WiseVector_StopX_V306[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WiseVector_StopX_V306.exe
Size

49.3MB
MD5

fdf7bdce4370c327c1db83f5cbad4b68
SHA1

f57e14b97444bfdb6006eeae1c51b9b90ebf2239
SHA256

bf35cca63b5d5cfe26963f52a6cf2535d33dce28a2fb8adad048381fbdcbf914
SHA512

426107cd2ae11e7d8b7804e3fcab10044fb1076e65c0c83cdcb820ae3a8431e1aae7604400df1bd30fb4d633cbe45515c4e85de0cc0181937953e3a984df0d63
SSDEEP

786432:IRqxTye1BMUz0k1CrVdSMJDPbVjA02/j7nRiS+MFHbUJnvdQUQRmZAL54eE1:IoxTyQ1wzSM3AH/j74S+obmnWd3Sek

Score

3^/10

Malware Config

Signatures

Unsigned PE 19 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsis7zU.dll
unpack003/7z.dll
unpack003/lib/_ctypes.pyd
unpack003/lib/_elementtree.pyd
unpack003/lib/_hashlib.pyd
unpack003/lib/_socket.pyd
unpack003/lib/_ssl.pyd
unpack003/lib/bz2.pyd
unpack003/lib/lxml.etree.pyd
unpack003/lib/select.pyd
unpack003/lib/unicodedata.pyd
unpack003/libcrypto-1_1.dll
unpack003/python27.dll
unpack005/$PLUGINSDIR/BgWorker.dll
unpack005/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/nsProcess.dll

Files

WiseVector_StopX_V306.exe
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:4d:38:1d:77:77:46:2a:e9:ca:6b:cc:b4:8c:1e:30:c7:33:f5:63:70:ac:6d:9c:69:67:ce:4d:a1:cd:87:4c
Signer

Actual PE Digest

52:4d:38:1d:77:77:46:2a:e9:ca:6b:cc:b4:8c:1e:30:c7:33:f5:63:70:ac:6d:9c:69:67:ce:4d:a1:cd:87:4c

Digest Algorithm

sha256

PE Digest Matches

true

92:2f:08:e9:36:df:d0:c3:f1:00:aa:df:b0:f1:48:f2:5e:66:85:64
Signer

Actual PE Digest

92:2f:08:e9:36:df:d0:c3:f1:00:aa:df:b0:f1:48:f2:5e:66:85:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 788KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BgWorker.dll
.dll windows:4 windows x86 arch:x86

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread

user32

IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects

Exports

Exports

CallAndWait

Sections

.text
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/licence.rtf
.rtf
$PLUGINSDIR/logo.ico
$PLUGINSDIR/nsNiuniuSkin.dll
.dll windows:5 windows x86 arch:x86

d5c478d000c5c26f099a32477a25dc97

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

73:09:a2:53:fc:80:74:f3:53:a6:0d:5b:a0:4d:e2:97
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

10/10/2016, 00:00

Not After

09/12/2019, 23:59

Subject

CN=Shao zhengjun,OU=Individual Developer,O=No Organization Affiliation,L=Shenzhen,ST=Guang Dong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:86:89:46:8e:90:7a:0e:b2:b2:b8:2b:e4:7b:b4:49:1e:f6:66:d9
Signer

Actual PE Digest

86:86:89:46:8e:90:7a:0e:b2:b2:b8:2b:e4:7b:b4:49:1e:f6:66:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\NiuNiuCapture\niuniu_src\nsNiuniuSkin\plugin\nsNiuniuDui\bin\nsNiuniuDUI.pdb

Imports

kernel32

TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapAlloc
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetModuleFileNameA
SetFilePointer
CloseHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
CreateFileW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
LoadLibraryA
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
TlsAlloc
MulDiv
lstrlenW
LoadLibraryW
GetCurrentDirectoryW
GetFileSize
GlobalUnlock
GlobalLock
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
LocalFree
FormatMessageW
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryW
GetFileAttributesW
SetFileTime
lstrcmpiW
GetLocalTime
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
RtlUnwind
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedDecrement
InterlockedIncrement
TlsGetValue
GetProcAddress
CreateFileA
GetModuleHandleW
GetModuleHandleA
lstrcpyW
GlobalFree
lstrcpynW
WideCharToMultiByte
GlobalAlloc
ExitProcess
MultiByteToWideChar
lstrlenA

user32

GetCaretBlinkTime
KillTimer
GetFocus
ReleaseCapture
GetCursorPos
MapWindowPoints
IsWindowVisible
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetActiveWindow
InvalidateRect
SetCapture
FillRect
DrawTextW
CharPrevW
SetRect
UpdateLayeredWindow
MoveWindow
GetWindowRgn
SetForegroundWindow
IsWindowEnabled
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
GetWindowTextLengthW
GetWindowTextW
EqualRect
MessageBoxW
SetWindowRgn
IsZoomed
IsIconic
GetCaretPos
CreatePopupMenu
AppendMenuW
EnableMenuItem
TrackPopupMenu
DestroyMenu
IntersectRect
CharNextW
SetTimer
PtInRect
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetCursor
UnionRect
InflateRect
OffsetRect
SetPropW
GetPropW
GetWindowLongW
CallWindowProcW
GetClassInfoExW
RegisterClassExW
LoadCursorW
RegisterClassW
GetSystemMetrics
LoadImageW
SendMessageW
GetParent
MonitorFromWindow
GetMonitorInfoW
GetWindow
EnableWindow
SetFocus
PostQuitMessage
ShowWindow
SetWindowLongW
CreateWindowExW
DefWindowProcW
UpdateWindow
GetClientRect
GetDC
ScreenToClient
DispatchMessageW
SetWindowTextW
IsWindow
SetWindowPos
TranslateMessage
PostMessageW
GetMessageW
GetWindowRect
DestroyWindow
GetKeyState
ReleaseDC
wsprintfW
GetSysColor

shell32

SHBrowseForFolderW
DragQueryFileW
SHGetPathFromIDListW

ole32

OleDuplicateData
RegisterDragDrop
CreateStreamOnHGlobal
ReleaseStgMedium
CLSIDFromString
OleLockRunning
CoCreateInstance
DoDragDrop
CoInitialize
CLSIDFromProgID

gdi32

BitBlt
CloseEnhMetaFile
SaveDC
SelectObject
RestoreDC
GetTextMetricsW
GetObjectW
DeleteObject
CreateFontIndirectW
AddFontMemResourceEx
SetWindowOrgEx
CreateCompatibleDC
GetDeviceCaps
PlayEnhMetaFile
CreateCompatibleBitmap
GetEnhMetaFileHeader
CreateDIBitmap
GetStockObject
CreateRoundRectRgn
CreatePen
DeleteDC
RemoveFontMemResourceEx
SetBitmapBits
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
GetObjectA
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
GdiFlush
PtInRegion
CreateRectRgn
GetBitmapBits
CreateEnhMetaFileW

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipAlloc
GdipFree
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipDeleteBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCloneBrush
GdipCreateSolidFill
GdipDeletePen
GdipDrawRectangleI
GdipSetPenMode
GdipCreatePen1
GdipDeleteFont
GdipDeleteStringFormat
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDrawImageRectI
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem

Exports

Exports

BindCallBack
BindCallBackEx
ExitDUISetup
GetControlAttribute
GetWindowSize
InitSkinPage
InitSkinSubPage
ResetLicenseFile
SelectInstallDir
SelectInstallDirEx
SetControlAttribute
SetWindowSize
SetWindowTile
ShowPage
ShowPageItem
ShowSkinSubPage
StringHelper

Sections

.text
Size: 729KB - Virtual size: 729KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

d6b0243dd90845123f35b66da1032c84

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
lstrcpynW
GlobalAlloc

user32

wsprintfW

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1024B - Virtual size: 993B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7zU.dll
.dll windows:6 windows x86 arch:x86

b6854db8fde386e6ef367d623b9e75d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetStdHandle
ReadFile
WriteFile
WaitForMultipleObjects
AreFileApisANSI
SetFileApisToOEM
SetFileApisToANSI
GlobalAlloc
GlobalFree
lstrcpynW
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
CreateDirectoryW
CreateFileW
DeleteFileW
GetFullPathNameW
EnterCriticalSection
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
lstrlenW
MoveFileW
FindClose
FindFirstFileW
GetFileSize
SetEndOfFile
SetFilePointer
GetCurrentProcess
GetSystemInfo
GetModuleHandleW
GetProcAddress
GetStringTypeW
WriteConsoleW
SetFilePointerEx
SetStdHandle
LCMapStringW
GetVersionExW
VirtualFree
GetTempFileNameW
VirtualAlloc
OutputDebugStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
HeapAlloc
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
HeapReAlloc
GetCommandLineA
GetProcessHeap
InterlockedDecrement
ExitProcess
GetModuleHandleExW
SetLastError
InterlockedIncrement
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
HeapSize
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

FindWindowExW
SetWindowTextW
GetDlgItem
SendMessageW
wsprintfW
CharLowerW
CharUpperW

oleaut32

VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
SysFreeString

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/skin.zip
.zip
arrow_down.png
.png
arrow_up.png
.png
bgbottom.png
.png
bk_shadow.png
.png
configpage.xml
default.xml
.xml
finishpage.xml
finishpage_xp.xml
form/bg.png
.png
form/bk_down.png
.png
form/btn_down_hovered.png
.png
form/btn_down_normal.png
.png
form/btn_down_pressed.png
.png
form/btn_installation_disable.png
.png
form/btn_installation_hovered.png
.png
form/btn_installation_normal.png
.png
form/btn_installation_pressed.png
.png
form/btn_path_hovered.png
.png
form/btn_path_normal.png
.png
form/btn_path_pressed.png
.png
form/btn_up_hovered.png
.png
form/btn_up_normal.png
.png
form/btn_up_pressed.png
.png
form/error.png
.png
form/fg.png
.png
form/infor.png
.png
form/ok.png
.png
form/pic.png
.png
form/question.png
.png
form/uninstall.png
.png
form/warning.png
.png
install.xml
installingpage.xml
license_bg.png
.png
licensepage.xml
msgBox.xml
.xml
msgWarning.png
.png
process_bottom.png
.png
process_top.png
.png
public/bk/bk_shadow.png
.png
public/button/btn_global_green_80x30_hovered.png
.png
public/button/btn_global_green_80x30_normal.png
.png
public/button/btn_global_green_80x30_pushed.png
.png
public/button/btn_global_white_80x30_hovered.png
.png
public/button/btn_global_white_80x30_normal.png
.png
public/button/btn_global_white_80x30_pushed.png
.png
public/button/btn_wnd_close_hovered.png
.png
public/button/btn_wnd_close_pushed.png
.png
public/button/btn_wnd_gray_close.png
.png
public/button/btn_wnd_gray_max.png
.png
public/button/btn_wnd_gray_max_hovered.png
.png
public/button/btn_wnd_gray_max_pushed.png
.png
public/button/btn_wnd_gray_min.png
.png
public/button/btn_wnd_gray_min_hovered.png
.png
public/button/btn_wnd_gray_min_pushed.png
.png
public/button/btn_wnd_gray_restore.png
.png
public/button/btn_wnd_gray_restore_hovered.png
.png
public/button/btn_wnd_gray_restore_pushed.png
.png
public/button/btn_wnd_white_close.png
.png
public/button/btn_wnd_white_min.png
.png
public/button/btn_wnd_white_min_hovered.png
.png
public/button/btn_wnd_white_min_pushed.png
.png
public/caption/caption_public.png
.png
public/checkbox/check_green_no.png
.png
public/checkbox/check_green_yes.png
.png
public/checkbox/check_no.png
.png
public/checkbox/check_yes.png
.png
public/checkbox/check_yes1.png
.png
public/edit/edit0.png
.png
public/vsrcollbar/bk_hovered.png
.png
public/vsrcollbar/bk_normal.png
.png
public/vsrcollbar/thumb_hovered.png
.png
public/vsrcollbar/thumb_normal.png
.png
scroll.png
.png
uninst_process_bottom.png
.png
uninst_process_top.png
.png
uninstallfinishpage.xml
uninstallingpage.xml
uninstallpage.xml
app.7z
.7z
7z.dll
.dll windows:4 windows x86 arch:x86

6a7be52633b01426b17d148203c82793

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharPrevExA
CharUpperW

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 885KB - Virtual size: 885KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AdvanceScan.dat
Eg.dll
.dll windows:5 windows x86 arch:x86

93dd0a15e80c7c84c8f3ae1bbbd1b26c

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:1b:48:93:bc:5a:e0:81:7e:1c:4e:cc:57:f4:d3:12:cc:93:31:f6:d8:6a:a0:a0:4a:bc:34:53:4a:aa:5b:88
Signer

Actual PE Digest

06:1b:48:93:bc:5a:e0:81:7e:1c:4e:cc:57:f4:d3:12:cc:93:31:f6:d8:6a:a0:a0:4a:bc:34:53:4a:aa:5b:88

Digest Algorithm

sha256

PE Digest Matches

true

29:20:5b:51:69:9a:9b:52:6c:9e:cd:46:ce:a6:21:45:8d:cc:1f:5f
Signer

Actual PE Digest

29:20:5b:51:69:9a:9b:52:6c:9e:cd:46:ce:a6:21:45:8d:cc:1f:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libcrypto-1_1

EVP_sha1

kernel32

GetVersionExA
GetVersionExW
TlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shell32

SHGetFolderPathW

egaddtionalhelper

??1CDoEgAddtionalHelper@@QAE@XZ

eghelperone

?Eg4@CEgHelperOne@@QAEHXZ

eghelperthree

?Eg1@CEgHelperThree@@QAEHPAUag_ctx_tag@@@Z

eghelpertwo

??0CEgHelperTwo@@QAE@XZ

shlwapi

AssocQueryStringW

vcomp120

_vcomp_set_num_threads

ws2_32

WSACleanup

Exports

Exports

??0CEg@@QAE@XZ
??4CDoEgAddtionalHelper@@QAEAAV0@ABV0@@Z
??4CEg@@QAEAAV0@ABV0@@Z
??4CEgHelperOne@@QAEAAV0@ABV0@@Z
??4CEgHelperThree@@QAEAAV0@ABV0@@Z
??4CEgHelperTwo@@QAEAAV0@ABV0@@Z
?Eg1@CEg@@QAEHPAUag_ctx_tag@@@Z
?Eg4@CEg@@QAEHXZ
?QueryCache@CEg@@AAEHPADPAUag_ctx_tag@@PA_W@Z
?WriteCache@CEg@@AAEXPADPAUag_ctx_tag@@H@Z
XGBGetLastError
XGBoosterBoostOneIter
XGBoosterCreate
XGBoosterDumpModel
XGBoosterDumpModelEx
XGBoosterDumpModelExWithFeatures
XGBoosterDumpModelWithFeatures
XGBoosterEvalOneIter
XGBoosterFree
XGBoosterGetAttr
XGBoosterGetAttrNames
XGBoosterGetModelRaw
XGBoosterLoadModel
XGBoosterLoadModelFromBuffer
XGBoosterLoadRabitCheckpoint
XGBoosterPredict
XGBoosterSaveModel
XGBoosterSaveRabitCheckpoint
XGBoosterSetAttr
XGBoosterSetParam
XGBoosterUpdateOneIter
XGDMatrixCreateFromCSC
XGDMatrixCreateFromCSCEx
XGDMatrixCreateFromCSR
XGDMatrixCreateFromCSREx
XGDMatrixCreateFromDataIter
XGDMatrixCreateFromFile
XGDMatrixCreateFromMat
XGDMatrixFree
XGDMatrixGetFloatInfo
XGDMatrixGetUIntInfo
XGDMatrixNumCol
XGDMatrixNumRow
XGDMatrixSaveBinary
XGDMatrixSetFloatInfo
XGDMatrixSetGroup
XGDMatrixSetUIntInfo
XGDMatrixSliceDMatrix

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 50.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EgAddtionalHelper.dll
.dll windows:5 windows x86 arch:x86

bcb76fcb0e8dbb1361b424c5e69d9811

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1a:b8:2b:72:b1:2f:11:6a:0d:7c:1d:3f:c9:55:bc:e6:6f:69:cc:80:80:52:b2:be:96:02:96:db:27:9a:9d:0a
Signer

Actual PE Digest

1a:b8:2b:72:b1:2f:11:6a:0d:7c:1d:3f:c9:55:bc:e6:6f:69:cc:80:80:52:b2:be:96:02:96:db:27:9a:9d:0a

Digest Algorithm

sha256

PE Digest Matches

true

aa:c2:29:aa:ce:02:47:30:c8:1a:2e:1e:3f:75:7d:03:14:06:00:ff
Signer

Actual PE Digest

aa:c2:29:aa:ce:02:47:30:c8:1a:2e:1e:3f:75:7d:03:14:06:00:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
GetStringTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
QueryPerformanceCounter
LCMapStringW
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
GetModuleFileNameA
GetStartupInfoW
GetStdHandle
GetTimeZoneInformation
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
GetModuleHandleExW
RaiseException
ExitProcess
HeapQueryInformation
IsProcessorFeaturePresent
IsDebuggerPresent
ExitThread
CreateThread
SetUnhandledExceptionFilter
GetCommandLineA
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
Sleep
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetCurrentDirectoryW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
UnhandledExceptionFilter
FreeEnvironmentStringsW
RtlUnwind
GetEnvironmentStringsW
FindClose
GetUserDefaultUILanguage
CompareStringW
GlobalFlags
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
FreeLibrary
EncodePointer
GetCurrentProcessId
GlobalGetAtomNameW
CopyFileW
MulDiv
GlobalSize
FindResourceW
SizeofResource
LockResource
LoadResource
ResumeThread
SetThreadPriority
GetCurrentThreadId
WaitForSingleObject
SetErrorMode
LocalReAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetModuleHandleA
OutputDebugStringA
SetLastError
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
DecodePointer
HeapSize
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetVersionExW
GetVersion
VirtualFree
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
lstrcmpA
lstrcpyW
VirtualAlloc
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetLastError
CloseHandle
CreateFileW
lstrcpynW
GetFileAttributesW
GetTempPathW
GetSystemDirectoryW
GetWindowsDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW

user32

SetClassLongW
LockWindowUpdate
SetParent
SetRect
SetCursorPos
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetSystemMenu
IsZoomed
GetComboBoxInfo
TrackMouseEvent
GetKeyNameTextW
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
MonitorFromPoint
UpdateLayeredWindow
IsMenu
UnionRect
SetWindowRgn
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
EndDialog
CreateDialogIndirectParamW
MapVirtualKeyW
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
GetAsyncKeyState
MessageBeep
GetNextDlgTabItem
GetIconInfo
DrawIconEx
LoadImageW
IsRectEmpty
OffsetRect
SetRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
IsIconic
InvalidateRect
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
CharUpperW
DestroyIcon
PostQuitMessage
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
GetMenuItemInfoW
DestroyMenu
DrawIcon
InflateRect
LoadCursorW
GetSysColorBrush
GetSystemMetrics
RealChildWindowFromPoint
GetDesktopWindow
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
GetWindowRgn
DestroyCursor
MapDialogRect
CreateMenu
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
FrameRect
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
SetMenuDefaultItem
CopyIcon
IntersectRect
GetDoubleClickTime
CheckMenuItem
GetFocus
FillRect
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetLastActivePopup
GetWindowThreadProcessId
GetParent
GetWindowLongW
MessageBoxW
IsWindowEnabled
EnableWindow
GetWindowTextLengthW
GetWindowTextW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnhookWindowsHookEx
UnregisterClassW
wsprintfW
GetNextDlgGroupItem

gdi32

SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
GetTextExtentPoint32W
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
GetTextMetricsW
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
Rectangle
GetRgnBox
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetTextFaceW
SetTextColor
SetROP2
SetTextAlign
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetPolyFillMode
GetLayout
SetLayout
EnumFontFamiliesExW
CopyMetaFileW
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
CreateBitmap
BitBlt
GetDeviceCaps
CreateDCW

