity
Adobe_OOBELib_UpdateUserSpecificLicensing
Adobe_OOBELib_UpgradeCheck
Adobe_OOBELib_UpgradeDoneAtInstallTime
Adobe_OOBELib_ValidateSerialOnline
Adobe_OOBELib_Validate_SerialNumber
Adobe_OOBELib_Verify_OffLineExcpType1_ServerResponseCode
GetAsnVersion
IAL_ActivateLicense
IAL_CheckSubscription
IAL_CloseSession
IAL_CreateSession
IAL_DeactivateLicense
IAL_GetAULData
IAL_GetEntitledSerialData
IAL_GetEntitlementsForLEIDS
IAL_GetLEIDForSerial
IAL_GetPackagePoolData
IAL_GetPackagePools
IAL_GetSLConfigData
IAL_GetType2aOfflineException
IAL_GetVersion
IAL_SendAppUsageData
IAL_SendEnrolTrialRequest
IAL_SetCaller
IAL_SetEULAStatus
IAL_SetLicensingLEID
IAL_SetLoggingMethod
IAL_SetProxyDetails
IAL_ValidateSerial
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adobe_upgrade.dll
.dll windows:6 windows x86 arch:x86

6c25149a5e8f2c94cae853461fe2f8c6

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f2:a9:23:75:c0:25:7f:59:f1:3d:a9:d7:a6:fd:63:fd:5f:14:b8:3f:a0:09:72:89:f8:ac:2c:99:6d:f5:af:65
Signer

Actual PE Digest

f2:a9:23:75:c0:25:7f:59:f1:3d:a9:d7:a6:fd:63:fd:5f:14:b8:3f:a0:09:72:89:f8:ac:2c:99:6d:f5:af:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

iphlpapi

GetIfTable

shlwapi

PathStripPathW
PathRemoveBackslashW
PathRemoveBackslashA
SHDeleteEmptyKeyA
SHDeleteKeyA
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathAddExtensionW
PathRenameExtensionW
PathIsDirectoryW
PathAppendW
PathIsFileSpecW

kernel32

GetLastError
CloseHandle
lstrcmpA
lstrcpyA
lstrcatA
lstrlenA
CreateProcessA
GetStdHandle
GetFileType
WriteFile
GetCurrentThreadId
GetModuleHandleA
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
QueryPerformanceFrequency
GetThreadTimes
GetCurrentThread
WideCharToMultiByte
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetTempPathW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
CreateSemaphoreW
SetFilePointer
CreateFileW
ReadFile
SetEndOfFile
UnlockFileEx
LocalAlloc
SetFileAttributesW
LocalFree
LockFileEx
GetFileSize
FlushFileBuffers
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
Sleep
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVersionExW
GetModuleHandleW
GetModuleHandleExW
CreateEventW
SetEvent
GlobalFree
ResetEvent
HeapFree
GetCurrentProcess
HeapSize
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
GetProcessHeap
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
GetVersionExA
DeleteFileA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetComputerNameExW
OpenSemaphoreW
ResumeThread
CreateThread
SwitchToThread
lstrcmpW
lstrlenW
CopyFileW
CopyFileExW
GetVolumeInformationW
GetACP
SetCurrentDirectoryW
SetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
LoadLibraryA
GetProcAddress
FreeLibrary
GetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentDirectoryW
SetConsoleCtrlHandler
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
FileTimeToSystemTime
SetFileTime
TzSpecificLocalTimeToSystemTime
MoveFileExW
GetTimeZoneInformation
ExitProcess
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
ReadConsoleW
SetStdHandle
HeapQueryInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
WaitForMultipleObjects
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
EncodePointer
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
WaitForSingleObjectEx

user32

GetUserObjectInformationW
MessageBoxA
GetDC
ReleaseDC
wsprintfW
UnregisterClassW
GetProcessWindowStation

gdi32

GetObjectA
GetDIBits
GetDeviceCaps
DeleteObject
CreateCompatibleBitmap

advapi32

SystemFunction036
SetNamedSecurityInfoW
GetNamedSecurityInfoW
LookupPrivilegeValueW
GetUserNameW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
SetSecurityInfo
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegUnLoadKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegLoadKeyA
RegFlushKey
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderLocation
SHGetPathFromIDListW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SetErrorInfo
CreateErrorInfo
SysFreeString
SysAllocString
VariantChangeType
VariantInit
GetErrorInfo
VariantClear
SysAllocStringByteLen
SysStringLen