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW

shell32

SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetFolderPathW
DragFinish
DragQueryFileW
SHGetDesktopFolder

shlwapi

PathFindFileNameW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathFindExtensionW
PathRemoveFileSpecW

uxtheme

GetThemePartSize
GetWindowTheme
GetThemeSysColor
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName

ole32

OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoInitialize
CoUninitialize
CoDisconnectObject
CoCreateInstance
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
VariantInit
VarBstrFromDate
VariantChangeType
VariantCopy
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CryptDecodeObject
CertFreeCertificateContext

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Exports

Exports

??0CDoEgAddtionalHelper@@QAE@XZ
??1CDoEgAddtionalHelper@@QAE@XZ
??4CDoEgAddtionalHelper@@QAEAAV0@ABV0@@Z
?Eg1@CDoEgAddtionalHelper@@QAEHXZ
?Eg2@CDoEgAddtionalHelper@@QAEHPAUag_ctx_tag@@@Z
?Eg3@CDoEgAddtionalHelper@@QAEXXZ

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EgHelperOne.dll
.dll windows:5 windows x86 arch:x86

f5b684189bbfdbb1596ac085bce240d0

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7b:21:ea:a7:41:53:c6:2a:7c:d1:9a:14:80:fb:f7:7b:3a:b4:34:91:50:06:65:cb:03:43:3c:ce:f8:ba:d1:53
Signer

Actual PE Digest

7b:21:ea:a7:41:53:c6:2a:7c:d1:9a:14:80:fb:f7:7b:3a:b4:34:91:50:06:65:cb:03:43:3c:ce:f8:ba:d1:53

Digest Algorithm

sha256

PE Digest Matches

true

cd:33:4c:33:b6:96:1e:bb:9a:5d:72:1f:94:ae:e0:6e:bd:fa:7b:8b
Signer

Actual PE Digest

cd:33:4c:33:b6:96:1e:bb:9a:5d:72:1f:94:ae:e0:6e:bd:fa:7b:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libcrypto-1_1

EVP_MD_size

kernel32

GetVersionExW
GetVersionExA
GetTempPathA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

??0CEgHelperOne@@QAE@XZ
??4CEgHelperOne@@QAEAAV0@ABV0@@Z
?CheckDigiSign@CEgHelperOne@@AAEHPAUag_ctx_tag@@@Z
?CheckFileName@CEgHelperOne@@AAEHPADPAUag_ctx_tag@@@Z
?CheckHash@CEgHelperOne@@AAEHPADPAUag_ctx_tag@@PAUfilemapping@@@Z
?CheckScriptFileName@CEgHelperOne@@AAEHPAUag_ctx_tag@@@Z
?CheckWithAI@CEgHelperOne@@AAEHPAUag_ctx_tag@@PAUwsv_ctx_tag@@PAUpe_data@@@Z
?CheckZipBomb@CEgHelperOne@@AAEHPAUag_ctx_tag@@PAUfilemapping@@@Z
?Eg1@CEgHelperOne@@QAEHPAUag_ctx_tag@@@Z
?Eg2@CEgHelperOne@@QAEHPAUag_ctx_tag@@@Z
?Eg4@CEgHelperOne@@QAEHXZ
?ScanGenericPE@CEgHelperOne@@AAEHPAUag_ctx_tag@@PAUfilemapping@@@Z

Sections

.text
Size: - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 100.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: 733KB - Virtual size: 732KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EgHelperThree.dll
.dll windows:5 windows x86 arch:x86

9cb5e4f281bdc2cb9726f4a2975112cf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

49:bc:94:84:be:46:fe:a1:3f:1f:8b:f8:23:8b:16:d3:7b:44:41:7c:d4:01:46:7d:36:e1:a4:6c:e4:0f:44:5d
Signer

Actual PE Digest

49:bc:94:84:be:46:fe:a1:3f:1f:8b:f8:23:8b:16:d3:7b:44:41:7c:d4:01:46:7d:36:e1:a4:6c:e4:0f:44:5d

Digest Algorithm

sha256

PE Digest Matches

true

b2:d9:46:f9:6d:8c:a9:d9:72:19:ba:1c:08:aa:d3:6b:86:d6:3e:62
Signer

Actual PE Digest

b2:d9:46:f9:6d:8c:a9:d9:72:19:ba:1c:08:aa:d3:6b:86:d6:3e:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

python27

PyRun_SimpleStringFlags

kernel32

GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

??0CEgHelperThree@@QAE@XZ
??4CEgHelperThree@@QAEAAV0@ABV0@@Z
?Eg1@CEgHelperThree@@QAEHPAUag_ctx_tag@@@Z
?Eg4@CEgHelperThree@@QAEHXZ

Sections

.text
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EgHelperTwo.dll
.dll windows:5 windows x86 arch:x86

bdd385e0042d19e55220d52268c13788

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:f4:14:8c:40:39:96:e8:0f:e7:d3:15:ca:7e:81:21:c7:9a:9c:ec:c7:1f:4e:1f:b8:de:b5:6a:17:b0:cb:21
Signer

Actual PE Digest

0c:f4:14:8c:40:39:96:e8:0f:e7:d3:15:ca:7e:81:21:c7:9a:9c:ec:c7:1f:4e:1f:b8:de:b5:6a:17:b0:cb:21

Digest Algorithm

sha256

PE Digest Matches

true

44:3a:b3:36:6f:ef:a2:de:eb:e6:23:7f:aa:26:6f:2c:e6:6f:a3:4b
Signer

Actual PE Digest

44:3a:b3:36:6f:ef:a2:de:eb:e6:23:7f:aa:26:6f:2c:e6:6f:a3:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

python27

PyErr_Fetch

kernel32

MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

??0CEgHelperTwo@@QAE@XZ
??4CEgHelperTwo@@QAEAAV0@ABV0@@Z
?Eg1@CEgHelperTwo@@QAEHPAUag_ctx_tag@@@Z
?Eg4@CEgHelperTwo@@QAEHXZ

Sections

.text
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Process.dat
WiseVector.exe
.exe windows:5 windows x86 arch:x86

fad66230d75db0b88820e93861190fe1

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:77:be:7f:d8:e3:51:e0:87:19:31:d2:94:d8:e8:0e:a8:c2:78:0c:0a:74:3e:25:da:cf:c7:de:a1:d2:35:a2
Signer

Actual PE Digest

84:77:be:7f:d8:e3:51:e0:87:19:31:d2:94:d8:e8:0e:a8:c2:78:0c:0a:74:3e:25:da:cf:c7:de:a1:d2:35:a2

Digest Algorithm

sha256

PE Digest Matches

true

92:10:d4:2d:e8:d1:0f:a2:d4:f6:62:20:52:fa:09:c4:03:69:a0:41
Signer

Actual PE Digest

92:10:d4:2d:e8:d1:0f:a2:d4:f6:62:20:52:fa:09:c4:03:69:a0:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Develop\PDB\WiseVector.pdb

Imports

libcrypto-1_1

EVP_CipherUpdate
PKCS5_PBKDF2_HMAC_SHA1
EVP_CipherFinal_ex
EVP_get_cipherbyname
EVP_CIPHER_nid
RAND_add
OPENSSL_init_crypto
HMAC_Init_ex
OBJ_nid2sn
EVP_CIPHER_iv_length
EVP_sha1
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_set_padding
EVP_CipherInit_ex
EVP_CIPHER_CTX_free
EVP_CIPHER_key_length
HMAC_CTX_new
HMAC_CTX_free
HMAC_Update
RAND_bytes
EVP_CIPHER_block_size
EVP_MD_size
HMAC_Final

advapi32

SetFileSecurityW
RegEnumKeyExW
RegSetValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
CryptEncrypt
CryptImportKey
CryptDestroyKey
GetFileSecurityW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegEnumValueW
StartServiceW
QueryServiceStatus
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
GetUserNameA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

ws2_32

WSAIoctl
getaddrinfo
socket
accept
listen
recvfrom
sendto
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
send
recv
WSASetLastError
freeaddrinfo
ioctlsocket
gethostname
htonl
ntohl
select

crypt32

CertFreeCertificateContext

wldap32

ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
ord301

wisevectorhelperfive

?Helper3@CHelperFive@@QAEHKK@Z
??0CHelperFive@@QAE@XZ
?Helper1@CHelperFive@@QAEHP6AHHAAHPADPA_WPAEH@Z@Z
?Helper4@CHelperFive@@QAEHKPA_W@Z
?Helper2@CHelperFive@@QAEHII@Z

wisevectorscan

?QueryScanInfo@CScanWork@@QAEJAAU_WV_SCAN_INFO@@@Z
?Stop@CScanWork@@QAEJXZ
?QueryCleanInfo@CScanWork@@QAEJAAU_WV_CLEAN_INFO@@@Z
?Initialize@CScanWork@@QAEJKPAVIScanFileCallBack@@@Z
??1CScanWork@@QAE@XZ
??0CScanWork@@QAE@XZ
?CleanSingleFile@CScanWork@@QAEJPA_W0@Z
?ScanSingleFile@CScanWork@@QAEJHPA_WPAD110AAHAAM0H@Z
?Clean@CScanWork@@QAEJABV?$CAtlArray@KV?$CElementTraits@K@ATL@@@ATL@@@Z
?Scan@CScanWork@@QAEJHHHQAY0CAA@_W@Z

kernel32

SetFileAttributesW
DeleteFileW
GetShortPathNameW
SetProcessWorkingSetSize
ExitProcess
OpenThread
TerminateThread
FindClose
WinExec
GetModuleHandleW
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
RemoveDirectoryW
FindNextFileW
MoveFileW
GetUserDefaultUILanguage
VirtualAlloc
VirtualFree
lstrcmpA
lstrcpynW
lstrcpyW
GetExitCodeThread
GetTempPathA
ReadProcessMemory
GetModuleHandleA
SetHandleInformation
CreatePipe
DecodePointer
HeapDestroy
HeapAlloc
OpenEventW
HeapFree
HeapSize
GetProcessHeap
DeleteCriticalSection
GetThreadContext
SuspendThread
ResumeThread
MoveFileExW
InterlockedDecrement
IsBadReadPtr
IsBadWritePtr
VerLanguageNameW
GetComputerNameA
GetCommandLineW
SetCurrentDirectoryW
GetVolumeInformationW
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetACP
GetLocaleInfoW
CreateProcessW
DeleteFileA
MulDiv
InterlockedIncrement
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
FreeResource
GlobalFree
OutputDebugStringW
SetThreadPriority
GetFullPathNameW
GetFullPathNameA
CreateFileA
HeapCompact
TryEnterCriticalSection
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
FormatMessageW
GetFileAttributesA
HeapCreate
HeapValidate
VirtualUnlock
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
VirtualLock
GetSystemInfo
GetFileAttributesExW
GetVersionExA
GetSystemTime
AreFileApisANSI
SetLastError
SleepEx
VerSetConditionMask
VerifyVersionInfoA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetFileInformationByHandle
CompareFileTime
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
LoadLibraryExW
lstrcmpiW
GetStringTypeExW
GetThreadLocale
EncodePointer
GlobalDeleteAtom
lstrcmpW
GetDriveTypeW
GlobalFindAtomW
GetCurrentThread
CompareStringA
GetFileSizeEx
LocalFileTimeToFileTime
GlobalSize
GlobalGetAtomNameW
GetAtomNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
CompareStringW
GetSystemDefaultUILanguage
GlobalFlags
VerifyVersionInfoW
GetTempFileNameW
GetProfileIntW
SearchPathW
VirtualProtect
ReplaceFileW
GetUserDefaultLCID
FindResourceExW
LocalLock
LocalUnlock
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
ExitThread
GetCPInfo
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
SetStdHandle
HeapQueryInformation
VirtualQuery
GetStartupInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidCodePage
GetOEMCP
SetConsoleCtrlHandler
GetStringTypeW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
FatalAppExitA
ReadConsoleW
WriteConsoleW
SetEnvironmentVariableA
CreateNamedPipeW
CreateEventW
CreateMutexW
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
ReadFile
WriteFile
ReleaseMutex
ResetEvent
SetEvent
GetProcessTimes
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
IsWow64Process
CopyFileW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetWindowsDirectoryA
GetSystemDirectoryW
GetSystemDirectoryA
FindResourceW
GetModuleFileNameW
CreateSemaphoreW
GetTickCount
FileTimeToSystemTime
GetLocalTime
GetFileTime
SizeofResource
LoadResource
Sleep
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetLongPathNameW
LockResource
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
RaiseException
CreateFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
GetFileSize
TerminateProcess
OpenProcess
GetVersionExW
GetFileAttributesW
LoadLibraryW
GetLastError
GetCurrentProcess
LocalFree
LocalAlloc
GetProcAddress
GetLogicalDrives
FindFirstFileW
CreateDirectoryW
GetTempPathW
FileTimeToLocalFileTime
GlobalAddAtomW
OpenFileMappingW
lstrlenA
lstrlenW
HeapReAlloc

user32

CharNextW
CopyAcceleratorTableW
GetNextDlgGroupItem
MessageBeep
GetDialogBaseUnits
LoadAcceleratorsW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
RegisterClipboardFormatW
GetMenuDefaultItem
DrawFocusRect
DrawIconEx
GetIconInfo
GetAsyncKeyState
EnableScrollBar
InvertRect
NotifyWinEvent
GetSystemMenu
SetParent
PostThreadMessageW
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
IsMenu
MonitorFromPoint
TrackMouseEvent
GetComboBoxInfo
IsCharLowerW
MapVirtualKeyExW
GetDCEx
LockWindowUpdate
ToUnicodeEx
GetKeyboardState
DestroyAcceleratorTable
SetCursorPos
SetClassLongW
GetDoubleClickTime
CopyIcon
SetMenuDefaultItem
ModifyMenuW
CharUpperBuffW
FrameRect
EnumChildWindows
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
SubtractRect
SendNotifyMessageW
InSendMessage
CreateMenu
DestroyCursor
WindowFromDC
GetTabbedTextExtentW
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetDesktopWindow
MapDialogRect
SetWindowContextHelpId
GetWindowThreadProcessId
GetActiveWindow
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
EqualRect
MapWindowPoints
RemovePropW
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
GetForegroundWindow
SetActiveWindow
TrackPopupMenuEx
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetCapture
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
WaitMessage
SetWindowPlacement
GetWindowPlacement
IsChild
GetClassInfoW
GetMessageTime
GetMessagePos
PeekMessageW
CopyRect
MapVirtualKeyW
GetKeyNameTextW
IsDialogMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
ScrollWindowEx
IsWindowEnabled
GetFocus
GetDlgCtrlID
SendDlgItemMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
CharUpperW
LoadImageW
GetWindow
AdjustWindowRectEx
GetPropW
SetPropW
GetMenu
SetFocus
GetClassInfoExW
RegisterClassW
CallWindowProcW
PostQuitMessage
GetMessageW
GetWindowRgn
CreateWindowExW
RegisterClassExW
InvalidateRgn
EndPaint
BeginPaint
CreateAcceleratorTableW
DefWindowProcW
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
DispatchMessageW
TranslateMessage
GetKeyboardLayout
UpdateLayeredWindow
KillTimer
SetTimer
MoveWindow
ShowWindow
DestroyWindow
LoadIconW
ShowScrollBar
SetRectEmpty
SetCursor
SystemParametersInfoW
SetWindowLongW
GetWindowLongW
IsRectEmpty
UnionRect
IntersectRect
ScreenToClient
InvalidateRect
SetWindowRgn
GetUpdateRect
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
IsZoomed
IsIconic
ShowOwnedPopups
SetLayeredWindowAttributes
IsWindow
SendMessageTimeoutW
RegisterWindowMessageW
LoadCursorW
SetRect
FillRect
GetSysColor
GetClientRect
RedrawWindow
DrawIcon
GetParent
DeleteMenu
GetSysColorBrush
SendDlgItemMessageA
EnableWindow
SendMessageW
UnregisterClassW
wsprintfW
DestroyIcon
FindWindowW
OffsetRect
ClientToScreen
GetCursorPos
MessageBoxW
GetWindowRect
SetForegroundWindow
UpdateWindow
GetSystemMetrics
BringWindowToTop
SetWindowPos
PostMessageW
ExitWindowsEx
CopyImage
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
WindowFromPoint
InflateRect
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuState
GetMenuStringW
BeginDeferWindowPos
LoadMenuW
PtInRect

gdi32

DeleteObject
PtInRegion
CreateCompatibleBitmap
SelectObject
CreateRectRgnIndirect
PatBlt
SetBkColor
SetTextColor
CreateBitmap
CreateDIBPatternBrushPt
CreateHatchBrush
CreatePen
CombineRgn
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
GetObjectW
SetPixel
GetTextCharsetInfo
CreatePatternBrush
EnumFontFamiliesW
CreateDIBitmap
StretchDIBits
GetCharWidthW
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
RealizePalette
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
GetStockObject
GetDeviceCaps
DeleteDC
CreateRectRgn
CreateFontW
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocW
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
TextOutW
ExtTextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
Rectangle
EnumFontFamiliesExW
OffsetRgn
CreateRoundRectRgn
GetCurrentObject
RoundRect
FrameRgn
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
CloseMetaFile
CreateMetaFileW
CreatePalette
DeleteMetaFile
GetTextMetricsW
GetRgnBox
GetTextColor
GetDIBits
CreateSolidBrush
EnumMetaFile
CreateDIBSection
CreateFontIndirectW
GetSystemPaletteEntries
GetPaletteEntries
CreateDCW
CreateCompatibleDC
SetBkMode
BitBlt
GetBkColor
GetTextExtentPoint32W
DPtoLP
SetRectRgn
GetMapMode
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
GetNearestPaletteIndex