Exports

Exports

AULAcceptsChallengeResponse
AULCloseSession
AULGetChallengeString
AULGetQualifyingSerialNumbers
AULGetUpgradeStatus
AULIsQualifyingSerialNumberForAnyProduct
AULIsQualifyingSerialNumberForProduct
AULNeedsUpgradeCheck
AULNextProduct
AULOpenSession
AULSetQualifyingSerialNumbers
AULSetUpgradeScenario
GetAsnVersion
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 577KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dispatchtable.xml
.xml
imshelper.dll
.dll windows:6 windows x86 arch:x86

259edbcfb5cb47c36fdcea4a8f2d3871

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:43:49:e5:84:da:c5:13:0d:81:45:28:41:20:27:ca:59:36:70:b4:21:ab:4d:3b:50:4f:a1:a5:db:cc:4c:02
Signer

Actual PE Digest

69:43:49:e5:84:da:c5:13:0d:81:45:28:41:20:27:ca:59:36:70:b4:21:ab:4d:3b:50:4f:a1:a5:db:cc:4c:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpOpen
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl

kernel32

GetFileSizeEx
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
DeviceIoControl
GetTempPathW
GetVersionExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
CreateProcessW
GetModuleHandleW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
SetStdHandle
GetACP
SetFilePointerEx
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
WriteFile
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
GetFileType
GetStringTypeW
TryEnterCriticalSection
EncodePointer
DecodePointer
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind

advapi32

SystemFunction036
CredFree
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHCreateDirectoryExW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

PathIsFileSpecW
PathAppendW
PathIsDirectoryW
PathAddExtensionW
UrlEscapeW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathRenameExtensionW
PathFileExistsW

bcrypt

BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider

crypt32

CertCloseStore
CryptUnprotectData
CryptProtectData

secur32

GetUserNameExW

Exports

Exports

GetNGLDeviceIdentifier
GetNGLDeviceIdentifierForOSUser

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/IMSLib.dll
.dll windows:5 windows x64 arch:x64

7e1f3b3faa8abef600c129ed3e5e8671

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:fe:02:fa:14:fa:77:22:7e:4b:b5:b7:b0:1e:d2:07:dd:80:12:c7:90:76:44:2a:b3:b3:d7:71:62:c6:a8:e2
Signer

Actual PE Digest

7e:fe:02:fa:14:fa:77:22:7e:4b:b5:b7:b0:1e:d2:07:dd:80:12:c7:90:76:44:2a:b3:b3:d7:71:62:c6:a8:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

kernel32

WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateEventW
MultiByteToWideChar
GetLastError
SetEvent
GlobalFree
CloseHandle
CreateThread
ResetEvent
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
ReadFile
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
GetTempPathW
CreateMutexW
FindClose
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
ReleaseMutex
SetFileAttributesW
Sleep
DeleteFileW
RaiseException
DecodePointer
GetProcAddress
LocalFree
MoveFileExW
GetFileSize
SystemTimeToFileTime
CreateProcessW
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetSystemTime
EnumSystemLocalesW
ReleaseSemaphore
GetCurrentProcessId
CreateSemaphoreW
CreateDirectoryW
LoadLibraryW
FreeLibrary
GetLocalTime
GetTimeFormatW
GetDateFormatW
QueryPerformanceCounter
SetFilePointer
GetCurrentThreadId
GetFileSizeEx
OpenMutexW
GetFileAttributesExW
CreateSymbolicLinkW
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
IsValidLocale
GetStdHandle
GetACP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetUserDefaultLCID
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetConsoleCP
WriteConsoleW
FlushFileBuffers
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
RtlPcToFileHeader
EncodePointer
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

wsprintfW

advapi32

SetEntriesInAclW
SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CreateWellKnownSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW

shell32

SHGetFolderPathW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
OleRun
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoInitializeSecurity
CoInitializeEx
CoCreateGuid

oleaut32

VariantChangeType
GetErrorInfo
VariantClear
SysStringLen
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
VariantInit

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsFileSpecW
PathIsDirectoryW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
PathRenameExtensionW
PathFindFileNameW

Exports

Exports

IMS_EEPLogin
IMS_createRef
IMS_createRefEx
IMS_createRefExWithXMLParams
IMS_createRefForProductVersion
IMS_deregisterClientFromGroup
IMS_fetchAccessToken
IMS_fetchAccessToken2
IMS_fetchAccounts
IMS_fetchContinueToken
IMS_fetchDefaultUserInfoForClientId
IMS_fetchFeatureFlags
IMS_fetchIDPResponseForKey
IMS_fetchReleaseFlag
IMS_fetchUserProfileData
IMS_getDeviceID
IMS_getProxyCredentialsFromIMSLibSession
IMS_logOutUserForClient
IMS_registerClientToGroup
IMS_releaseData
IMS_releaseRef
IMS_revokeDeviceToken
IMS_setProxyCredentials
IMS_setProxyCredentialsInIMSLibSession
IMS_setRetryAfterResponseHandlingData
IMS_setUserAsDefaultForClientId
IMS_storeDeviceTokenAndUserProfile
IMS_storeDeviceTokenAndUserProfileEx

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/imshelper.dll
.dll windows:6 windows x64 arch:x64

934608716f8745db55b9b0a4e96a9144

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:9f:36:8d:fa:42:b6:89:fd:28:f6:7d:d2:39:bd:64:96:43:f5:ed:be:57:26:94:c4:3c:3d:41:d4:67:2e:f8
Signer

Actual PE Digest

42:9f:36:8d:fa:42:b6:89:fd:28:f6:7d:d2:39:bd:64:96:43:f5:ed:be:57:26:94:c4:3c:3d:41:d4:67:2e:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

winhttp

WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData

kernel32

GetFileSizeEx
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
DeviceIoControl
GetTempPathW
GetVersionExW
FileTimeToSystemTime
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetProcAddress
CreateProcessW
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetCurrentThreadId
GetDateFormatW
OpenMutexW
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
ReadConsoleW
FindFirstFileExA
SetStdHandle
GetACP
SetFilePointerEx
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
WriteFile
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetTimeZoneInformation
ReadFile
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapSize
SetEndOfFile
GetTimeFormatW
GetFileType
GetStringTypeW
TryEnterCriticalSection
RtlPcToFileHeader
EncodePointer
DecodePointer
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
IsProcessorFeaturePresent
QueueUserWorkItem
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx

advapi32

SystemFunction036
CredFree
CredReadW
CredWriteW
GetUserNameW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
CredDeleteW

shell32

SHGetKnownFolderPath
SHCreateDirectoryExW

ole32

CoCreateGuid
CoTaskMemFree

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFileExistsW
PathAddExtensionW
PathIsFileSpecW
PathAppendW
PathIsDirectoryW
UrlEscapeW
PathRenameExtensionW

bcrypt

BCryptHashData
BCryptDestroyHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash

crypt32

CertCloseStore
CryptUnprotectData
CryptProtectData

secur32

GetUserNameExW

Exports

Exports

GetNGLDeviceIdentifier
GetNGLDeviceIdentifierForOSUser

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 703KB - Virtual size: 702KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADC/LCC/LCC.pimx
packages/ADC/LCC/LCC.sig
.xml
packages/ADC/Runtime/Runtime.pima
.zip
customhook/RuntimeCustomHook.exe
.exe windows:5 windows x86 arch:x86

a86d2f6618f0ca766d767ca663a73ad1

Code Sign

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:03:41:d1:c9:55:d9:7e:8e:5e:04:ef:be:e1:f9:c9:5e:cc:d5:f7:b7:5e:cf:8e:ca:76:ae:3e:bf:46:6e:62
Signer