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetOpenFileNameW

winspool.drv

DocumentPropertiesW
ClosePrinter
GetJobW
OpenPrinterW

shell32

SHGetPathFromIDListW
ord190
SHOpenFolderAndSelectItems
SHBrowseForFolderW
SHGetFolderPathA
SHGetMalloc
ExtractIconW
SHGetSpecialFolderLocation
SHGetFolderLocation
SHGetDesktopFolder
Shell_NotifyIconW
DragQueryFileW
DragQueryPoint
DragAcceptFiles
DragFinish
SHAppBarMessage
ExtractAssociatedIconW
SHAddToRecentDocs
ord155
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW

comctl32

_TrackMouseEvent

shlwapi

PathCanonicalizeW
StrFormatKBSizeW
UrlUnescapeW
PathRemoveFileSpecW
PathRemoveExtensionW
PathStripToRootW
PathIsUNCW
StrChrW
PathFindFileNameW
StrToIntW
PathFileExistsW
StrRetToStrW
PathIsDirectoryW
AssocCreate
PathGetArgsW
PathFindExtensionW

uxtheme

GetThemeSysColor
GetWindowTheme
IsAppThemed
GetThemePartSize
GetCurrentThemeName
GetThemeColor
CloseThemeData
OpenThemeData
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground
DrawThemeText

ole32

StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateFileMoniker
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CreateGenericComposite
CreateItemMoniker
WriteClassStm
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
StgCreateDocfileOnILockBytes
CoGetClassObject
StgOpenStorageOnILockBytes
OleSetMenuDescriptor
DoDragDrop
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
OleUninitialize
OleInitialize
CoDisconnectObject
StringFromGUID2
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemAlloc
CoCreateGuid
OleLockRunning
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
CoGetMalloc
CreateStreamOnHGlobal
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoInitialize
OleSaveToStream
OleSetContainedObject
OleGetIconOfClass
GetHGlobalFromILockBytes
PropVariantCopy
OleRegGetMiscStatus
OleRegEnumVerbs
OleQueryLinkFromData
OleQueryCreateFromData
OleIsRunning
GetRunningObjectTable
CreateDataAdviseHolder
CreateOleAdviseHolder
CoFreeUnusedLibraries
OleRun
CreateILockBytesOnHGlobal

oleaut32

SetErrorInfo
GetErrorInfo
SafeArrayRedim
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
VarDecFromStr
VarBstrFromDec
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantCopy
VariantChangeType
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
CreateErrorInfo
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock

oledlg

OleUIBusyW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

setupapi

CM_Get_Sibling
CM_Get_DevNode_Registry_PropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
CM_Get_Child

psapi

EnumProcessModules
GetModuleInformation
GetModuleFileNameExW

userenv

CreateEnvironmentBlock

secur32

GetUserNameExW

rasapi32

RasEnumConnectionsW
RasGetConnectStatusW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipFillRectangle
GdipCreateTexture
GdipDrawRectanglesI
GdipDrawLineI
GdipSetPenColor
GdipSetPenWidth
GdipGraphicsClear
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetFontHeightGivenDPI
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipCreateHICONFromBitmap
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipGetPathWorldBounds
GdipAddPathString
GdipDeletePath
GdipCreatePath
GdipDrawRectangle
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatTrimming
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSolidFillColor
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign

winmm

PlaySoundW

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetDescriptionW
ImmGetOpenStatus

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpSendRequestExW
GopherCreateLocatorW
HttpQueryInfoW
InternetSetCookieW
InternetGetCookieW
InternetErrorDlg
GopherFindFirstFileW
GopherOpenFileW
HttpEndRequestW
FtpCommandW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpOpenFileW
FtpRenameFileW
FtpDeleteFileW
FtpPutFileW
FtpGetFileW
FtpFindFirstFileW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionExW
InternetQueryOptionW
InternetFindNextFileW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetOpenUrlW
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
GopherGetAttributeW
InternetCrackUrlA
InternetCrackUrlW

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 870KB - Virtual size: 870KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorCommu.dll
.dll windows:5 windows x86 arch:x86

1daf655c5b82cefe41b2cac8ee95c5b6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b3:65:05:34:21:34:40:b6:05:3d:4e:56:51:5b:9c:4a:52:ba:37:2c:80:e0:a7:32:5e:98:1b:39:16:00:e7:4f
Signer

Actual PE Digest

b3:65:05:34:21:34:40:b6:05:3d:4e:56:51:5b:9c:4a:52:ba:37:2c:80:e0:a7:32:5e:98:1b:39:16:00:e7:4f

Digest Algorithm

sha256

PE Digest Matches

true

95:0c:ad:08:e8:ef:89:6c:a0:ed:f5:f7:d9:8d:29:45:fb:21:ee:86
Signer

Actual PE Digest

95:0c:ad:08:e8:ef:89:6c:a0:ed:f5:f7:d9:8d:29:45:fb:21:ee:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenMutexW
CloseHandle
GetCurrentDirectoryW
InitializeCriticalSection
CreateFileW
GetLastError
EnterCriticalSection
LeaveCriticalSection
WriteFile
ReadFile
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW

Exports

Exports

??0Cagcommunication@@QAE@XZ
??4Cagcommunication@@QAEAAV0@ABV0@@Z
?Eg1@Cagcommunication@@QAEHPAUag_ctx_tag@@@Z
?Eg4@Cagcommunication@@QAEHH@Z
?IsShieldsOn@Cagcommunication@@AAEHXZ

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorExt.dll
.dll regsvr32 windows:5 windows x86 arch:x86

758730c76fd01172ab8452ed52a3b1ec

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

59:83:25:e0:ea:e0:af:8c:f5:c4:6a:a6:4d:44:ac:9d:d4:e2:6a:cf:36:49:7b:fc:d1:1c:a7:aa:9c:50:72:fc
Signer

Actual PE Digest

59:83:25:e0:ea:e0:af:8c:f5:c4:6a:a6:4d:44:ac:9d:d4:e2:6a:cf:36:49:7b:fc:d1:1c:a7:aa:9c:50:72:fc

Digest Algorithm

sha256

PE Digest Matches

true

e6:5f:d7:cf:27:b6:c8:e5:75:59:3f:66:90:c8:bc:88:f3:0c:73:dc
Signer

Actual PE Digest

e6:5f:d7:cf:27:b6:c8:e5:75:59:3f:66:90:c8:bc:88:f3:0c:73:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
MultiByteToWideChar
GlobalLock
GlobalUnlock
EnterCriticalSection
lstrcpynA
lstrcpynW
CreateFileMappingW
OpenFileMappingW
WideCharToMultiByte
GetPrivateProfileStringW
GetSystemDefaultLangID
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
RaiseException
GetLastError
GetVersion
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DecodePointer
MapViewOfFile
EncodePointer
FlushFileBuffers
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
HeapFree
HeapAlloc
RtlUnwind
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
GetStdHandle
WriteFile
HeapReAlloc
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

InsertMenuW
SetMenuItemBitmaps
LoadBitmapW
CharNextW

gdi32

DeleteObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

shell32

DragQueryFileW
ShellExecuteW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
ReleaseStgMedium
CoTaskMemAlloc

oleaut32

UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString
LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorExt_X64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

931ec5cb42b1e4dd4f24c3c2a626ac3e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

35:f9:89:68:13:4c:12:35:55:2c:0c:2f:0d:ba:fb:5a:ec:f3:3d:5c:b7:1e:46:2c:a2:23:6d:60:40:d0:7c:56
Signer

Actual PE Digest

35:f9:89:68:13:4c:12:35:55:2c:0c:2f:0d:ba:fb:5a:ec:f3:3d:5c:b7:1e:46:2c:a2:23:6d:60:40:d0:7c:56

Digest Algorithm

sha256

PE Digest Matches

true

af:8e:34:e2:2a:5c:e3:5d:ae:83:0e:bd:08:8b:54:c6:2e:10:2a:3c
Signer

Actual PE Digest

af:8e:34:e2:2a:5c:e3:5d:ae:83:0e:bd:08:8b:54:c6:2e:10:2a:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
MultiByteToWideChar
GlobalLock
GlobalUnlock
MapViewOfFile
InitializeCriticalSectionAndSpinCount
lstrcpynW
CreateFileMappingW
OpenFileMappingW
WideCharToMultiByte
GetPrivateProfileStringW
GetSystemDefaultLangID
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
EnterCriticalSection
LeaveCriticalSection
GetLastError
RaiseException
GetVersion
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
DecodePointer
lstrcpynA
EncodePointer
FlushFileBuffers
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileW
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
HeapFree
HeapAlloc
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
HeapSize
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
GetStdHandle
WriteFile
HeapReAlloc
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

InsertMenuW
SetMenuItemBitmaps
LoadBitmapW
CharNextW

gdi32

DeleteObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

shell32

DragQueryFileW
ShellExecuteW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
ReleaseStgMedium
CoTaskMemAlloc

oleaut32

UnRegisterTypeLi
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorFWO_X64.sys
.sys windows:6 windows x64 arch:x64

e457b87fad113dd77e3da6c042685365

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e8:76:de:e7:89:91:76:73:f3:52:e8:e3:64:fb:0d:f7:9a:a4:6d:e8:68:c7:59:c6:a8:1b:1e:fc:93:01:2c:9e
Signer

Actual PE Digest

e8:76:de:e7:89:91:76:73:f3:52:e8:e3:64:fb:0d:f7:9a:a4:6d:e8:68:c7:59:c6:a8:1b:1e:fc:93:01:2c:9e

Digest Algorithm

sha256

PE Digest Matches

true

3a:cc:8c:ba:d2:ca:05:4f:40:03:70:c1:81:fd:91:d5:d7:86:68:1e
Signer

Actual PE Digest

3a:cc:8c:ba:d2:ca:05:4f:40:03:70:c1:81:fd:91:d5:d7:86:68:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

i:\develop\pdb\3.0\dev\winxp\firewall\std\objfre_wnet_amd64\amd64\WiseVectorFWO_X86.pdb

Imports

ntoskrnl.exe

KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
IoDeleteSymbolicLink
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
swprintf
MmGetSystemRoutineAddress
ExSystemTimeToLocalTime
ZwClose
IofCompleteRequest
RtlTimeToTimeFields
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ObOpenObjectByPointer
IoDetachDevice
IofCallDriver
IoBuildDeviceIoControlRequest
RtlDowncaseUnicodeString
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoFreeMdl
KeInsertQueueDpc
KeWaitForSingleObject
ExFreePoolWithTag
IoAllocateMdl
ObReferenceObjectByHandle
IoFreeIrp
IoReleaseCancelSpinLock
MmMapLockedPagesSpecifyCache
IoAllocateIrp
RtlAppendUnicodeToString
KeInitializeDpc
KeInitializeTimer
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
MmUnmapLockedPages
MmAllocatePagesForMdl
KeSetTimer
MmFreePagesFromMdl
KeBugCheckEx
PsGetCurrentProcessId
ExAllocatePoolWithTag
__C_specific_handler

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorFWO_X86.sys
.sys windows:6 windows x86 arch:x86

f01f3963cbd9e88ce1d19e14dee04d26

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:18:54:86:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/04/2011, 22:06

Not After

11/04/2021, 22:16

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:29:c3:c6:fd:32:2e:93:98:a6:01:6d:62:39:ac:ac:6d:19:d8:5b:09:79:f7:8f:fa:b8:c9:04:d3:c6:c3:bf
Signer

Actual PE Digest

14:29:c3:c6:fd:32:2e:93:98:a6:01:6d:62:39:ac:ac:6d:19:d8:5b:09:79:f7:8f:fa:b8:c9:04:d3:c6:c3:bf

Digest Algorithm

sha256

PE Digest Matches

true

25:02:b1:92:51:c6:9a:0b:95:74:34:7a:17:27:f2:24:b8:99:b3:d0
Signer

Actual PE Digest

25:02:b1:92:51:c6:9a:0b:95:74:34:7a:17:27:f2:24:b8:99:b3:d0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

i:\develop\pdb\3.0\dev\winxp\firewall\std\objfre_wxp_x86\i386\WiseVectorFWO_X86.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ZwClose
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
swprintf
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
memcpy
IoDetachDevice
IofCallDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
RtlDowncaseUnicodeString
PsGetCurrentProcessId
KeWaitForSingleObject
KeInitializeEvent
IoDeleteDevice
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoFreeIrp
MmMapLockedPagesSpecifyCache
IoAllocateIrp
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
KeInsertQueueDpc
ExAllocatePoolWithTag
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorFW_X64.sys
.sys windows:6 windows x64 arch:x64

93d9dbc8fb5bcf84ae0deec81774ea66

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:25

Not After

02/12/2021, 22:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:6c:43:4a:72:f9:1e:91:75:3b:08:e1:67:08:d3:eb:90:67:44:ee:72:a3:df:56:50:8e:ab:35:5e:eb:14:57
Signer

Actual PE Digest

59:6c:43:4a:72:f9:1e:91:75:3b:08:e1:67:08:d3:eb:90:67:44:ee:72:a3:df:56:50:8e:ab:35:5e:eb:14:57

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

I:\Develop\PDB\WiseVectorFW_X64.pdb

Imports

fwpkclnt.sys

FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpmFreeMemory0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsAllocateNetBufferAndNetBufferList0
FwpsPendClassify0

ndis.sys

NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
RtlInitUnicodeString
RtlAppendUnicodeToString
RtlTimeToTimeFields
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExSystemTimeToLocalTime
MmBuildMdlForNonPagedPool
MmGetSystemRoutineAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
PsGetCurrentProcessId
ZwSetInformationThread
PsLookupProcessByProcessId
ObOpenObjectByPointer
swprintf
__C_specific_handler
RtlCompareMemory
RtlValidSid
KeBugCheckEx

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorFW_X86.sys
.sys windows:6 windows x86 arch:x86

87fa408a30fff579932382130f738e0c

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:25

Not After

02/12/2021, 22:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:92:e1:25:ab:21:03:e0:9a:3d:be:bb:6c:42:6b:2f:eb:89:c1:f0:dd:0e:3d:51:aa:50:ea:ed:2b:7a:c3:fa
Signer

Actual PE Digest

43:92:e1:25:ab:21:03:e0:9a:3d:be:bb:6c:42:6b:2f:eb:89:c1:f0:dd:0e:3d:51:aa:50:ea:ed:2b:7a:c3:fa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Develop\PDB\WiseVectorFW_X86.pdb

Imports

fwpkclnt.sys

FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpmTransactionCommit0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsFlowAssociateContext0
FwpsAcquireClassifyHandle0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsFreeCloneNetBufferList0
FwpsPendClassify0

ndis.sys

NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool

ntoskrnl.exe

memset
memcpy
RtlAppendUnicodeToString
RtlTimeToTimeFields
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeQuerySystemTime
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExSystemTimeToLocalTime
MmBuildMdlForNonPagedPool
MmGetSystemRoutineAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
PsGetCurrentProcessId
ZwSetInformationThread
PsLookupProcessByProcessId
ObOpenObjectByPointer
swprintf
_allmul
_aulldiv
_aullrem
RtlCompareMemory
RtlValidSid
RtlUnwind
KeTickCount
KeBugCheckEx
swprintf_s
ExUuidCreate
ExAllocatePoolWithTag
RtlInitUnicodeString

hal

KeReleaseInStackQueuedSpinLock
KeGetCurrentIrql
KeAcquireInStackQueuedSpinLock

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorFolderPicker.exe
.exe windows:5 windows x86 arch:x86

52d17b70a5002833a226150840118c28

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:ca:ec:10:29:42:83:1c:ed:ee:c6:82:7e:d8:91:3d:1b:f3:c5:ab:83:c0:16:99:e3:a8:dc:3f:40:ff:2f:e7
Signer

Actual PE Digest

38:ca:ec:10:29:42:83:1c:ed:ee:c6:82:7e:d8:91:3d:1b:f3:c5:ab:83:c0:16:99:e3:a8:dc:3f:40:ff:2f:e7

Digest Algorithm

sha256

PE Digest Matches

true

4e:21:75:78:44:18:5d:79:0b:85:73:f9:7c:30:f1:42:c3:7b:87:4a
Signer

Actual PE Digest

4e:21:75:78:44:18:5d:79:0b:85:73:f9:7c:30:f1:42:c3:7b:87:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Develop\Other\BeatTrojan2017\New\2017Release\WiseVectorFolderPicker.pdb

Imports

kernel32

GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
OutputDebugStringW
GetCPInfo
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
GetOEMCP
GetACP
IsValidCodePage
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
VirtualQuery
VirtualAlloc
GetSystemInfo
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
IsDebuggerPresent
HeapQueryInformation
GetStringTypeW
CreateThread
RtlUnwind
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
Sleep
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
lstrcpyW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
GetWindowsDirectoryW
GetCurrentDirectoryW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
GetTimeZoneInformation
ExitThread
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
FileTimeToSystemTime
GlobalGetAtomNameW
lstrcmpA
GlobalFlags
ResumeThread
SetThreadPriority
WaitForSingleObject
CloseHandle
GetCurrentProcessId
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetUserDefaultUILanguage
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
EncodePointer
MultiByteToWideChar
WideCharToMultiByte
SetErrorMode
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
FindResourceW
LoadLibraryW
LoadLibraryA
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
GetStdHandle
RaiseException
ReadFile
GetVersionExW
InitializeCriticalSectionAndSpinCount
WriteFile
GetProcessHeap
GetModuleHandleW
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineW

user32

DestroyCursor
GetWindowRgn
DrawIcon
SetParent
SetRect
SetCursorPos
CopyAcceleratorTableW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetSystemMenu
IsZoomed
GetComboBoxInfo
TrackMouseEvent
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
MonitorFromPoint
UpdateLayeredWindow
IsMenu
UnionRect
SetWindowRgn
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
GetAsyncKeyState
MessageBeep
GetIconInfo
DrawIconEx
LoadImageW
IsRectEmpty
OffsetRect
SetRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
IsIconic
GetMenuDefaultItem
CreatePopupMenu
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
IntersectRect
CharUpperW
DestroyIcon
PostQuitMessage
SendDlgItemMessageA
CopyImage
SystemParametersInfoW
InflateRect
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
TranslateMessage
GetMessageW
FillRect
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
LoadCursorW
GetSysColorBrush
ReleaseDC
GetDC
GetSystemMetrics
GetWindowThreadProcessId
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetDlgCtrlID
GetDlgItem
MapDialogRect
CreateMenu
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
FrameRect
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongW
GetCursorPos
LockWindowUpdate
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
UnhookWindowsHookEx
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetParent
IsWindowEnabled
EnableWindow
GetFocus
SetFocus
IsWindow
SendMessageW
InvalidateRect

gdi32

TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
GetTextMetricsW
CombineRgn
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
MoveToEx
Polyline
Rectangle
EnumFontFamiliesExW
GetRgnBox
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetTextFaceW
SetROP2
SetPolyFillMode
GetLayout
Polygon
CopyMetaFileW
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateDCW
SetTextAlign

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

DragFinish
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
SHBrowseForFolderW
DragQueryFileW
ShellExecuteW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
StrFormatKBSizeW

uxtheme

GetCurrentThemeName
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetWindowTheme
GetThemePartSize

ole32

OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoInitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoDisconnectObject

oleaut32

SysFreeString
SysAllocString
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
LoadTypeLi
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

gdiplus

GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDrawImageRectI

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHIPSO_X64.sys
.sys windows:6 windows x64 arch:x64

8f7f023edf15392be3af2232609bb597

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d9:e0:9f:09:90:ce:e9:b2:be:cd:98:bd:36:29:34:d7:d5:76:cf:d3:da:e0:97:4f:36:1b:e3:72:b4:06:45:ef
Signer