Actual PE Digest

01:03:41:d1:c9:55:d9:7e:8e:5e:04:ef:be:e1:f9:c9:5e:cc:d5:f7:b7:5e:cf:8e:ca:76:ae:3e:bf:46:6e:62

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord113

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
GetLastError
DeleteFileW
CloseHandle
LocalFree
MoveFileExW
lstrcmpW
FlushFileBuffers
HeapFree
SetLastError
GetCurrentProcess
TerminateProcess
InitializeCriticalSectionEx
WaitForSingleObject
HeapSize
CreateEventW
SetEvent
HeapReAlloc
RaiseException
ResetEvent
HeapAlloc
DecodePointer
GetProcAddress
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
SetFilePointer
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLangID
FreeLibrary
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
SystemTimeToFileTime
GetDateFormatW
CreateMutexW
ReleaseMutex
OpenMutexW
GetUserDefaultLCID
LCMapStringW
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultUILanguage
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetFileType
GetACP
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
WriteFile
FindNextFileW
TlsAlloc
FindFirstFileW
ReadFile
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
SetEndOfFile
WriteConsoleW
InitializeCriticalSectionAndSpinCount
EncodePointer
DeleteCriticalSection
GetStdHandle
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
GetStringTypeW

advapi32

RegCloseKey
SystemFunction036
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

oleaut32

VariantClear

shlwapi

PathFileExistsW
PathFindFileNameW
PathRenameExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
PathAppendW
PathRemoveFileSpecW

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc10/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

a1f6f100bff4507a3332f3f0cdfc24f5

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

58:5d:c5:26:99:03:d9:98:d7:bd:f4:32:05:e3:4e:3b:e4:dd:15:47
Signer

Actual PE Digest

58:5d:c5:26:99:03:d9:98:d7:bd:f4:32:05:e3:4e:3b:e4:dd:15:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf

advapi32

InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor

kernel32

CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime

user32

SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow

ntdll

NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.5MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
customhook/vc10/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

a1f6f100bff4507a3332f3f0cdfc24f5

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f
Signer

Actual PE Digest

3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

msvcrt

__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf

advapi32

InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor

kernel32

CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime

user32

SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow

ntdll

NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.8MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
customhook/vc12/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

33c6db41ca15b47cfcec52de6c2ab2b7

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:3c:0e:d0:e9:29:66:d4:05:e1:26:24:9d:da:d9:c0:63:79:c5:68:38:c7:69:c5:25:f3:62:ab:0e:b8:a4:f6
Signer

Actual PE Digest

51:3c:0e:d0:e9:29:66:d4:05:e1:26:24:9d:da:d9:c0:63:79:c5:68:38:c7:69:c5:25:f3:62:ab:0e:b8:a4:f6

Digest Algorithm

sha256

PE Digest Matches

true

8c:12:40:11:a9:d9:22:02:f1:9b:18:34:2a:70:2d:89:dc:3c:69:a5
Signer

Actual PE Digest

8c:12:40:11:a9:d9:22:02:f1:9b:18:34:2a:70:2d:89:dc:3c:69:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CopyFileExW
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
ResetEvent
SetEndOfFile
DeleteFileW
GetThreadLocale
UnmapViewOfFile
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetLocalTime
SetFilePointer
GetComputerNameW
CreateFileA
GetProcessHeap
GetModuleHandleA
CopyFileW
MoveFileExW
GlobalFree
GlobalAlloc
GetFileSizeEx
GetCurrentDirectoryW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
RaiseException
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FormatMessageW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
CompareStringW
InitializeCriticalSection
CloseHandle
LocalFree
ReleaseMutex
GetVersionExW
GetProcessId
ReadFile
CreateNamedPipeW
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
WaitForSingleObject
OpenProcess
CreateFileW
SetFilePointerEx
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
VerifyVersionInfoW
VerSetConditionMask
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
GetExitCodeProcess
SetThreadExecutionState
FlushFileBuffers