Actual PE Digest

d9:e0:9f:09:90:ce:e9:b2:be:cd:98:bd:36:29:34:d7:d5:76:cf:d3:da:e0:97:4f:36:1b:e3:72:b4:06:45:ef

Digest Algorithm

sha256

PE Digest Matches

true

27:a7:c1:f0:fc:a2:5e:06:aa:a3:ea:25:b2:f9:e8:95:ad:8a:d2:97
Signer

Actual PE Digest

27:a7:c1:f0:fc:a2:5e:06:aa:a3:ea:25:b2:f9:e8:95:ad:8a:d2:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

I:\Develop\PDB\WiseVectorHIPSO_X64.pdb

Imports

fltmgr.sys

FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltGetVolumeName
FltCreateFile
FltReadFile
FltWriteFile
FltQueryInformationFile
FltClose
FltGetVolumeInstanceFromName
FltEnumerateVolumes
FltObjectDereference
FltAllocateContext
FltSetStreamContext
FltGetStreamContext
FltReleaseContext
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCompletePendedPostOperation
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltIsDirectory
FltDeleteStreamContext
FltAllocateDeferredIoWorkItem
FltFreeDeferredIoWorkItem
FltQueueDeferredIoWorkItem
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

ntoskrnl.exe

wcschr
wcsncpy
wcsstr
RtlInitUnicodeString
RtlCompareUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
RtlCopyUnicodeString
ExInitializeResourceLite
ExDeleteResourceLite
wcsrchr
_wcsicmp
_wcsnicmp
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExGetPreviousMode
IoDeleteDevice
IoDeleteSymbolicLink
IoGetTopLevelIrp
IoUnregisterShutdownNotification
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
swprintf
DbgPrint
RtlTimeToTimeFields
KeDelayExecutionThread
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
ZwClose
ZwOpenKey
ZwQueryValueKey
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType
_vsnwprintf
CmRegisterCallback
CmUnRegisterCallback
ZwDeleteValueKey
ZwSetValueKey
MmIsAddressValid
ObQueryNameString
towlower
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHIPSO_X86.sys
.sys windows:6 windows x86 arch:x86

7414f67efef5758a18f99f8bbc348ecc

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

00:0d:f1:63:4b:1c:22:23:fb:35:39:33:84:9b:ef:ba:8f:22:76:ad:61:ce:9f:26:39:a5:47:d8:bb:6a:a9:53
Signer

Actual PE Digest

00:0d:f1:63:4b:1c:22:23:fb:35:39:33:84:9b:ef:ba:8f:22:76:ad:61:ce:9f:26:39:a5:47:d8:bb:6a:a9:53

Digest Algorithm

sha256

PE Digest Matches

true

a2:e2:5c:2a:2f:da:dd:48:08:61:84:97:cf:ac:26:5b:ba:77:d1:8c
Signer

Actual PE Digest

a2:e2:5c:2a:2f:da:dd:48:08:61:84:97:cf:ac:26:5b:ba:77:d1:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Develop\PDB\WiseVectorHIPSO_X86.pdb

Imports

fltmgr.sys

FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltGetVolumeName
FltCreateFile
FltReadFile
FltWriteFile
FltQueryInformationFile
FltClose
FltGetVolumeInstanceFromName
FltEnumerateVolumes
FltObjectDereference
FltAllocateContext
FltSetStreamContext
FltGetStreamContext
FltReleaseContext
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCompletePendedPostOperation
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltIsDirectory
FltDeleteStreamContext
FltAllocateDeferredIoWorkItem
FltFreeDeferredIoWorkItem
FltQueueDeferredIoWorkItem
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

ntoskrnl.exe

RtlCompareUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
memset
RtlCopyUnicodeString
ExInitializeResourceLite
ExDeleteResourceLite
wcsrchr
_wcsicmp
_wcsnicmp
RtlInitUnicodeString
KeLeaveCriticalRegion
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExGetPreviousMode
IoDeleteDevice
IoDeleteSymbolicLink
IoGetTopLevelIrp
IoUnregisterShutdownNotification
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
swprintf
memmove
_allmul
DbgPrint
RtlTimeToTimeFields
KeDelayExecutionThread
KeQuerySystemTime
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
ZwClose
ZwOpenKey
ZwQueryValueKey
PsLookupProcessByProcessId
ObOpenObjectByPointer
memcpy
PsProcessType
_vsnwprintf
CmRegisterCallback
CmUnRegisterCallback
ZwDeleteValueKey
ZwSetValueKey
MmIsAddressValid
ObQueryNameString
towlower
KeTickCount
KeBugCheckEx
RtlUnwind
wcsstr
wcsncpy
wcschr
KeEnterCriticalRegion

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHIPS_X64.sys
.sys windows:6 windows x64 arch:x64

1f27e326aa3fcfcc9d2eee8368ef5e92

Code Sign

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/09/2021, 19:15

Not After

01/09/2022, 19:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:71:68:f5:1a:d0:a3:69:bf:65:95:b9:22:9e:dd:d4:f7:34:29:b7:07:fc:cb:20:9c:20:dd:b1:2c:ce:63:93
Signer

Actual PE Digest

f6:71:68:f5:1a:d0:a3:69:bf:65:95:b9:22:9e:dd:d4:f7:34:29:b7:07:fc:cb:20:9c:20:dd:b1:2c:ce:63:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

I:\Develop\PDB\WiseVectorHIPS_X64.pdb

Imports

fltmgr.sys

FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltGetVolumeName
FltCreateFile
FltReadFile
FltWriteFile
FltQueryInformationFile
FltClose
FltGetVolumeInstanceFromName
FltEnumerateVolumes
FltObjectDereference
FltAllocateContext
FltSetStreamContext
FltGetStreamContext
FltReleaseContext
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCompletePendedPostOperation
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltIsDirectory
FltDeleteStreamContext
FltAllocateDeferredIoWorkItem
FltFreeDeferredIoWorkItem
FltQueueDeferredIoWorkItem
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

ksecdd.sys

BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCreateHash

ntoskrnl.exe

wcschr
wcsncpy
wcsstr
RtlInitUnicodeString
RtlCompareUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
_vsnwprintf
RtlCopyUnicodeString
ExInitializeResourceLite
ExDeleteResourceLite
wcsrchr
_wcsicmp
_wcsnicmp
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExGetPreviousMode
IoDeleteDevice
IoDeleteSymbolicLink
IoGetTopLevelIrp
IoUnregisterShutdownNotification
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
swprintf
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
RtlGetVersion
PsWrapApcWow64Thread
IoGetCurrentProcess
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenKey
ZwQueryValueKey
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
RtlDuplicateUnicodeString
KeInitializeApc
KeInsertQueueApc
KeTestAlertThread
PsGetProcessWow64Process
PsIsProtectedProcess
RtlImageDirectoryEntryToData
DbgPrint
RtlTimeToTimeFields
KeDelayExecutionThread
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType
RtlInt64ToUnicodeString
ObRegisterCallbacks
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutineEx
PsGetProcessCreateTimeQuadPart
PsGetProcessId
PsGetThreadProcessId
PsThreadType
CmRegisterCallback
CmUnRegisterCallback
MmIsAddressValid
ObQueryNameString
towupper
towlower
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHIPS_X86.sys
.sys windows:6 windows x86 arch:x86

aa246f6f3b06e944345ccc216f75f294

Code Sign

33:00:00:00:4d:e5:97:a7:75:e3:15:7f:7b:00:00:00:00:00:4d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/09/2021, 19:15

Not After

01/09/2022, 19:15

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:7a:ad:c4:77:5b:f2:46:32:17:51:f5:5c:0b:66:36:c6:94:ee:9c:74:9a:91:38:ad:e0:17:0a:52:34:e4:a9
Signer

Actual PE Digest

92:7a:ad:c4:77:5b:f2:46:32:17:51:f5:5c:0b:66:36:c6:94:ee:9c:74:9a:91:38:ad:e0:17:0a:52:34:e4:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\Develop\PDB\WiseVectorHIPS_X86.pdb

Imports

fltmgr.sys

FltAllocatePoolAlignedWithTag
FltFreePoolAlignedWithTag
FltGetVolumeName
FltCreateFile
FltReadFile
FltWriteFile
FltQueryInformationFile
FltClose
FltGetVolumeInstanceFromName
FltEnumerateVolumes
FltObjectDereference
FltAllocateContext
FltSetStreamContext
FltGetStreamContext
FltReleaseContext
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltCompletePendedPostOperation
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltIsDirectory
FltDeleteStreamContext
FltAllocateDeferredIoWorkItem
FltFreeDeferredIoWorkItem
FltQueueDeferredIoWorkItem
FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor

ksecdd.sys

BCryptOpenAlgorithmProvider
BCryptHashData
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash

ntoskrnl.exe

RtlCompareUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
_vsnwprintf
memset
RtlCopyUnicodeString
ExInitializeResourceLite
ExDeleteResourceLite
wcsrchr
_wcsicmp
_wcsnicmp
KeEnterCriticalRegion
KeLeaveCriticalRegion
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
RtlInitUnicodeString
ExReleaseResourceLite
ExGetPreviousMode
IoDeleteDevice
IoDeleteSymbolicLink
IoGetTopLevelIrp
IoUnregisterShutdownNotification
PsSetCreateProcessNotifyRoutine
PsGetCurrentProcessId
PsGetCurrentThreadId
swprintf
KeGetCurrentThread
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
RtlGetVersion
IoGetCurrentProcess
ZwClose
ZwCreateSection
ZwMapViewOfSection
wcsstr
ZwOpenKey
ZwQueryValueKey
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
RtlDuplicateUnicodeString
KeInitializeApc
KeInsertQueueApc
KeTestAlertThread
PsIsProtectedProcess
RtlImageDirectoryEntryToData
memcpy
memmove
DbgPrint
RtlTimeToTimeFields
KeDelayExecutionThread
KeQuerySystemTime
ExSystemTimeToLocalTime
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
PsLookupProcessByProcessId
ObOpenObjectByPointer
_allmul
PsProcessType
RtlInt64ToUnicodeString
ObRegisterCallbacks
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutineEx
PsGetProcessCreateTimeQuadPart
PsGetProcessId
PsGetThreadProcessId
PsThreadType
CmRegisterCallback
CmUnRegisterCallback
MmIsAddressValid
ObQueryNameString
towupper
towlower
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
wcschr
ZwUnmapViewOfSection
ExAcquireResourceExclusiveLite

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperEight.dll
.dll windows:6 windows x86 arch:x86

9de199db682e36836ab04c8690aed9a0

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

58:4d:3b:c6:97:a8:2e:cb:a3:a9:e9:9e:41:6b:87:52:e6:65:39:aa:29:be:96:17:b7:25:b0:06:9b:ea:ea:89
Signer

Actual PE Digest

58:4d:3b:c6:97:a8:2e:cb:a3:a9:e9:9e:41:6b:87:52:e6:65:39:aa:29:be:96:17:b7:25:b0:06:9b:ea:ea:89

Digest Algorithm

sha256

PE Digest Matches

true

f3:72:79:f6:1d:8c:ed:39:c4:b0:70:ec:89:df:85:eb:6d:dd:19:d8
Signer

Actual PE Digest

f3:72:79:f6:1d:8c:ed:39:c4:b0:70:ec:89:df:85:eb:6d:dd:19:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\Other\BeatTrojan2017\New\2017Release\WiseVectorHelperEight.pdb

Imports

kernel32

OutputDebugStringW
WideCharToMultiByte
WriteConsoleW
CreateFileW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
HeapSize
SetStdHandle
SetFilePointerEx
HeapReAlloc
GetProcessHeap
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
RaiseException
InterlockedFlushSList
RtlUnwind
FreeLibrary
LoadLibraryExW
CloseHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW

advapi32

OpenTraceW
ControlTraceW
EnableTraceEx2
ProcessTrace
StartTraceW
CloseTrace

ole32

CoInitializeEx
StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
SysFreeString

tdh

TdhGetPropertySize
TdhGetEventInformation

Exports

Exports

WiseVectorEight_Four
WiseVectorEight_One
WiseVectorEight_Three
WiseVectorEight_Two

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperFive.dll
.dll windows:5 windows x86 arch:x86

f017c78881de3c27e8daefc778494c80

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:1f:1a:80:50:69:75:8d:6e:21:55:bf:5e:21:c7:6f:32:a0:3d:4f:85:a8:88:bc:d1:6a:2a:7e:aa:0f:15:65
Signer

Actual PE Digest

82:1f:1a:80:50:69:75:8d:6e:21:55:bf:5e:21:c7:6f:32:a0:3d:4f:85:a8:88:bc:d1:6a:2a:7e:aa:0f:15:65

Digest Algorithm

sha256

PE Digest Matches

true

3f:0b:5c:30:dc:ee:bc:fa:06:0d:05:20:91:9f:e2:ea:11:d5:e4:40
Signer

Actual PE Digest

3f:0b:5c:30:dc:ee:bc:fa:06:0d:05:20:91:9f:e2:ea:11:d5:e4:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

kernel32

GetVersionExW
OpenProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

LookupPrivilegeValueW

wisevectorcommu

?Eg1@Cagcommunication@@QAEHPAUag_ctx_tag@@@Z

psapi

GetMappedFileNameW

Exports

Exports

??0CHelperFive@@QAE@XZ
??1CHelperFive@@QAE@XZ
??4CHelperFive@@QAEAAV0@ABV0@@Z
??4Cagcommunication@@QAEAAV0@ABV0@@Z
?GetThreadMap@CHelperFive@@AAEHAAV?$multimap@KKU?$less@K@std@@V?$allocator@U?$pair@$$CBKK@std@@@2@@std@@@Z
?Helper1@CHelperFive@@QAEHP6AHHAAHPADPA_WPAEH@Z@Z
?Helper2@CHelperFive@@QAEHII@Z
?Helper3@CHelperFive@@QAEHKK@Z
?Helper4@CHelperFive@@QAEHKPA_W@Z
?KillProcess@CHelperFive@@AAEXK@Z
?ScanMalware@CHelperFive@@AAEHPA_WK@Z
?StartScanThread@CHelperFive@@KGKPAX@Z
?WaitForAnswer@CHelperFive@@AAEIPAUMiniNotifyDlgDispInfo@@@Z
?WaitMemoryGuard@CHelperFive@@AAEXKPADPA_WUt_report@pesieve@@@Z
?WaitMisMatchGuard@CHelperFive@@AAEXKPA_W0Ut_report@pesieve@@@Z
?WaitThreadGuard@CHelperFive@@AAEXKPA_W0@Z

Sections

.text
Size: - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wisevec
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WiseVectorHelperFour.dll
.dll windows:5 windows x86 arch:x86

a2576cea42551291ce0b1de4d8d6f738

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:79:57:51:0e:4a:22:b9:18:db:51:a3:45:db:a2:44:2a:3a:87:44:3f:9d:05:7b:5e:42:81:56:6d:07:3c:51
Signer

Actual PE Digest

30:79:57:51:0e:4a:22:b9:18:db:51:a3:45:db:a2:44:2a:3a:87:44:3f:9d:05:7b:5e:42:81:56:6d:07:3c:51

Digest Algorithm

sha256

PE Digest Matches

true

65:9e:56:53:19:ab:ef:ce:a1:e3:da:46:9e:b1:ca:08:fd:48:80:ed
Signer

Actual PE Digest

65:9e:56:53:19:ab:ef:ce:a1:e3:da:46:9e:b1:ca:08:fd:48:80:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\PDB\sewindows.pdb

Imports

kernel32

GetProcAddress
GetWindowsDirectoryW
QueryDosDeviceW
GetVersionExW
GetProcessTimes
GetModuleHandleA
LoadLibraryW
ReadProcessMemory
FindFirstFileW
FindClose
GetModuleHandleExW
SizeofResource
LockResource
GetModuleHandleW
FindResourceW
FindResourceExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateFileW
DeviceIoControl
IsDebuggerPresent
OutputDebugStringW
WriteConsoleW
SetStdHandle
DeleteCriticalSection
DecodePointer
HeapSize
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetShortPathNameW
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
CloseHandle
GetQueuedCompletionStatus
GetLastError
TerminateProcess
OpenProcess
CreateThread
CreateIoCompletionPort
WaitForMultipleObjectsEx
TerminateThread
LoadResource
EncodePointer
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
RtlUnwind
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers

advapi32

RegCloseKey
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
OpenServiceW
StartServiceW
RegFlushKey
RegSetValueExW
RegCreateKeyExW
CreateServiceW
CloseServiceHandle
OpenProcessToken

fltlib

FilterReplyMessage
FilterFindFirst
FilterFindNext
FilterFindClose
FilterGetMessage
FilterConnectCommunicationPort

Exports

Exports

WiseHIPS_Eight
WiseHIPS_Eightteen
WiseHIPS_Ele
WiseHIPS_Fifteen
WiseHIPS_Five
WiseHIPS_Four
WiseHIPS_Fourteen
WiseHIPS_Nine
WiseHIPS_Nineteen
WiseHIPS_One
WiseHIPS_Seven
WiseHIPS_Seventeen
WiseHIPS_Six
WiseHIPS_Sixteen
WiseHIPS_Ten
WiseHIPS_Thi
WiseHIPS_Three
WiseHIPS_Twe
WiseHIPS_Twentyone
WiseHIPS_Twentythree
WiseHIPS_Twentytwo
WiseHIPS_Two

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperOne_X64.dll
.dll windows:6 windows x64 arch:x64

204de7a1c734fe44d6c9593e9bd07a02

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a8:19:0a:c7:a3:23:29:e6:c7:ac:b9:1d:14:44:10:78:cf:79:75:14:d6:1f:c2:7a:5f:10:ae:ec:75:ac:df:65
Signer

Actual PE Digest

a8:19:0a:c7:a3:23:29:e6:c7:ac:b9:1d:14:44:10:78:cf:79:75:14:d6:1f:c2:7a:5f:10:ae:ec:75:ac:df:65

Digest Algorithm

sha256

PE Digest Matches

true

a8:7e:13:e9:bf:87:43:67:24:b6:8b:7f:4b:1e:35:c0:fb:06:ac:7e
Signer

Actual PE Digest

a8:7e:13:e9:bf:87:43:67:24:b6:8b:7f:4b:1e:35:c0:fb:06:ac:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetCurrentProcess
GetLastError
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
ReleaseMutex
WaitForSingleObject
CloseHandle
MapViewOfFile
UnmapViewOfFile
OpenMutexW
OpenFileMappingW
GetSystemDirectoryW
GetWindowsDirectoryW
GetProcessTimes
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteFile
ReadFile
GetLocalTime
GetCommandLineW
VirtualProtect
GetLongPathNameW
MultiByteToWideChar
GetProcessHeap
GetVersionExW
HeapFree
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
HeapSize
GetStdHandle
GetStringTypeW
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
GetThreadContext
SetThreadContext
Thread32First
HeapCreate
Thread32Next
FlushInstructionCache
OpenThread
CreateToolhelp32Snapshot
SuspendThread
ResumeThread
VirtualQuery
VirtualFree
VirtualAlloc
GetSystemInfo