msi

ord171
ord45
ord137
ord125
ord17
ord8
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
ord118
ord115
ord116
ord205

shell32

SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW

rpcrt4

UuidCreate

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetSetOptionW
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
StretchBlt

cabinet

ord23
ord22
ord20

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SetNamedSecurityInfoW
AllocateAndInitializeSid
CheckTokenMembership
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegOpenKeyExW
GetTokenInformation
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfigW
DecryptFileW
SetEntriesInAclW
InitializeAcl
CreateWellKnownSid
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceConfigW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

ole32

CLSIDFromProgID
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
StringFromGUID2

user32

LoadBitmapW
IsWindow
PostMessageW
PeekMessageW
GetMessageW
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
CreateWindowExW
RegisterClassW
MsgWaitForMultipleObjects
LoadCursorW
PostQuitMessage
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
PostThreadMessageW
MessageBoxW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc12/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

33c6db41ca15b47cfcec52de6c2ab2b7

Code Sign

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:12

Not After

04/12/2013, 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:21:a8:7f:5a:3b:9a:0a:03:ac:c7:ff:64:14:0d:fb:d7:83:d6:35:6f:b3:45:b4:6a:5d:07:98:a0:f2:ce:30
Signer

Actual PE Digest

f9:21:a8:7f:5a:3b:9a:0a:03:ac:c7:ff:64:14:0d:fb:d7:83:d6:35:6f:b3:45:b4:6a:5d:07:98:a0:f2:ce:30

Digest Algorithm

sha256

PE Digest Matches

true

fa:4d:cd:f6:4c:96:60:0c:ed:96:a4:ab:84:4d:56:72:9b:e5:6f:2f
Signer

Actual PE Digest

fa:4d:cd:f6:4c:96:60:0c:ed:96:a4:ab:84:4d:56:72:9b:e5:6f:2f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CopyFileExW
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
ResetEvent
SetEndOfFile
DeleteFileW
GetThreadLocale
UnmapViewOfFile
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetLocalTime
SetFilePointer
GetComputerNameW
CreateFileA
GetProcessHeap
GetModuleHandleA
CopyFileW
MoveFileExW
GlobalFree
GlobalAlloc
GetFileSizeEx
GetCurrentDirectoryW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
RaiseException
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FormatMessageW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetTimeZoneInformation
CompareStringW
InitializeCriticalSection
CloseHandle
LocalFree
ReleaseMutex
GetVersionExW
GetProcessId
ReadFile
CreateNamedPipeW
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
WaitForSingleObject
OpenProcess
CreateFileW
SetFilePointerEx
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
VerifyVersionInfoW
VerSetConditionMask
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
GetExitCodeProcess
SetThreadExecutionState
FlushFileBuffers

msi

ord171
ord45
ord137
ord125
ord17
ord8
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
ord118
ord115
ord116
ord205

shell32

SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW

rpcrt4

UuidCreate

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetSetOptionW
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

gdi32

DeleteDC
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
StretchBlt

cabinet

ord23
ord22
ord20

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SetNamedSecurityInfoW
AllocateAndInitializeSid
CheckTokenMembership
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegOpenKeyExW
GetTokenInformation
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfigW
DecryptFileW
SetEntriesInAclW
InitializeAcl
CreateWellKnownSid
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceConfigW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

ole32

CLSIDFromProgID
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
StringFromGUID2

user32

LoadBitmapW
IsWindow
PostMessageW
PeekMessageW
GetMessageW
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
CreateWindowExW
RegisterClassW
MsgWaitForMultipleObjects
LoadCursorW
PostQuitMessage
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
PostThreadMessageW
MessageBoxW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 312KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc13/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:b3:48:1e:88:d9:0e:2c:be:6a:8c:11:b0:ca:01:0d:03:6c:ae:3c:b7:4b:f3:3f:f2:38:70:bc:db:8e:3b:44
Signer