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperOne_X86.dll
.dll windows:6 windows x86 arch:x86

e7a49ba112c5638263635d914118d649

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ac:c8:49:31:a2:1b:9a:a6:c1:65:e1:7c:f0:c1:05:92:0a:4e:76:ae:f7:b0:88:a4:09:b4:3a:63:a4:91:2a:5a
Signer

Actual PE Digest

ac:c8:49:31:a2:1b:9a:a6:c1:65:e1:7c:f0:c1:05:92:0a:4e:76:ae:f7:b0:88:a4:09:b4:3a:63:a4:91:2a:5a

Digest Algorithm

sha256

PE Digest Matches

true

13:8c:32:1d:c7:5c:af:ac:4c:12:e4:cb:ee:10:04:8d:08:3f:58:bc
Signer

Actual PE Digest

13:8c:32:1d:c7:5c:af:ac:4c:12:e4:cb:ee:10:04:8d:08:3f:58:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\PDB\TestHookApi.pdb

Imports

kernel32

GetProcAddress
GetCurrentProcess
GetLastError
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
ReleaseMutex
WaitForSingleObject
CloseHandle
MapViewOfFile
UnmapViewOfFile
OpenMutexW
OpenFileMappingW
GetSystemDirectoryW
GetWindowsDirectoryW
GetProcessTimes
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteFile
ReadFile
GetLocalTime
GetCommandLineW
VirtualProtect
GetLongPathNameW
SearchPathW
MultiByteToWideChar
GetProcessHeap
GetVersionExW
HeapFree
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapAlloc
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThread
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
GetStdHandle
GetStringTypeW
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CreateSemaphoreW
FatalAppExitA
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
GetThreadContext
SetThreadContext
InterlockedCompareExchange
Thread32First
HeapDestroy
HeapCreate
Thread32Next
FlushInstructionCache
InterlockedExchange
OpenThread
CreateToolhelp32Snapshot
SuspendThread
ResumeThread
VirtualQuery
VirtualFree
VirtualAlloc

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperSeven.dll
.dll windows:5 windows x86 arch:x86

f5c711c8d112124763fe9849e06476fa

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:dc:2a:76:ab:a8:34:7f:ec:08:1e:dd:fc:6f:c0:ac:97:70:9e:36:bf:a0:cc:9e:78:25:f9:95:ed:e1:17:fe
Signer

Actual PE Digest

52:dc:2a:76:ab:a8:34:7f:ec:08:1e:dd:fc:6f:c0:ac:97:70:9e:36:bf:a0:cc:9e:78:25:f9:95:ed:e1:17:fe

Digest Algorithm

sha256

PE Digest Matches

true

d8:53:f6:0b:60:1a:c3:33:fb:b4:2d:26:86:06:6e:4c:a3:2a:fb:d3
Signer

Actual PE Digest

d8:53:f6:0b:60:1a:c3:33:fb:b4:2d:26:86:06:6e:4c:a3:2a:fb:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\Other\BeatTrojan2017\New\2017Release\WiseVectorHelperSeven.pdb

Imports

libcrypto-1_1

OBJ_nid2sn
HMAC_Init_ex
EVP_CIPHER_nid
EVP_get_cipherbyname
EVP_CipherFinal_ex
PKCS5_PBKDF2_HMAC_SHA1
EVP_CipherUpdate
EVP_MD_size
EVP_CIPHER_block_size
RAND_bytes
HMAC_Update
HMAC_CTX_free
HMAC_CTX_new
EVP_CIPHER_key_length
EVP_CIPHER_CTX_free
EVP_CipherInit_ex
EVP_CIPHER_CTX_set_padding
EVP_CIPHER_CTX_new
EVP_sha1
EVP_CIPHER_iv_length
OPENSSL_init_crypto
RAND_add
HMAC_Final

kernel32

LCMapStringW
CompareStringW
GetStringTypeW
RtlUnwind
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetProcAddress
GetModuleHandleW
GetSystemDirectoryW
ReadProcessMemory
GetWindowsDirectoryW
OpenProcess
TerminateProcess
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
IsWow64Process
Process32NextW
LoadLibraryW
GetCurrentProcess
GetLastError
LocalFree
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
SetFileTime
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
MoveFileW
DeleteFileW
GetLocalTime
SetFileAttributesW
Sleep
MoveFileExW
HeapAlloc
GetProcessHeap
GetTickCount
FileTimeToSystemTime
GetFileInformationByHandle
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
CreateMutexW
HeapCompact
TryEnterCriticalSection
FreeLibrary
QueryPerformanceCounter
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
FormatMessageW
GetVersionExW
ReadConsoleW
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
VirtualUnlock
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
VirtualLock
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetStartupInfoW
TlsFree
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
HeapFree
HeapDestroy
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetCommandLineA
CreateThread
ExitThread
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue

user32

GetDesktopWindow
wsprintfW

advapi32

FreeSid
OpenProcessToken
SetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW

Exports

Exports

WiseVectorSeven_Five
WiseVectorSeven_Four
WiseVectorSeven_One
WiseVectorSeven_Three
WiseVectorSeven_Two

Sections

.text
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperSix.dll
.dll windows:5 windows x86 arch:x86

0ec63f14bbecc5a7974d708044fd8dfd

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

15:98:b3:2f:a7:2d:f6:32:a6:b6:d6:5c:8b:43:54:34:c8:8f:f8:54:ad:da:1d:5f:24:db:7b:73:72:ca:bf:6e
Signer

Actual PE Digest

15:98:b3:2f:a7:2d:f6:32:a6:b6:d6:5c:8b:43:54:34:c8:8f:f8:54:ad:da:1d:5f:24:db:7b:73:72:ca:bf:6e

Digest Algorithm

sha256

PE Digest Matches

true

4c:1b:0a:84:1f:4a:f3:e7:48:5d:7c:9c:bd:ba:c0:60:13:49:b7:e9
Signer

Actual PE Digest

4c:1b:0a:84:1f:4a:f3:e7:48:5d:7c:9c:bd:ba:c0:60:13:49:b7:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\PDB\WiseVectorHelperSix.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
WriteFile
DeviceIoControl
GetSystemInfo
GetTickCount
CreateEventW
GetModuleHandleA
GetOverlappedResult
CancelIo
CreateFileA
GetVersionExA
MultiByteToWideChar
GetTempFileNameW
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
GetLastError
OpenProcess
GetProcAddress
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetFileAttributesW
GetUserDefaultUILanguage
InitializeCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetVersionExW
GetCurrentProcessId
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WideCharToMultiByte
EncodePointer
DecodePointer
GetStringTypeW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
GetCommandLineA
GetCurrentThreadId
CreateThread
ExitThread
LoadLibraryExW
RaiseException
RtlUnwind
HeapReAlloc
SetEndOfFile
GetProcessHeap
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameA
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW

advapi32

CreateServiceW
StartServiceW
QueryServiceStatus
OpenServiceA
OpenSCManagerW
OpenProcessToken
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges

iphlpapi

GetAdaptersAddresses

ws2_32

ntohl
htons
WSACleanup
WSAStartup
ntohs
WSAAddressToStringA
getnameinfo

Exports

Exports

WiseVectorSix_Five
WiseVectorSix_Four
WiseVectorSix_One
WiseVectorSix_Three
WiseVectorSix_Two

Sections

.text
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorHelperTwo.dll
.dll windows:5 windows x86 arch:x86

32e11888eba02622dfd520df814d18b5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:b4:22:f8:df:80:9c:85:dc:f3:e7:3c:ff:8a:fb:3d:9b:e9:5b:cb:08:89:e0:51:cc:eb:9f:24:c0:c6:13:cb
Signer

Actual PE Digest

07:b4:22:f8:df:80:9c:85:dc:f3:e7:3c:ff:8a:fb:3d:9b:e9:5b:cb:08:89:e0:51:cc:eb:9f:24:c0:c6:13:cb

Digest Algorithm

sha256

PE Digest Matches

true

a9:b6:ad:05:af:91:67:0a:66:a4:45:d2:25:56:75:b5:00:16:b5:c9
Signer

Actual PE Digest

a9:b6:ad:05:af:91:67:0a:66:a4:45:d2:25:56:75:b5:00:16:b5:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFullPathNameW
ExpandEnvironmentStringsW
GetFileAttributesW
DeviceIoControl
GetModuleFileNameW
LoadLibraryExW
GetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentProcess
GetVersionExW
GetModuleHandleW
SetErrorMode
GetPrivateProfileStringW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetProcAddress
CreateFileW
CloseHandle
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindNextFileW
FindClose
FindFirstFileW
GetDriveTypeW
SetLastError
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetStdHandle
WriteFile
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW

advapi32

RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree

shlwapi

StrPBrkW
PathAppendW
StrCmpIW
StrChrW
StrCmpNW
StrCpyNW
StrCmpNIW
StrRChrW

Exports

Exports

WvHelperTwoHandle

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorScan.dll
.dll windows:5 windows x86 arch:x86

b7b6adde85b8b0fd72b272c986083372

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

32:7a:73:ee:48:c7:cc:7f:40:5f:25:ab:a8:00:f5:d5:dd:a5:86:55:c4:69:39:98:44:2d:c2:15:c6:0b:78:6a
Signer

Actual PE Digest

32:7a:73:ee:48:c7:cc:7f:40:5f:25:ab:a8:00:f5:d5:dd:a5:86:55:c4:69:39:98:44:2d:c2:15:c6:0b:78:6a

Digest Algorithm

sha256

PE Digest Matches

true

85:89:d7:d9:dd:ea:9c:d3:2a:99:5b:29:d5:8b:88:9b:d6:45:b3:77
Signer

Actual PE Digest

85:89:d7:d9:dd:ea:9c:d3:2a:99:5b:29:d5:8b:88:9b:d6:45:b3:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
GetWindowsDirectoryW
GetCurrentProcess
GetCurrentThread
TerminateProcess
CreateDirectoryW
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetPrivateProfileIntW
WritePrivateProfileStringW
GetVersionExW
GetDriveTypeW
SetErrorMode
DeleteCriticalSection
SetEvent
CreateEventW
ResetEvent
GetLocalTime
GetTickCount
TerminateThread
SetProcessWorkingSetSize
RaiseException
DecodePointer
WriteConsoleW
SetStdHandle
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetFileAttributesW
ExpandEnvironmentStringsW
GetLongPathNameW
GetFullPathNameW
LocalFree
DeviceIoControl
GetModuleHandleW
GetProcAddress
CreateFileW
CloseHandle
GetLastError
FindNextFileW
FindClose
FindFirstFileW
SetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetSystemDirectoryW
HeapDestroy
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsProcessorFeaturePresent
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
TlsAlloc
FlushFileBuffers

advapi32

RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetThreadToken
ImpersonateSelf
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RevertToSelf
OpenProcessToken
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetAce
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoUninitialize
CoInitialize

wisevectorcommu

??0Cagcommunication@@QAE@XZ
?Eg1@Cagcommunication@@QAEHPAUag_ctx_tag@@@Z
?Eg4@Cagcommunication@@QAEHH@Z

shlwapi

StrChrW
StrRChrW
StrCmpNIW
PathAppendW
StrCpyNW
PathRemoveFileSpecW
StrCmpNW

userenv

UnloadUserProfile

mpr

WNetGetResourceInformationW

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

Exports

Exports

??0CScanWork@@QAE@ABV0@@Z
??0CScanWork@@QAE@XZ
??1CScanWork@@QAE@XZ
??4CScanWork@@QAEAAV0@ABV0@@Z
??4Cagcommunication@@QAEAAV0@ABV0@@Z
??_7CScanWork@@6BIBKEngineCallback@Skylark@@@
??_7CScanWork@@6BIEnumOperation@@@
?AfterCleanFile@CScanWork@@MAGJPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?AfterScanFile@CScanWork@@MAGJPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?BeforeCleanFile@CScanWork@@MAGJPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?BeforeScanFile@CScanWork@@MAGJPB_WPAX@Z
?Clean@CScanWork@@QAEJABV?$CAtlArray@KV?$CElementTraits@K@ATL@@@ATL@@@Z
?CleanSingleFile@CScanWork@@QAEJPA_W0@Z
?CleanVirusFileProc@CScanWork@@CGIPAX@Z
?EnumScanFileProc@CScanWork@@CGIPAX@Z
?GetScanSetting@CScanWork@@QAEJAAU_BK_SCAN_SETTING@@@Z
?Initialize@CScanWork@@QAEJKPAVIScanFileCallBack@@@Z
?IsExitEnumWork@CScanWork@@MAEHXZ
?OnFinish@CScanWork@@MAGJJ@Z
?OnIdle@CScanWork@@MAGJXZ
?OnScanDetail@CScanWork@@MAGJPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?OperateFile@CScanWork@@MAEJABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBU_WIN32_FIND_DATAW@@KPAX2@Z
?QueryCleanInfo@CScanWork@@QAEJAAU_WV_CLEAN_INFO@@@Z
?QueryFileInfo@CScanWork@@QAEJHKAAU_BK_FILE_INFO@@@Z
?QueryScanInfo@CScanWork@@QAEJAAU_WV_SCAN_INFO@@@Z
?QueryScanStep@CScanWork@@QAEJHAAV?$CAtlArray@HV?$CElementTraits@H@ATL@@@ATL@@@Z
?Scan@CScanWork@@QAEJHHHQAY0CAA@_W@Z
?ScanSingleFile@CScanWork@@QAEJHPA_WPAD110AAHAAM0H@Z
?SetScanSetting@CScanWork@@QAEJABU_BK_SCAN_SETTING@@@Z
?Stop@CScanWork@@QAEJXZ
?Uninitialize@CScanWork@@QAEJXZ
?_CleanWork@CScanWork@@AAEJXZ
?_EnumFileWork@CScanWork@@AAEKXZ
?_ExitCleanVirusThread@CScanWork@@AAEXXZ
?_ExitEnumFileThread@CScanWork@@AAEXXZ
?_IsFindFile@CScanWork@@AAEHAAV?$CAtlArray@UBK_FILE_RESULT_EX@@V?$CElementTraits@UBK_FILE_RESULT_EX@@@ATL@@@ATL@@PB_W@Z
?_ResetForClean@CScanWork@@AAEJXZ
?_ResetForScan@CScanWork@@AAEJXZ
?_ScanWork@CScanWork@@AAEJXZ
?_SetScanProgress@CScanWork@@AAEXXZ
?_SetScanTime@CScanWork@@AAEXXZ
?_StopScan@CScanWork@@AAEXXZ
?_UpdateCleanInfo@CScanWork@@AAEXPB_WPBUBKENG_RESULT@Skylark@@PAXI@Z
?_UpdateCleanResult@CScanWork@@AAEXPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?_UpdateScanInfo@CScanWork@@AAEXPB_WPBUBKENG_RESULT@Skylark@@PAX@Z
?_UpdateScanResult@CScanWork@@AAEXPB_WPBUBKENG_RESULT@Skylark@@PAX@Z

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiseVectorService.exe
.exe windows:5 windows x86 arch:x86

c9f1ec22191c8a8b55b9801534241d7c

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a3:00:8b:45:8c:73:51:c9:d2:83:c0:98:13:3f:9e:9d:9a:96:fa:30:3c:2a:f4:32:52:ea:89:20:7e:36:9c:14
Signer

Actual PE Digest

a3:00:8b:45:8c:73:51:c9:d2:83:c0:98:13:3f:9e:9d:9a:96:fa:30:3c:2a:f4:32:52:ea:89:20:7e:36:9c:14

Digest Algorithm

sha256

PE Digest Matches

true

48:67:42:a7:ab:4e:6c:27:f3:08:75:89:01:57:49:fb:40:75:d5:b7
Signer

Actual PE Digest

48:67:42:a7:ab:4e:6c:27:f3:08:75:89:01:57:49:fb:40:75:d5:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
LoadLibraryExW
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetCurrentProcessId
lstrcmpA
GlobalGetAtomNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
WaitForSingleObject
GetCurrentThreadId
SetThreadPriority
ResumeThread
GlobalAddAtomW
EncodePointer
CompareStringW
FreeLibrary
GlobalFlags
lstrcmpW
FreeResource
GlobalDeleteAtom
GlobalFindAtomW
lstrcpyW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
GetTempPathW
GetTickCount
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
GetCommandLineA
CreateThread
ExitThread
HeapQueryInformation
GetModuleHandleExW
GetSystemInfo
VirtualAlloc
VirtualQuery
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetStringTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
LCMapStringW
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
GetModuleHandleW
GetModuleHandleA
DuplicateHandle
OutputDebugStringA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
CopyFileW
FindResourceW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SizeofResource
LockResource
LoadResource
SetLastError
LoadLibraryA
ExitProcess
lstrcmpiW
WideCharToMultiByte
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
CloseHandle
Sleep
GetShortPathNameW
InterlockedDecrement
CreateProcessW
GetUserDefaultUILanguage
GetVersionExW
GetSystemDirectoryW
LoadLibraryW
GetCurrentProcess
GetProcAddress
GetFileAttributesW
GetCurrentDirectoryW
GetPrivateProfileStringW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
EnterCriticalSection
DecodePointer

user32

GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
SetRectEmpty
OffsetRect
IsRectEmpty
LoadImageW
DrawIconEx
GetIconInfo
MessageBeep
GetAsyncKeyState
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
SetWindowRgn
UnionRect
IsMenu
UpdateLayeredWindow
MonitorFromPoint
BringWindowToTop
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetKeyNameTextW
TrackMouseEvent
GetComboBoxInfo
IsZoomed
GetSystemMenu
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetCursorPos
SetRect
SetParent
LockWindowUpdate
SetClassLongW
GetDoubleClickTime
CopyIcon
SetMenuDefaultItem
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
FrameRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
MapDialogRect
DestroyCursor
GetWindowRgn
DrawIcon
GetTopWindow
GetClassLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetClientRect
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
SendDlgItemMessageA
GetNextDlgTabItem
TrackPopupMenu
SetMenu
GetMenu
GetCapture
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
FillRect
ScreenToClient
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
IsDialogMessageW
SetWindowLongW
CheckDlgButton
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
IsWindow
GetScrollPos
SetScrollPos
SetFocus
RealChildWindowFromPoint
GetWindow
GetClassNameW
GetDesktopWindow
PtInRect
ClientToScreen
GetWindowRect
SetWindowTextW
GetFocus
GetDlgCtrlID
DestroyIcon
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetLastActivePopup
GetWindowThreadProcessId
GetParent
GetWindowLongW
IsWindowEnabled
EnableWindow
SendMessageW
UnhookWindowsHookEx
GetSystemMetrics
CharUpperW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
MessageBoxW
CopyImage
SystemParametersInfoW
EndDialog
CreateDialogIndirectParamW
InvalidateRect
KillTimer
SetTimer
DeleteMenu
SetCursor
ShowOwnedPopups
GetMenuItemInfoW
DestroyMenu
IntersectRect
InflateRect
IsIconic
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
UpdateWindow
LoadIconW
RemovePropW

advapi32

RegDeleteKeyW
RegEnumKeyExW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
RegDeleteValueW
RegCreateKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

shell32

SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHFileOperationW

ole32

OleTranslateAccelerator
IsAccelerator
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
VariantClear
VariantInit
SysFreeString
SysAllocString
VariantCopy
VariantChangeType
VarBstrFromDate

msimg32

TransparentBlt
AlphaBlend

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFileExistsW
StrFormatKBSizeW

uxtheme

DrawThemeParentBackground
OpenThemeData
CloseThemeData
GetThemePartSize
GetWindowTheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
DrawThemeText

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipSetInterpolationMode
GdipDrawImageRectI
GdipBitmapUnlockBits
GdipGetImagePixelFormat
GdipGetImageHeight
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdiplusShutdown
GdipAlloc
GdipGetImageWidth

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

gdi32

GetTextExtentPoint32W
GetTextMetricsW
CreatePalette
CreateDCW
GetDeviceCaps
DeleteObject
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreateFontIndirectW
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
BitBlt
CreateBitmap
CreateCompatibleDC
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
DeleteDC
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
CopyMetaFileW
GetTextFaceW
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
GetBoundsRect
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
Rectangle
EnumFontFamiliesExW
GetRgnBox
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WiseVectorSvc.exe
.exe windows:5 windows x86 arch:x86

390d276a9774ef136c21122d759ca644

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

01/11/2021, 00:00

Not After

31/10/2024, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,ST=Beijing Shi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2e:2c:08:36:ff:eb:1e:97:12:d2:1a:9e:c5:34:08:ab:ae:32:63:22:dd:38:87:07:87:13:4f:3c:af:3a:b3:65
Signer

Actual PE Digest

2e:2c:08:36:ff:eb:1e:97:12:d2:1a:9e:c5:34:08:ab:ae:32:63:22:dd:38:87:07:87:13:4f:3c:af:3a:b3:65

Digest Algorithm

sha256

PE Digest Matches

true

db:e8:be:51:e6:54:c5:85:38:db:cd:b4:09:27:52:7e:de:81:3f:54
Signer

Actual PE Digest

db:e8:be:51:e6:54:c5:85:38:db:cd:b4:09:27:52:7e:de:81:3f:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
ReadFile
FlushFileBuffers
CloseHandle
ConnectNamedPipe
DisconnectNamedPipe
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateEventW
OpenFileMappingW
GetModuleFileNameW
GetPrivateProfileIntW
CreateNamedPipeW
Sleep
SetEvent
FindClose
OpenEventW
WritePrivateProfileStringW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WaitForSingleObject
ResetEvent
TerminateThread
CreateThread
ExitProcess
SetProcessWorkingSetSize
GetVersionExW
LoadLibraryW
GetLastError
GetCurrentProcess
LocalFree
GetShortPathNameW
GetProcAddress
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
RtlUnwind
EncodePointer
DecodePointer
HeapFree
HeapAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
GetModuleHandleExW
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
RaiseException
SetFilePointerEx
CreateFileW
SetStdHandle
WriteConsoleW
LoadLibraryExW
OutputDebugStringW
HeapReAlloc
HeapSize

advapi32

OpenProcessToken
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
InitializeSecurityDescriptor

eg

?Eg1@CEg@@QAEHPAUag_ctx_tag@@@Z
??0CEg@@QAE@XZ
?Eg4@CEg@@QAEHXZ

Exports

Exports

??4CDoEgAddtionalHelper@@QAEAAV0@ABV0@@Z
??4CEg@@QAEAAV0@ABV0@@Z

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bait/sample.doc
.doc windows office2003
bait/sample.jpg
.jpg
bait/sample.mdb
bait/sample.sql
bait/sample.txt
bait/sample.xls
.xls windows office2003
bak/lh.de
bak/lr.cfg
bak/me.de
bak/nh.de
cfg/lr.cfg
cfg/rec.de
cfg/set.de
dat/a.mtk
dat/d.mtk
dat/do.mtk
dat/f.mtk
dat/ic.db
dat/lh.de
dat/local.de
dat/localu.de
dat/me.de
dat/nh.de
dat/o.mtk
dat/p.mtk
dat/pa.mtk
dat/pa.ptk
dat/po.mtk
dat/pp.mtk
dat/ppo.mtk
dat/se.de
dat/u.mtk
dat/uo.mtk
dat/v.mtk
dbghelp.dll
.dll windows:6 windows x86 arch:x86

c4677aef9c8c5ed50bde782c8933dff3

Code Sign

33:00:00:00:5a:ed:2f:f4:e4:20:99:3f:3a:00:00:00:00:00:5a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2014, 17:13

Not After

23/08/2015, 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:35

Not After

24/12/2014, 17:35

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:c5:92:3c:cc:97:1a:7a:79:6d:a8:6d:30:27:cf:07:24:d8:f6:50:52:c8:dd:a5:fe:97:80:3b:70:77:b4:15
Signer

Actual PE Digest

9d:c5:92:3c:cc:97:1a:7a:79:6d:a8:6d:30:27:cf:07:24:d8:f6:50:52:c8:dd:a5:fe:97:80:3b:70:77:b4:15

Digest Algorithm

sha256

PE Digest Matches

true

48:4f:db:e3:28:ab:12:29:ed:c9:3c:f9:52:13:6c:83:af:2e:de:46
Signer

Actual PE Digest

48:4f:db:e3:28:ab:12:29:ed:c9:3c:f9:52:13:6c:83:af:2e:de:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_lseeki64
_write
_isatty
__pioinfo
__badioinfo
_read
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
memset
memcpy
_ismbblead
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
memmove
__CxxFrameHandler
_errno
iswspace
calloc
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
_ltoa
_strnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
iswdigit
__unDName
bsearch
strchr
fread
fseek
_wfsopen
wcstoul
_wfullpath
_wgetenv
_chsize
_close
_get_osfhandle
_open_osfhandle
ftell
_mbscmp
_memicmp
wcsrchr
strstr
free
realloc
qsort
iswxdigit
wcsncmp
wcschr
_wcsnicmp
_wcsicmp
wcsstr
_wsopen
memcmp

kernel32

InitializeCriticalSectionAndSpinCount
DeviceIoControl
GetFileType
CopyFileExW
SetFileAttributesW
LCMapStringW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExA
GetModuleHandleW
MapViewOfFileEx
FlushViewOfFile
LocalFree
GetSystemTimeAsFileTime
GetVersion
RtlUnwind
GetThreadSelectorEntry
TerminateThread
HeapCreate
HeapDestroy
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
CreateFileMappingA
GetSystemInfo
LoadLibraryA
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
ReadProcessMemory
GetFileAttributesA
SetErrorMode
OutputDebugStringA
WriteFile
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
MapViewOfFile
DuplicateHandle
VirtualProtect
LocalAlloc
RaiseException
SetLastError
FindClose
EnterCriticalSection
LeaveCriticalSection
GetLastError
DeleteCriticalSection
ExitThread
GetTickCount
CloseHandle
InitializeCriticalSection
CreateThread
WaitForSingleObject
GetExitCodeThread
CreateFileA
GetFileSize
ReadFile
TlsGetValue
TlsSetValue
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
Sleep
SetEnvironmentVariableA
SetFilePointer
VirtualAlloc
GetCurrentProcess
UnmapViewOfFile
CreateDirectoryA
DelayLoadFailureHook

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dbghelp_x64.dll
.dll windows:6 windows x64 arch:x64

1070d0a734a349d697cec96febe8448f

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:33:56:f6:94:1d:9a:8c:bd:e5:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:35

Not After

24/12/2014, 17:35

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:6c:4c:8b:c1:68:95:6c:54:a8:ac:54:47:78:b5:c6:cb:55:bc:52:5d:f7:ca:db:dc:1c:17:2f:ac:bf:20:52
Signer

Actual PE Digest

61:6c:4c:8b:c1:68:95:6c:54:a8:ac:54:47:78:b5:c6:cb:55:bc:52:5d:f7:ca:db:dc:1c:17:2f:ac:bf:20:52

Digest Algorithm

sha256

PE Digest Matches

true

da:99:98:a0:c6:6e:fa:97:98:5c:a0:fd:67:37:b9:bd:08:d1:62:b8
Signer

Actual PE Digest

da:99:98:a0:c6:6e:fa:97:98:5c:a0:fd:67:37:b9:bd:08:d1:62:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_lseeki64
_write
_isatty
__pioinfo
__badioinfo
_read
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
memset
memcpy
_ismbblead
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
memmove
__CxxFrameHandler
_errno
iswspace
calloc
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
_ltoa
_strnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
_strlwr
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
iswdigit
__unDName
bsearch
memcmp
strchr
fread
fseek
_wfsopen
wcstoul
_wfullpath
_time64
_chsize
_close
_get_osfhandle
_open_osfhandle
ftell
_mbscmp
_memicmp
_wgetenv
wcsrchr
strstr
free
realloc
qsort
iswxdigit
wcsncmp
wcschr
_wcsnicmp
_wcsicmp
wcsstr
_wsopen
strcmp
wcscmp

kernel32

SetFileAttributesW
__chkstk
LCMapStringW
LocalFree
CopyFileExW
GetVersion
LoadLibraryExA
GetModuleHandleW
GetFileType
DeviceIoControl
InitializeCriticalSectionAndSpinCount
MapViewOfFileEx
FlushViewOfFile
MoveFileW
HeapCreate
HeapDestroy
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
CreateFileMappingA
IsProcessorFeaturePresent
GetSystemInfo
LoadLibraryA
lstrcmpiW
GetCurrentThreadId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ReadProcessMemory
LoadLibraryW
GetSystemDirectoryW
GetFileAttributesA
SetErrorMode
GetVersionExW
OutputDebugStringW
OutputDebugStringA
WriteFile
VirtualFree
OpenProcess
GetCurrentProcessId
GetModuleHandleA
MapViewOfFile
LocalAlloc
RaiseException
FormatMessageW
SetLastError
FindFirstFileW
FindClose
FindNextFileW
GetDriveTypeW
EnterCriticalSection
LeaveCriticalSection
GetLastError
DeleteCriticalSection
ExitThread
GetTickCount
CloseHandle
InitializeCriticalSection
CreateThread
WaitForSingleObject
GetExitCodeThread
DeleteFileW
RemoveDirectoryW
CreateFileA
GetFileSize
ReadFile
TlsGetValue
TlsSetValue
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
GetTempPathW
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
Sleep
GetEnvironmentVariableW
SetEnvironmentVariableA
GetModuleFileNameW
CreateFileW
CopyFileW
CreateDirectoryW
CreateFileMappingW
SetFilePointer
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
GetFileAttributesW
CreateDirectoryA
VirtualAlloc
VirtualProtect
DuplicateHandle
GetCurrentProcess
UnmapViewOfFile
DelayLoadFailureHook

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/0x04.dat
lang/0x09.dat
lang/chinese.dat
lang/english.dat
lib/_ctypes.pyd
.dll windows:5 windows x86 arch:x86

b77655425a9b31633dafaa7e2db5f195

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\_ctypes.pdb

Imports

kernel32

GetProcAddress
GetLastError
SetLastError
DisableThreadLibraryCalls
FreeLibrary
FormatMessageA
LoadLibraryA
LocalFree
IsBadStringPtrW
IsBadStringPtrA
VirtualAlloc
GetSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

ole32

ProgIDFromCLSID

oleaut32

GetErrorInfo
SysFreeString
SysStringLen
SysAllocStringLen

python27

_PyWeakref_ProxyType
PyObject_SetAttrString
PyExc_OverflowError
_PyObject_CallFunction_SizeT
PyObject_AsWriteBuffer
PyObject_CallFunctionObjArgs
_PyArg_ParseTuple_SizeT
_Py_NoneStruct
PyMem_Free
PyErr_WriteUnraisable
PyNumber_AsSsize_t
PyString_Format
PyTuple_GetItem
PyExc_ValueError
PyErr_Occurred
_Py_CheckRecursiveCall
PyDict_GetItemString
PyObject_SetAttr
PyObject_IsSubclass
PyErr_SetString
PyDescr_NewClassMethod
PySequence_GetItem
PyType_IsSubtype
_Py_BuildValue_SizeT
PyErr_NewException
PyUnicodeUCS2_AsWideChar
PyCFunction_NewEx
PyTuple_Pack
_PyObject_CallMethod_SizeT
PyWeakref_NewProxy
_PyWeakref_CallableProxyType
PyType_Type
PyModule_AddStringConstant
PyErr_Clear
PyObject_IsInstance
PyEval_InitThreads
PyMethod_New
PyList_New
PyType_GenericNew
PySequence_GetSlice
PyExc_RuntimeError
PyMem_Malloc
PyErr_Format
PyModule_AddObject
PyExc_TypeError
PyLong_FromVoidPtr
PyDict_SetItemString
PyExc_IndexError
PyObject_GetAttrString
PyDescr_NewGetSet
_PySlice_Unpack
PyErr_NoMemory
Py_InitModule4
PyArg_UnpackTuple
PyDict_Type
PySys_GetObject
PyFile_WriteString
PyGILState_Release
PyInt_AsLong
Py_Initialize
PyObject_GC_Del
PyCode_NewEmpty
PyFrame_New
PyObject_CallFunction
Py_IsInitialized
PyThreadState_Get
PyExc_RuntimeWarning
PyTraceBack_Here
PyObject_GC_Track
PyErr_Print
PyObject_GC_UnTrack
PyImport_ImportModuleNoBlock
PyGILState_Ensure
_PyObject_GC_NewVar
PyErr_WarnEx
_PyObject_New
PyDict_SetItem
PyCapsule_IsValid
PyErr_SetFromWindowsErr
Py_BuildValue
PyLong_FromSsize_t
PyTuple_Type
PyCapsule_New
PyErr_SetObject
PyEval_RestoreThread
PyEval_SaveThread
PyArg_ParseTuple
PyObject_Free
PyObject_CallMethod
PyLong_AsUnsignedLong
PyLong_AsLong
PyMem_Realloc
PyThreadState_GetDict
PyCapsule_GetPointer
PyErr_NormalizeException
PyString_ConcatAndDel
PyString_FromFormatV
PyString_Type
PyExc_WindowsError
PyErr_Fetch
PyFloat_FromDouble
_PyFloat_Pack8
PyInt_AsUnsignedLongLongMask
PyLong_FromUnsignedLong
_PyFloat_Unpack4
PyFloat_Type
PyLong_FromLongLong
_PyFloat_Unpack8
PyBool_FromLong
_PyFloat_Pack4
_PyString_Resize
PyString_Size
PyFloat_AsDouble
PyObject_IsTrue
PyLong_FromUnsignedLongLong
Py_FatalError
_PyInt_AsInt
PySequence_Fast
PyTuple_Size
PyObject_HasAttrString
PyObject_GetAttr
PyUnicodeUCS2_AsEncodedString
_PyThreadState_Current
PyObject_AsReadBuffer
PyObject_GenericSetAttr
PyString_AsString
PyBuffer_Type
PyDict_DelItem
PyDict_GetItem
PyTuple_GetSlice
PyString_FromStringAndSize
_PySlice_AdjustIndices
PyUnicodeUCS2_FromWideChar
PyBuffer_Release
PyDict_Update
PyInt_FromLong
PyObject_CallObject
PyString_FromFormat
PyString_Concat
PyUnicodeUCS2_FromEncodedObject
PyDict_New
PyLong_AsVoidPtr
PyTuple_New
PyDict_Next
PyCallable_Check
PySequence_Size
PyUnicodeUCS2_FromUnicode
PySequence_Tuple
PyInt_AsUnsignedLongMask
_Py_CheckRecursionLimit
PyInt_FromSsize_t
PyString_FromString
PySequence_SetItem
PyExc_AttributeError
PySlice_Type
PyType_Ready
PyString_InternFromString
PyObject_Str
PyObject_GetBuffer
PyDict_Size

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
isspace
_vsnprintf
_errno
memset
strchr
memmove
sprintf
memcpy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
init_ctypes

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/_elementtree.pyd
.dll windows:5 windows x86 arch:x86

3ce752a632660df8059f0cd7fa43d1a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\_elementtree.pdb

Imports

kernel32

GetSystemDirectoryA
GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
GetSystemTimeAsFileTime
GetCurrentProcessId
Sleep
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange

python27

PyObject_Free
PyErr_SetString
PyObject_CallMethod
PyErr_NewException
PyArg_ParseTupleAndKeywords
Py_Py3kWarningFlag
PyDict_Keys
PyList_Type
PyTuple_Pack
PyObject_Realloc
_PyString_Resize
PyType_Type
PyErr_Clear
PyList_New
PyObject_Malloc
PySequence_GetSlice
PyRun_StringFlags
PyExc_RuntimeError
PyString_Type
PyErr_Format
PyExc_SyntaxError
PyModule_AddObject
PyExc_TypeError
PyDict_SetItemString
PyExc_IndexError
PyObject_GetAttrString
PyUnicodeUCS2_DecodeUTF8
_PySlice_Unpack
PyDict_Size
PyErr_WarnEx
Py_InitModule4
PyCapsule_Import
PyDict_Items
PyList_Append
PyDict_Type
PyDict_GetItemString
PyErr_Occurred
PyUnicodeUCS2_Decode
PyExc_ValueError
PyObject_Repr
Py_ReprLeave
Py_FindMethod
PyArg_ParseTuple
PyNumber_AsSsize_t
_Py_NoneStruct
PyExc_OverflowError
PyObject_SetAttrString
PySequence_Fast
PyDict_SetItem
PyList_SetItem
PyExc_AttributeError
PyErr_SetObject
PyExc_DeprecationWarning
PySlice_Type
PyDict_Copy
PyObject_CallFunction
PyErr_NoMemory
PyDict_GetItem
PyString_FromStringAndSize
Py_BuildValue
PyEval_GetBuiltins
PyObject_Compare
_PySlice_AdjustIndices
PyDict_Update
PyUnicodeUCS2_FromFormat
PyInt_FromLong
PyObject_CallObject
PyString_FromFormat
PyDict_New
PyTuple_New
_PyObject_New
PySequence_Size
PyExc_PendingDeprecationWarning
PyString_FromString
Py_ReprEnter

msvcr90

memcpy
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
getenv
realloc
fprintf
__iob_func
memmove
strpbrk
malloc
free
sprintf
memset

Exports

Exports

init_elementtree

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/_hashlib.pyd
.dll windows:5 windows x86 arch:x86

c928a6f9856d95e2e4b2503ee43b5ef6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\_hashlib.pdb