Actual PE Digest

f7:b3:48:1e:88:d9:0e:2c:be:6a:8c:11:b0:ca:01:0d:03:6c:ae:3c:b7:4b:f3:3f:f2:38:70:bc:db:8e:3b:44

Digest Algorithm

sha256

PE Digest Matches

true

53:e7:06:12:cd:06:8c:a2:85:86:35:60:30:63:3f:87:4f:05:82:af
Signer

Actual PE Digest

53:e7:06:12:cd:06:8c:a2:85:86:35:60:30:63:3f:87:4f:05:82:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc13/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:27:97:21:2a:b7:e5:8c:21:be:ad:02:8f:47:7b:69:f2:50:43:38:08:e0:1e:fe:0e:16:24:16:37:c4:61:c3
Signer

Actual PE Digest

8e:27:97:21:2a:b7:e5:8c:21:be:ad:02:8f:47:7b:69:f2:50:43:38:08:e0:1e:fe:0e:16:24:16:37:c4:61:c3

Digest Algorithm

sha256

PE Digest Matches

true

8e:75:58:f3:0e:54:bd:7d:de:84:0e:27:cb:f3:ea:45:35:d6:b6:1d
Signer

Actual PE Digest

8e:75:58:f3:0e:54:bd:7d:de:84:0e:27:cb:f3:ea:45:35:d6:b6:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc14/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:c8:81:e0:51:e2:8e:90:c8:a7:97:a3:4e:8f:3d:38:59:24:5d:52:bc:07:ba:87:3a:30:d2:24:e0:ba:a1:aa
Signer

Actual PE Digest

78:c8:81:e0:51:e2:8e:90:c8:a7:97:a3:4e:8f:3d:38:59:24:5d:52:bc:07:ba:87:3a:30:d2:24:e0:ba:a1:aa

Digest Algorithm

sha256

PE Digest Matches

true

ee:06:44:fc:5a:c2:b4:0b:19:cb:7f:50:20:2a:e5:aa:eb:62:28:ad
Signer

Actual PE Digest

ee:06:44:fc:5a:c2:b4:0b:19:cb:7f:50:20:2a:e5:aa:eb:62:28:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc14/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:45:2a:56:c0:f3:81:46:af:6e:89:37:2e:28:2d:43:8a:9b:a7:92:9e:fa:29:02:73:52:a4:92:90:15:b8:a2
Signer

Actual PE Digest

04:45:2a:56:c0:f3:81:46:af:6e:89:37:2e:28:2d:43:8a:9b:a7:92:9e:fa:29:02:73:52:a4:92:90:15:b8:a2

Digest Algorithm

sha256

PE Digest Matches

true

a1:bd:bd:a0:3c:24:17:06:25:9d:6a:4b:c5:08:02:76:a5:e3:dc:72
Signer

Actual PE Digest

a1:bd:bd:a0:3c:24:17:06:25:9d:6a:4b:c5:08:02:76:a5:e3:dc:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc17/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:2b:c4:a7:3c:56:b7:ed:a7:14:86:5a:fe:b0:3b:c3:96:3a:6c:11:2e:c6:ed:8d:c8:7f:98:31:fc:b1:eb:40
Signer

Actual PE Digest

73:2b:c4:a7:3c:56:b7:ed:a7:14:86:5a:fe:b0:3b:c3:96:3a:6c:11:2e:c6:ed:8d:c8:7f:98:31:fc:b1:eb:40