Imports

kernel32

FreeLibrary
QueryPerformanceCounter
GetTickCount
LoadLibraryA
CloseHandle
GetCurrentProcessId
GlobalMemoryStatus
Sleep
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVersion
GetCurrentThreadId
GetModuleHandleA
GetFileType
GetLastError
GetProcAddress
GetStdHandle
MultiByteToWideChar
FlushConsoleInputBuffer
WriteFile
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange

user32

MessageBoxA
GetProcessWindowStation
ReleaseDC
GetDC
GetUserObjectInformationW

gdi32

GetDIBits
DeleteObject
CreateCompatibleBitmap
GetObjectA
GetDeviceCaps

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA

python27

PyFrozenSet_New
PyLong_FromLong
PyLong_AsLong
PyErr_SetString
_PyArg_ParseTupleAndKeywords_SizeT
PyObject_Free
PyErr_Occurred
PyExc_ValueError
PyOS_snprintf
PyEval_SaveThread
_Py_NoneStruct
_PyArg_ParseTuple_SizeT
PyType_Type
PyEval_RestoreThread
PyType_Ready
PyThread_allocate_lock
PySet_Add
PyErr_NoMemory
PyThread_acquire_lock
PyString_AsString
PyString_FromStringAndSize
_PyArg_Parse_SizeT
PyBuffer_Release
PyThread_free_lock
_PyObject_New
PyString_FromString
PyErr_Format
PyModule_AddObject
PyExc_TypeError
Py_InitModule4
PyThread_release_lock
PyExc_OverflowError

msvcr90

memcpy
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_getch
signal
fputs
strstr
sprintf
_gmtime64
fprintf
_stricmp
strrchr
strtol
isupper
strerror
strchr
strncpy
qsort
strcmp
sscanf
raise
__iob_func
_exit
wcsstr
_vsnprintf
strtoul
getenv
free
malloc
realloc
isspace
isalnum
isdigit
_localtime64
_time64
atoi
isxdigit
feof
fflush
_wfopen
_errno
fgets
fopen
fread
_fileno
ferror
fwrite
_setmode
ftell
fseek
fclose
memmove
_strnicmp
strncmp
memchr
tolower
memset

Exports

Exports

init_hashlib

Sections

.text
Size: 735KB - Virtual size: 734KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/_helper.pyh
.zip
HTMLParser.pyo
StringIO.pyo
UserDict.pyo
_LWPCookieJar.pyo
_MozillaCookieJar.pyo
__future__.pyo
_abcoll.pyo
_ctypes.pyo
_elementtree.pyo
_hashlib.pyo
_osx_support.pyo
_socket.pyo
_ssl.pyo
_strptime.pyo
_threading_local.pyo
_weakrefset.pyo
abc.pyo
argparse.pyo
atexit.pyo
base64.pyo
bdb.pyo
bisect.pyo
bz2.pyo
calendar.pyo
cgi.pyo
cmd.pyo
code.pyo
codecs.pyo
codeop.pyo
collections.pyo
colorclass/__init__.pyo
colorclass/codes.pyo
colorclass/color.pyo
colorclass/core.pyo
colorclass/parse.pyo
colorclass/search.pyo
colorclass/toggles.pyo
colorclass/windows.pyo
contextlib.pyo
cookielib.pyo
copy.pyo
copy_reg.pyo
cryptography/__about__.pyo
cryptography/__init__.pyo
cryptography/exceptions.pyo
cryptography/hazmat/__init__.pyo
cryptography/hazmat/_der.pyo
cryptography/hazmat/_oid.pyo
cryptography/hazmat/backends/__init__.pyo
cryptography/hazmat/backends/interfaces.pyo
cryptography/hazmat/backends/openssl/__init__.pyo
cryptography/hazmat/backends/openssl/aead.pyo
cryptography/hazmat/backends/openssl/backend.pyo
cryptography/hazmat/backends/openssl/ciphers.pyo
cryptography/hazmat/backends/openssl/cmac.pyo
cryptography/hazmat/backends/openssl/decode_asn1.pyo
cryptography/hazmat/backends/openssl/dh.pyo
cryptography/hazmat/backends/openssl/dsa.pyo
cryptography/hazmat/backends/openssl/ec.pyo
cryptography/hazmat/backends/openssl/ed25519.pyo
cryptography/hazmat/backends/openssl/ed448.pyo
cryptography/hazmat/backends/openssl/encode_asn1.pyo
cryptography/hazmat/backends/openssl/hashes.pyo
cryptography/hazmat/backends/openssl/hmac.pyo
cryptography/hazmat/backends/openssl/ocsp.pyo
cryptography/hazmat/backends/openssl/poly1305.pyo
cryptography/hazmat/backends/openssl/rsa.pyo
cryptography/hazmat/backends/openssl/utils.pyo
cryptography/hazmat/backends/openssl/x25519.pyo
cryptography/hazmat/backends/openssl/x448.pyo
cryptography/hazmat/backends/openssl/x509.pyo
cryptography/hazmat/bindings/__init__.pyo
cryptography/hazmat/bindings/_constant_time.pyo
cryptography/hazmat/bindings/_openssl.pyo
cryptography/hazmat/bindings/openssl/__init__.pyo
cryptography/hazmat/bindings/openssl/_conditional.pyo
cryptography/hazmat/bindings/openssl/binding.pyo
cryptography/hazmat/primitives/__init__.pyo
cryptography/hazmat/primitives/asymmetric/__init__.pyo
cryptography/hazmat/primitives/asymmetric/dh.pyo
cryptography/hazmat/primitives/asymmetric/dsa.pyo
cryptography/hazmat/primitives/asymmetric/ec.pyo
cryptography/hazmat/primitives/asymmetric/ed25519.pyo
cryptography/hazmat/primitives/asymmetric/ed448.pyo
cryptography/hazmat/primitives/asymmetric/padding.pyo
cryptography/hazmat/primitives/asymmetric/rsa.pyo
cryptography/hazmat/primitives/asymmetric/utils.pyo
cryptography/hazmat/primitives/asymmetric/x25519.pyo
cryptography/hazmat/primitives/asymmetric/x448.pyo
cryptography/hazmat/primitives/ciphers/__init__.pyo
cryptography/hazmat/primitives/ciphers/aead.pyo
cryptography/hazmat/primitives/ciphers/algorithms.pyo
cryptography/hazmat/primitives/ciphers/base.pyo
cryptography/hazmat/primitives/ciphers/modes.pyo
cryptography/hazmat/primitives/constant_time.pyo
cryptography/hazmat/primitives/hashes.pyo
cryptography/hazmat/primitives/kdf/__init__.pyo
cryptography/hazmat/primitives/kdf/scrypt.pyo
cryptography/hazmat/primitives/serialization/__init__.pyo
cryptography/hazmat/primitives/serialization/base.pyo
cryptography/hazmat/primitives/serialization/ssh.pyo
cryptography/utils.pyo
cryptography/x509/__init__.pyo
cryptography/x509/base.pyo
cryptography/x509/certificate_transparency.pyo
cryptography/x509/extensions.pyo
cryptography/x509/general_name.pyo
cryptography/x509/name.pyo
cryptography/x509/ocsp.pyo
cryptography/x509/oid.pyo
csv.pyo
ctypes/__init__.pyo
ctypes/_endian.pyo
ctypes/macholib/__init__.pyo
ctypes/macholib/dyld.pyo
ctypes/macholib/dylib.pyo
ctypes/macholib/framework.pyo
ctypes/util.pyo
ctypes/wintypes.pyo
dateutil/__init__.pyo
dateutil/_common.pyo
dateutil/_version.pyo
dateutil/easter.pyo
dateutil/parser.pyo
dateutil/relativedelta.pyo
dateutil/rrule.pyo
dateutil/tz/__init__.pyo
dateutil/tz/_common.pyo
dateutil/tz/tz.pyo
dateutil/tz/win.pyo
dateutil/zoneinfo/__init__.pyo
decimal.pyo
difflib.pyo
dis.pyo
distutils/__init__.pyo
distutils/debug.pyo
distutils/errors.pyo
distutils/log.pyo
distutils/spawn.pyo
distutils/sysconfig.pyo
distutils/text_file.pyo
doctest.pyo
dummy_thread.pyo
dummy_threading.pyo
email/__init__.pyo
email/_parseaddr.pyo
email/base64mime.pyo
email/charset.pyo
email/encoders.pyo
email/errors.pyo
email/feedparser.pyo
email/generator.pyo
email/header.pyo
email/iterators.pyo
email/message.pyo
email/mime/__init__.pyo
email/parser.pyo
email/quoprimime.pyo
email/utils.pyo
encodings/__init__.pyo
encodings/aliases.pyo
encodings/ascii.pyo
encodings/base64_codec.pyo
encodings/big5.pyo
encodings/big5hkscs.pyo
encodings/bz2_codec.pyo
encodings/charmap.pyo
encodings/cp037.pyo
encodings/cp1006.pyo
encodings/cp1026.pyo
encodings/cp1140.pyo
encodings/cp1250.pyo
encodings/cp1251.pyo
encodings/cp1252.pyo
encodings/cp1253.pyo
encodings/cp1254.pyo
encodings/cp1255.pyo
encodings/cp1256.pyo
encodings/cp1257.pyo
encodings/cp1258.pyo
encodings/cp424.pyo
encodings/cp437.pyo
encodings/cp500.pyo
encodings/cp720.pyo
encodings/cp737.pyo
encodings/cp775.pyo
encodings/cp850.pyo
encodings/cp852.pyo
encodings/cp855.pyo
encodings/cp856.pyo
encodings/cp857.pyo
encodings/cp858.pyo
encodings/cp860.pyo
encodings/cp861.pyo
encodings/cp862.pyo
encodings/cp863.pyo
encodings/cp864.pyo
encodings/cp865.pyo
encodings/cp866.pyo
encodings/cp869.pyo
encodings/cp874.pyo
encodings/cp875.pyo
encodings/cp932.pyo
encodings/cp949.pyo
encodings/cp950.pyo
encodings/euc_jis_2004.pyo
encodings/euc_jisx0213.pyo
encodings/euc_jp.pyo
encodings/euc_kr.pyo
encodings/gb18030.pyo
encodings/gb2312.pyo
encodings/gbk.pyo
encodings/hex_codec.pyo
encodings/hp_roman8.pyo
encodings/hz.pyo
encodings/idna.pyo
encodings/iso2022_jp.pyo
encodings/iso2022_jp_1.pyo
encodings/iso2022_jp_2.pyo
encodings/iso2022_jp_2004.pyo
encodings/iso2022_jp_3.pyo
encodings/iso2022_jp_ext.pyo
encodings/iso2022_kr.pyo
encodings/iso8859_1.pyo
encodings/iso8859_10.pyo
encodings/iso8859_11.pyo
encodings/iso8859_13.pyo
encodings/iso8859_14.pyo
encodings/iso8859_15.pyo
encodings/iso8859_16.pyo
encodings/iso8859_2.pyo
encodings/iso8859_3.pyo
encodings/iso8859_4.pyo
encodings/iso8859_5.pyo
encodings/iso8859_6.pyo
encodings/iso8859_7.pyo
encodings/iso8859_8.pyo
encodings/iso8859_9.pyo
encodings/johab.pyo
encodings/koi8_r.pyo
encodings/koi8_u.pyo
encodings/latin_1.pyo
encodings/mac_arabic.pyo
encodings/mac_centeuro.pyo
encodings/mac_croatian.pyo
encodings/mac_cyrillic.pyo
encodings/mac_farsi.pyo
encodings/mac_greek.pyo
encodings/mac_iceland.pyo
encodings/mac_latin2.pyo
encodings/mac_roman.pyo
encodings/mac_romanian.pyo
encodings/mac_turkish.pyo
encodings/mbcs.pyo
encodings/palmos.pyo
encodings/ptcp154.pyo
encodings/punycode.pyo
encodings/quopri_codec.pyo
encodings/raw_unicode_escape.pyo
encodings/rot_13.pyo
encodings/shift_jis.pyo
encodings/shift_jis_2004.pyo
encodings/shift_jisx0213.pyo
encodings/string_escape.pyo
encodings/tis_620.pyo
encodings/undefined.pyo
encodings/unicode_escape.pyo
encodings/unicode_internal.pyo
encodings/utf_16.pyo
encodings/utf_16_be.pyo
encodings/utf_16_le.pyo
encodings/utf_32.pyo
encodings/utf_32_be.pyo
encodings/utf_32_le.pyo
encodings/utf_7.pyo
encodings/utf_8.pyo
encodings/utf_8_sig.pyo
encodings/uu_codec.pyo
encodings/zlib_codec.pyo
enum/__init__.pyo
fnmatch.pyo
fractions.pyo
ftplib.pyo
functools.pyo
genericpath.pyo
getopt.pyo
getpass.pyo
gettext.pyo
glob.pyo
gzip.pyo
hashlib.pyo
heapq.pyo
hmac.pyo
htmlentitydefs.pyo
httplib.pyo
inspect.pyo
io.pyo
ipaddress.pyo
json/__init__.pyo
json/decoder.pyo
json/encoder.pyo
json/scanner.pyo
keyword.pyo
linecache.pyo
locale.pyo
logging/__init__.pyo
lxml/__init__.pyo
lxml/_elementpath.pyo
lxml/etree.pyo
markupbase.pyo
mimetools.pyo
mimetypes.pyo
msoffcrypto/__init__.pyo
msoffcrypto/format/__init__.pyo
msoffcrypto/format/base.pyo
msoffcrypto/format/common.pyo
msoffcrypto/format/doc97.pyo
msoffcrypto/format/ooxml.pyo
msoffcrypto/format/ppt97.pyo
msoffcrypto/format/xls97.pyo
msoffcrypto/method/__init__.pyo
msoffcrypto/method/ecma376_agile.pyo
msoffcrypto/method/ecma376_standard.pyo
msoffcrypto/method/rc4.pyo
msoffcrypto/method/rc4_cryptoapi.pyo
ntpath.pyo
nturl2path.pyo
numbers.pyo
olefile/__init__.pyo
olefile/olefile.pyo
oletools/__init__.pyo
oletools/common/__init__.pyo
oletools/common/clsid.pyo
oletools/common/codepages.pyo
oletools/common/errors.pyo
oletools/common/io_encoding.pyo
oletools/common/log_helper/__init__.pyo
oletools/common/log_helper/_json_formatter.pyo
oletools/common/log_helper/_logger_adapter.pyo
oletools/common/log_helper/_root_logger_wrapper.pyo
oletools/common/log_helper/log_helper.pyo
oletools/crypto.pyo
oletools/oleform.pyo
oletools/oleid.pyo
oletools/oleobj.pyo
oletools/olevba.pyo
.vbs
oletools/ooxml.pyo
oletools/ppt_parser.pyo
oletools/ppt_record_parser.pyo
oletools/record_base.pyo
oletools/rtfobj.pyo
oletools/thirdparty/__init__.pyo
oletools/thirdparty/oledump/__init__.pyo
oletools/thirdparty/oledump/plugin_biff.pyo
oletools/thirdparty/prettytable/__init__.pyo
oletools/thirdparty/prettytable/prettytable.pyo
oletools/thirdparty/tablestream/__init__.pyo
oletools/thirdparty/tablestream/tablestream.pyo
oletools/thirdparty/xglob/__init__.pyo
oletools/thirdparty/xglob/xglob.pyo
opcode.pyo
optparse.pyo
os.pyo
os2emxpath.pyo
pcodedmp/__init__.pyo
pcodedmp/pcodedmp.pyo
pdb.pyo
pickle.pyo
pkgutil.pyo
platform.pyo
plistlib.pyo
posixpath.pyo
pprint.pyo
py_compile.pyo
pyexpat.pyo
pyparsing.pyo
quopri.pyo
random.pyo
re.pyo
repr.pyo
rfc822.pyo
select.pyo
shlex.pyo
shutil.pyo
six.pyo
socket.pyo
sre.pyo
sre_compile.pyo
sre_constants.pyo
sre_parse.pyo
ssl.pyo
stat.pyo
string.pyo
stringprep.pyo
struct.pyo
subprocess.pyo
tarfile.pyo
tempfile.pyo
textwrap.pyo
threading.pyo
token.pyo
tokenize.pyo
traceback.pyo
types.pyo
unicodedata.pyo
unittest/__init__.pyo
unittest/case.pyo
unittest/loader.pyo
unittest/main.pyo
unittest/result.pyo
unittest/runner.pyo
unittest/signals.pyo
unittest/suite.pyo
unittest/util.pyo
urllib.pyo
urllib2.pyo
urlparse.pyo
uu.pyo
uuid.pyo
warnings.pyo
weakref.pyo
win_unicode_console/__init__.pyo
win_unicode_console/buffer.pyo
win_unicode_console/console.pyo
win_unicode_console/file_object.pyo
win_unicode_console/info.pyo
win_unicode_console/raw_input.pyo
win_unicode_console/readline_hook.pyo
win_unicode_console/streams.pyo
win_unicode_console/unicode_argv.pyo
xml/__init__.pyo
xml/dom/NodeFilter.pyo
xml/dom/__init__.pyo
xml/dom/domreg.pyo
xml/dom/expatbuilder.pyo
xml/dom/minicompat.pyo
xml/dom/minidom.pyo
xml/dom/pulldom.pyo
xml/dom/xmlbuilder.pyo
xml/etree/__init__.pyo
xml/etree/cElementTree.pyo
xml/parsers/__init__.pyo
xml/parsers/expat.pyo
xml/sax/__init__.pyo
xml/sax/_exceptions.pyo
xml/sax/expatreader.pyo
xml/sax/handler.pyo
xml/sax/saxutils.pyo
xml/sax/xmlreader.pyo
zipfile.pyo
lib/_socket.pyd
.dll .js windows:5 windows x86 arch:x86 polyglot

6659405c0b2ea760afe83f87de95373a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\_socket.pdb

Imports

ws2_32

getpeername
ioctlsocket
WSAIoctl
gethostname
connect
inet_ntoa
WSAStartup
recvfrom
ntohl
inet_addr
htonl
select
WSAGetLastError
htons
ntohs
getsockname
shutdown
getprotobyname
setsockopt
getservbyport
sendto
WSACleanup
accept
recv
bind
socket
getservbyname
__WSAFDIsSet
WSASetLastError
closesocket
gethostbyaddr
gethostbyname
send
getsockopt
listen

kernel32

GetCurrentProcessId
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

python27

PyFloat_AsDouble
PyList_New
PyType_GenericNew
Py_AtExit
PyErr_SetExcFromWindowsErr
PyErr_Format
PyModule_AddObject
PyExc_TypeError
Py_InitModule4
PyExc_ImportError
PyThread_release_lock
PyList_Append
PyErr_Clear
PyType_Type
_PyString_Resize
PyTuple_Pack
PyArg_ParseTupleAndKeywords
PyLong_AsLong
PyLong_AsUnsignedLong
PyErr_NewException
_Py_TrueStruct
PyType_GenericAlloc
PyErr_SetString
PyModule_AddIntConstant
PyObject_Free
PyExc_ValueError
PyOS_snprintf
PyTuple_Size
PyArg_ParseTuple
PyEval_SaveThread
PyMem_Free
_Py_NoneStruct
PyExc_OverflowError
PyEval_RestoreThread
PyErr_SetObject
PyCapsule_New
PyThread_allocate_lock
_PyInt_AsInt
_PyTime_FloatTime
PyLong_FromUnsignedLong
PyUnicodeUCS2_AsEncodedString
PyThread_acquire_lock
PyErr_SetFromErrno
PyString_AsString
PyObject_GenericGetAttr
PyInt_AsLong
PyObject_ClearWeakRefs
PyString_FromStringAndSize
Py_BuildValue
PyBuffer_Release
PyInt_FromLong
PyExc_IOError
PyFloat_FromDouble
PyInt_FromSsize_t
PyErr_CheckSignals
PyString_FromString
PyErr_Occurred

msvcr90

_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_amsg_exit
__dllonexit
_lock
_onexit
_except_handler4_common
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
strncpy_s
strcat_s
strtoul
strcpy_s
strncpy
_errno
memset
strchr
memcpy
strerror
calloc
free
sscanf
_unlock
sprintf_s