Digest Algorithm

sha256

PE Digest Matches

true

e1:12:58:68:88:a9:18:19:7a:3e:85:2f:55:f8:48:8c:05:a8:0e:82
Signer

Actual PE Digest

e1:12:58:68:88:a9:18:19:7a:3e:85:2f:55:f8:48:8c:05:a8:0e:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc17/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

8e2588a9cf43886de3449dfff03137b6

Code Sign

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:95:84:a5:67:91:df:4b:a8:b1:90:da:4d:59:73:e3:22:fb:cf:bb:15:59:5c:2f:5e:6c:33:3e:6a:5f:66:2a
Signer

Actual PE Digest

63:95:84:a5:67:91:df:4b:a8:b1:90:da:4d:59:73:e3:22:fb:cf:bb:15:59:5c:2f:5e:6c:33:3e:6a:5f:66:2a

Digest Algorithm

sha256

PE Digest Matches

true

be:28:93:02:a1:20:1e:fb:a5:81:12:3e:e2:96:71:53:75:f8:e7:95
Signer

Actual PE Digest

be:28:93:02:a1:20:1e:fb:a5:81:12:3e:e2:96:71:53:75:f8:e7:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc

advapi32

QueryServiceConfigW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner

user32

GetMessageW
PeekMessageW
PostMessageW
IsWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
IsDialogMessageW
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
BeginPaint
EndPaint
GetCursorPos
MonitorFromPoint
GetMonitorInfoW
ReleaseDC
MessageBoxW
PostThreadMessageW
RegisterClassW
CreateWindowExW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdi32

GetDeviceCaps
CreateDCW

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
StringFromGUID2
CoInitializeSecurity
CLSIDFromProgID

kernel32

GetCurrentProcess
InitializeCriticalSection
TlsFree
DeleteCriticalSection
CloseHandle
TlsGetValue
Sleep
GetLastError
ReleaseMutex
TlsSetValue
TlsAlloc
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
HeapAlloc
GetSystemDefaultLangID
GetUserDefaultLangID
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
HeapSetInformation
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
IsProcessorFeaturePresent
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GlobalFree
MoveFileExW
CopyFileW
GetFileSizeEx
GetModuleHandleA
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
UnmapViewOfFile
IsDebuggerPresent
DuplicateHandle
HeapFree
FormatMessageW
GetTempFileNameW
GetWindowsDirectoryW
CompareStringA
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
ExitProcess
SetUnhandledExceptionFilter
GetStartupInfoW
GetCommandLineW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap

cabinet

ord22
ord20
ord23

crypt32

CertGetCertificateContextProperty
CryptHashPublicKeyInfo

msi

ord88
ord17
ord125
ord116
ord115
ord118
ord8
ord171
ord205
ord45
ord137
ord141
ord238
ord190
ord169
ord90
ord173
ord111
ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wixburn
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
customhook/vc8/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

c63ba316533609531fac22f3877f847b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bc:02:7c:76:1b:ab:4d:a5:a9:3e:ef:53:79:b8:ae:b4:89:fe:1d:3d
Signer

Actual PE Digest

bc:02:7c:76:1b:ab:4d:a5:a9:3e:ef:53:79:b8:ae:b4:89:fe:1d:3d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA

kernel32

LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GlobalFree
GlobalUnlock
GlobalLock
GetProcAddress
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
ReadFile
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalAlloc

gdi32

GetDeviceCaps

user32

ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
customhook/vc8/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

c63ba316533609531fac22f3877f847b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

91:00:06:49:02:66:e1:2d:cc:0c:a3:f2:e7:0d:20:81:90:4d:81:78
Signer

Actual PE Digest

91:00:06:49:02:66:e1:2d:cc:0c:a3:f2:e7:0d:20:81:90:4d:81:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA

kernel32

LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GlobalFree
GlobalUnlock
GlobalLock
GetProcAddress
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
ReadFile
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalAlloc

gdi32

GetDeviceCaps

user32

ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
customhook/vc9/32bit/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:9f:10:fb:28:5b:a0:06:4b:55:37:02:3f:8b:c9:e0:6e:17:38:01
Signer

Actual PE Digest

0a:9f:10:fb:28:5b:a0:06:4b:55:37:02:3f:8b:c9:e0:6e:17:38:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.0MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
customhook/vc9/64bit/vcredist_x64.exe
.exe windows:5 windows x86 arch:x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:56:0e:fe:ba:e2:85:5d:f6:10:c9:7e:d6:ca:21:9e:37:89:68:0f
Signer

Actual PE Digest

53:56:0e:fe:ba:e2:85:5d:f6:10:c9:7e:d6:ca:21:9e:37:89:68:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.7MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
packages/ADC/Runtime/Runtime.pimx
packages/ADC/Runtime/Runtime.sig
.xml
packages/ApplicationInfo.xml
.xml

Sharing

General

Malware Config

Signatures

Files

5b3e6afc3f0e1189239b8b04658ee25a

Code Sign

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

07:af:3f:68:36:ed:fd:d3:a3:41:3f:3a:c7:2b:e8:71:53:a5:d9:9b:3e:6d:d0:c3:d6:a0:92:df:bb:f6:74:61Signer

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

shell32

shlwapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

bcrypt

secur32

crypt32

wintrust

comctl32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 439KB - Virtual size: 439KB

.data Size: 32KB - Virtual size: 64KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 102KB - Virtual size: 101KB

b78757e60c78fbd8d0549e7a1e0d29a1

Code Sign

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2fCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

ac:7d:c4:d6:78:b5:cd:0d:da:54:a6:bd:90:ba:4d:9e:d0:98:05:62:5d:95:08:08:69:0a:ff:f1:ac:cd:d5:43Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shell32

Sections

.text Size: 748KB - Virtual size: 747KB

.rdata Size: 197KB - Virtual size: 196KB

.data Size: 17KB - Virtual size: 33KB

.gfids Size: 1024B - Virtual size: 596B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 46KB - Virtual size: 46KB

.reloc Size: 44KB - Virtual size: 44KB

06:f2:4d:9f:4d:b0:7b:d7:ec:ad:06:7f:5e:e2:6c:29
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

07:af:3f:68:36:ed:fd:d3:a3:41:3f:3a:c7:2b:e8:71:53:a5:d9:9b:3e:6d:d0:c3:d6:a0:92:df:bb:f6:74:61
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 439KB - Virtual size: 439KB

.data
Size: 32KB - Virtual size: 64KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 102KB - Virtual size: 101KB

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2f
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

ac:7d:c4:d6:78:b5:cd:0d:da:54:a6:bd:90:ba:4d:9e:d0:98:05:62:5d:95:08:08:69:0a:ff:f1:ac:cd:d5:43
Signer

.text
Size: 748KB - Virtual size: 747KB

.rdata
Size: 197KB - Virtual size: 196KB

.data
Size: 17KB - Virtual size: 33KB

.gfids
Size: 1024B - Virtual size: 596B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 46KB - Virtual size: 46KB

.reloc
Size: 44KB - Virtual size: 44KB

0a:28:51:e5:f0:ff:db:46:e2:c9:cb:66:10:e6:51:2f
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

45:89:c1:a8:6a:c2:59:11:0f:f3:d0:dd:de:2c:9f:61:14:dd:37:fb:38:82:82:1c:83:5d:79:6e:28:bc:74:54
Signer

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 4KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 512B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

81:00:34:36:b5:50:17:84:cb:60:33:ba:8a:31:d0:db:11:b9:94:14:f7:23:71:c0:95:67:d0:b8:d9:c6:89:a2
Signer

.text
Size: 270KB - Virtual size: 270KB

.rdata
Size: 86KB - Virtual size: 85KB

.data
Size: 9KB - Virtual size: 13KB

.gfids
Size: 1024B - Virtual size: 680B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 16KB - Virtual size: 16KB

06:b9:22:a8:39:7e:63:2f:e5:34:8d:a2:67:27:5b:4f
Certificate