Exports

Exports

init_socket
init_sockobject

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/_ssl.pyd
.dll windows:5 windows x86 arch:x86

9ecb8d5fd8cb4e8a8191c96efee38dca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\_ssl.pdb

Imports

ws2_32

shutdown
recv
WSASetLastError
closesocket
send
select
WSAGetLastError

crypt32

CertGetEnhancedKeyUsage
CertEnumCRLsInStore
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCRLContext
CertOpenStore

kernel32

GetVersion
GlobalMemoryStatus
FreeLibrary
QueryPerformanceCounter
GetTickCount
MultiByteToWideChar
GetLastError
GetCurrentProcessId
FlushConsoleInputBuffer
GetCurrentThreadId
SystemTimeToFileTime
GetSystemTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
Sleep
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
GetFileType
GetProcAddress
GetStdHandle
SetLastError
WriteFile
CloseHandle
InterlockedCompareExchange
LoadLibraryA
InterlockedExchange
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
WideCharToMultiByte
FindFirstFileA
FindClose
FindNextFileA

user32

GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
ReleaseDC
GetDC

gdi32

GetDIBits
DeleteObject
CreateCompatibleBitmap
GetObjectA
GetDeviceCaps

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA

python27

PyList_Append
PyThread_release_lock
PySet_New
PyCapsule_Import
Py_InitModule4
PyErr_WarnEx
PyUnicodeUCS2_DecodeUTF8
PyDict_SetItemString
PyExc_TypeError
PyModule_AddObject
PyErr_Format
PyGILState_Ensure
PyMem_Malloc
PyList_New
PyObject_IsTrue
PyList_AsTuple
PyErr_Clear
_PyString_Resize
PyErr_SetFromErrnoWithFilenameObject
PyLong_FromLong
_Py_BuildValue_SizeT
_Py_TrueStruct
PyExc_RuntimeWarning
PyType_IsSubtype
PyErr_SetString
_PyArg_ParseTupleAndKeywords_SizeT
PyBool_FromLong
PyModule_AddIntConstant
PyObject_Free
_PyByteArray_empty_string
PyThread_get_thread_ident
PyErr_Occurred
PyExc_ValueError
PyObject_Repr
PyUnicodeUCS2_AsASCIIString
PyModule_GetDict
PyUnicodeUCS2_FromObject
PyExc_MemoryError
PyUnicodeUCS2_FromStringAndSize
PyEval_SaveThread
PyErr_WriteUnraisable
PyExc_OSError
PyMem_Free
_Py_NoneStruct
_PyArg_ParseTuple_SizeT
PyObject_CallFunctionObjArgs
PyExc_OverflowError
PyObject_SetAttrString
PyWeakref_NewRef
PyDict_SetItem
PyEval_RestoreThread
_Py_ZeroStruct
PyErr_SetObject
PyByteArray_Type
PyType_Ready
PyString_InternFromString
PyObject_GetBuffer
PyThread_allocate_lock
PySet_Add
PyErr_NoMemory
PyWeakref_GetObject
PyLong_FromUnsignedLong
Py_FileSystemDefaultEncoding
PyUnicodeUCS2_AsEncodedString
PyThread_acquire_lock
PyErr_SetFromErrno
PyString_AsString
PyList_Size
PyBuffer_IsContiguous
PyGILState_Release
PyUnicodeUCS2_FromString
PyDict_GetItem
PyString_FromStringAndSize
_PyArg_Parse_SizeT
PyBuffer_Release
PyUnicodeUCS2_FromFormat
PyInt_FromLong
PyObject_CallObject
PyErr_NewExceptionWithDoc
PyErr_SetFromWindowsErr
PyUnicodeUCS2_FromEncodedObject
PyDict_New
PyExc_IOError
PyTuple_New
PyObject_Str
PyThread_free_lock
PyCallable_Check
_PyObject_New
PyErr_CheckSignals
PyString_FromString
PyLong_AsLong

msvcr90

_wfopen
_stat64i32
calloc
fflush
feof
qsort
strncpy
strerror
memset
fwrite
isdigit
isspace
free
strchr
_errno
isalnum
memcpy
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
abort
strstr
sprintf
_getch
signal
fputs
atoi
_gmtime64
strtol
strrchr
isupper
tolower
_stricmp
_localtime64
_time64
isxdigit
strcmp
_strnicmp
fprintf
getenv
strtoul
_vsnprintf
wcsstr
_exit
__iob_func
raise
sscanf
realloc
malloc
strncmp
fgets
memmove
memchr
fclose
fseek
ftell
_setmode
ferror
_fileno
fread
fopen
printf

Exports

Exports

init_ssl

Sections

.text
Size: 1014KB - Virtual size: 1014KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/bz2.pyd
.dll windows:5 windows x86 arch:x86

d7b0db7c710c505d9f7ce8edfb3da5d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\bz2.pdb

Imports

python27

PyThread_release_lock
Py_InitModule4
PyObject_GetAttrString
PyFile_AsFile
PyExc_TypeError
PyModule_AddObject
PyErr_Format
PyMem_Malloc
PyExc_RuntimeError
PyType_GenericNew
PyList_New
_PyString_Resize
PyLong_AsLongLong
PyObject_AsCharBuffer
PyFile_DecUseCount
PyFile_Type
PyArg_ParseTupleAndKeywords
PyType_GenericAlloc
PyObject_CallMethod
PyErr_SetString
PyObject_Free
PyObject_GetIter
PyExc_EOFError
PyErr_Occurred
PyExc_ValueError
PyExc_MemoryError
PyArg_ParseTuple
PyEval_SaveThread
PyMem_Free
_Py_NoneStruct
PyFile_IncUseCount
PyExc_OverflowError
PyLong_FromLongLong
PyIter_Next
PyList_SetItem
PyEval_RestoreThread
PyList_GetSlice
PyObject_CallFunction
PyType_Ready
PyThread_allocate_lock
PyErr_NoMemory
PyThread_acquire_lock
PyObject_GenericSetAttr
PyObject_GenericGetAttr
PyInt_AsLong
PyString_FromStringAndSize
Py_BuildValue
PyBuffer_Release
PyExc_SystemError
PyInt_FromLong
PyString_Concat
PyExc_IOError
PyThread_free_lock
PyList_Append
PyString_FromString

msvcr90

_fdopen
_setmode
memcpy
_fileno
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
exit
fclose
fwrite
ferror
isdigit
fread
fopen
fgetc
fflush
ungetc
malloc
free
fprintf
__iob_func
memchr
memmove
memset

kernel32

QueryPerformanceCounter
Sleep
InterlockedCompareExchange
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess

Exports

Exports

initbz2

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/helperoneo.pyd
.dll windows:6 windows x86 arch:x86

b55acf775662bfc4ea135723c0940af0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

35:a7:9c:3f:76:d3:3a:68:1a:09:4a:16:f4:f8:9f:c4:63:aa:ea:1c:8a:05:6e:86:53:aa:4e:5f:66:4b:57:b5
Signer

Actual PE Digest

35:a7:9c:3f:76:d3:3a:68:1a:09:4a:16:f4:f8:9f:c4:63:aa:ea:1c:8a:05:6e:86:53:aa:4e:5f:66:4b:57:b5

Digest Algorithm

sha256

PE Digest Matches

true

10:2a:13:0c:5c:d7:ce:bb:de:cc:79:28:5f:77:c8:2f:24:70:ae:5f
Signer

Actual PE Digest

10:2a:13:0c:5c:d7:ce:bb:de:cc:79:28:5f:77:c8:2f:24:70:ae:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

python27

PyEval_EvalFrameEx
PyImport_AddModule
PyImport_ImportModule
PyImport_ReloadModule
PyObject_Call
PyObject_CallObject
_PyObject_CallFunction_SizeT
PyObject_CallFunctionObjArgs
PyObject_GetItem
PyObject_SetItem
PyObject_GetIter
PyNumber_Add
PyNumber_Multiply
PyNumber_Divide
PyNumber_Negative
PyNumber_Xor
PyNumber_Index
PyNumber_InPlaceAdd
PySequence_GetItem
PySequence_Contains
PyObject_IsSubclass
PyCode_New
PyEval_EvalCodeEx
PyFrame_New
PyBaseObject_Type
_Py_NoneStruct
PyInt_Type
_Py_CheckRecursiveCall
_Py_TrueStruct
PyLong_Type
PyFloat_Type
PyString_Type
PyTuple_Type
PyList_Type
PyDict_Type
PyCFunction_Type
PyFunction_Type
PyClass_Type
PyMethod_Type
PyTraceBack_Type
PyExc_BaseException
PyExc_StopIteration
PyExc_GeneratorExit
PyExc_AttributeError
PyExc_ImportError
PyExc_NameError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_SystemError
PyExc_TypeError
PyExc_ValueError
PyExc_RuntimeWarning
_PyThreadState_Current
_Py_CheckRecursionLimit
Py_GetVersion
PyRun_StringFlags
Py_InitModule4
PyArg_UnpackTuple
PyOS_snprintf
PyErr_WriteUnraisable
PyErr_Format
PyErr_NormalizeException
PyErr_ExceptionMatches
PyErr_GivenExceptionMatches
PyErr_Restore
PyErr_Fetch
PyErr_Clear
PyErr_Occurred
PyErr_SetString
PyErr_SetNone
PyErr_WarnEx
PySlice_New
PyTraceBack_Here
PyMethod_New
PyModule_GetDict
PyDict_SetItemString
PyDict_Size
PyDict_Values
PyDict_Keys
PyDict_Next
PyDict_SetItem
PyDict_GetItem
PyDict_New
_PyList_Extend
PyList_Append
PyList_New
PyTuple_Pack
PyTuple_GetSlice
PyTuple_GetItem
PyTuple_New
_PyString_Join
PyString_InternFromString
PyString_Format
_PyString_Eq
PyString_AsString
PyString_FromFormat
PyString_FromString
PyString_FromStringAndSize
PyFloat_FromDouble
PyLong_FromLongLong
PyLong_AsSsize_t
PyLong_FromLong
PyInt_AsSsize_t
PyInt_FromSsize_t
PyInt_FromLong
PyUnicodeUCS2_Compare
PyUnicodeUCS2_DecodeUTF8
PyUnicodeUCS2_FromStringAndSize
PyObject_GC_Del
PyObject_GC_UnTrack
PyObject_GC_Track
_PyObject_GC_New
PyObject_Free
PyObject_ClearWeakRefs
PyObject_Not
PyObject_IsTrue
PyObject_Hash
PyObject_GenericGetAttr
PyObject_SelfIter
_PyObject_GetDictPtr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompare
PyType_Ready
PyType_IsSubtype
PyMem_Realloc
_Py_ZeroStruct
PyMem_Malloc

kernel32

CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryExW
GetModuleFileNameW
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
GetModuleHandleExW
ExitProcess
DecodePointer
SetLastError
GetLastError
EncodePointer
GetCurrentThreadId
GetCommandLineA
CreateFileW

Exports

Exports

inithelperoneo

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/helpertwoo.pyd
.dll windows:6 windows x86 arch:x86

a4cb95ca684901b604979e7a3554d688

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:84:4c:f9:2c:ca:29:dc:85:ce:4d:79:78:2b:f2:2f:e0:44:f3:32:bf:58:91:7f:4a:2f:0d:11:19:cd:24:96
Signer

Actual PE Digest

fc:84:4c:f9:2c:ca:29:dc:85:ce:4d:79:78:2b:f2:2f:e0:44:f3:32:bf:58:91:7f:4a:2f:0d:11:19:cd:24:96

Digest Algorithm

sha256

PE Digest Matches

true

6f:2d:dc:86:df:d9:5b:03:ff:cd:29:8a:bf:19:f3:48:ee:a2:a6:7c
Signer

Actual PE Digest

6f:2d:dc:86:df:d9:5b:03:ff:cd:29:8a:bf:19:f3:48:ee:a2:a6:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

python27

PyEval_EvalFrameEx
PyImport_AddModule
PyImport_ImportModule
PyImport_ReloadModule
PyObject_Call
PyObject_CallObject
_PyObject_CallFunction_SizeT
PyObject_CallFunctionObjArgs
PyObject_GetItem
PyObject_GetIter
PyNumber_Add
PyNumber_Subtract
PyNumber_Multiply
PyNumber_Divide
PyNumber_Negative
PyNumber_Xor
PyNumber_Index
PyNumber_InPlaceAdd
PyNumber_InPlaceSubtract
PyNumber_InPlaceDivide
PySequence_GetItem
PyObject_IsSubclass
PyCode_New
PyEval_EvalCodeEx
PyFrame_New
PyBaseObject_Type
_Py_NoneStruct
PyInt_Type
_Py_CheckRecursiveCall
_Py_TrueStruct
PyLong_Type
PyFloat_Type
PyString_Type
PyTuple_Type
PyList_Type
PySet_Type
PyCFunction_Type
PyFunction_Type
PyClass_Type
PyMethod_Type
PyTraceBack_Type
PyExc_BaseException
PyExc_Exception
PyExc_StopIteration
PyExc_GeneratorExit
PyExc_AttributeError
PyExc_ImportError
PyExc_NameError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_SystemError
PyExc_TypeError
PyExc_ValueError
PyExc_RuntimeWarning
_PyThreadState_Current
_Py_CheckRecursionLimit
Py_GetVersion
PyRun_StringFlags
Py_InitModule4
PyArg_UnpackTuple
PyOS_snprintf
PyErr_WriteUnraisable
PyErr_Format
PyErr_NormalizeException
PyErr_ExceptionMatches
PyErr_GivenExceptionMatches
PyErr_Restore
PyErr_Fetch
PyErr_Clear
PyErr_Occurred
PyErr_SetString
PyErr_SetNone
PyErr_WarnEx
PySlice_New
PyTraceBack_Here
PyMethod_New
PyModule_GetDict
PyDict_SetItemString
_PyDict_NewPresized
PyDict_Size
PyDict_Next
PyDict_SetItem
PyDict_GetItem
PyDict_New
_PyList_Extend
PyList_Append
PyList_New
PyTuple_Pack
PyTuple_GetSlice
PyTuple_GetItem
PyTuple_New
_PyString_Join
PyString_InternFromString
PyString_Format
_PyString_Eq
PyString_AsString
PyString_FromFormat
PyString_FromString
PyString_FromStringAndSize
PyFloat_FromDouble
PyLong_FromLongLong
PyLong_AsDouble
PyLong_AsSsize_t
PyLong_FromLong
PyInt_AsSsize_t
PyInt_FromSsize_t
PyInt_FromLong
PyUnicodeUCS2_Compare
PyUnicodeUCS2_DecodeUTF8
PyUnicodeUCS2_FromStringAndSize
PyObject_GC_Del
PyObject_GC_UnTrack
PyObject_GC_Track
_PyObject_GC_New
PyObject_Free
PyObject_ClearWeakRefs
PyObject_Not
PyObject_IsTrue
PyObject_Hash
PyObject_GenericGetAttr
PyObject_SelfIter
_PyObject_GetDictPtr
PyObject_SetAttr
PyObject_GetAttr
PyObject_SetAttrString
PyObject_GetAttrString
PyObject_RichCompare
PyType_Ready
PyType_IsSubtype
PyMem_Realloc
_Py_ZeroStruct
PyMem_Malloc

kernel32

CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryExW
GetModuleFileNameW
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
GetModuleHandleExW
ExitProcess
DecodePointer
SetLastError
GetLastError
EncodePointer
GetCurrentThreadId
GetCommandLineA
CreateFileW

Exports

Exports

inithelpertwoo

Sections

.text
Size: 576KB - Virtual size: 575KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/lxml.etree.pyd
.dll windows:5 windows x86 arch:x86

f58d29cd824eb5b04065a1739168b995

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ioctlsocket
inet_ntoa
inet_addr
htonl
WSAGetLastError
ntohs
getservbyport
getservbyname
__WSAFDIsSet
WSASetLastError
gethostbyaddr
getsockopt
connect
WSAStartup
select
htons
getsockname
recv
bind
socket
closesocket
gethostbyname
send
listen

python27

PyNumber_Index
PyLong_AsSsize_t
PyInt_FromSize_t
PyExc_AssertionError
Py_OptimizeFlag
PyErr_NoMemory
PyUnicodeUCS2_Format
PyList_Sort
PySequence_List
PyObject_IsInstance
PyObject_Size
_PyEval_SliceIndex
PyString_Format
PyUnicodeUCS2_AsUTF8String
PyUnicodeUCS2_DecodeLatin1
PyUnicodeUCS2_FromFormat
PyUnicodeUCS2_DecodeASCII
PyUnicodeUCS2_Join
PyObject_Repr
PyInt_AsSsize_t
PyThreadState_GetDict
PyList_AsTuple
PySlice_Type
PyObject_Hash
PyObject_IsSubclass
PyDict_DelItem
PyDict_Clear
PyCallable_Check
PySet_New
PyUnicodeUCS2_AsEncodedString
PyThread_allocate_lock
PyObject_HasAttr
PyDict_Copy
PySequence_Check
PySet_Add
PyObject_Dir
PyNumber_Or
PyThread_acquire_lock
PyUnicodeUCS2_Split
PyObject_DelItem
PyErr_Restore
PyErr_Fetch
PyExc_NotImplementedError
PyUnicodeUCS2_FromObject
PyLong_AsLong
PyLong_AsUnsignedLong
PySlice_GetIndicesEx
_PyString_Join
PyList_Reverse
PyFile_AsFile
PyNumber_Multiply
PyErr_SetFromErrno
PyExc_Exception
PySet_Clear
PySet_Type
PyUnicodeUCS2_AsASCIIString
PyUnicodeUCS2_Concat
PyFloat_AsDouble
PyNumber_Check
PyBool_Type
PyType_Modified
PyWrapperDescr_Type
Py_InitModule4
PyUnicodeUCS2_FromStringAndSize
PyNumber_Int
PyNumber_Long
PyObject_IsTrue
PyByteArray_Type
PyString_AsStringAndSize
_PyByteArray_empty_string
PyUnicodeUCS2_DecodeUTF8
PyString_FromStringAndSize
PyModule_AddObject
PyOS_snprintf
Py_GetVersion
PyObject_GenericGetAttr
PyObject_SelfIter
PyImport_ImportModule
PyArg_UnpackTuple
PyExc_GeneratorExit
_PyObject_CallFunction_SizeT
PySequence_GetItem
PyFile_SoftSpace
PyFile_WriteString
PyFile_WriteObject
PyString_Size
PySys_GetObject
PyTraceBack_Here
PyMem_Malloc
PyMem_Realloc
PyCFunction_NewEx
PyList_Insert
PyObject_CallObject
PyImport_Import
PyClassMethod_New
PyDescr_NewClassMethod
PyDict_SetItemString
PyRun_StringFlags
PyExc_RuntimeWarning
PyErr_WarnEx
PyExc_KeyError
PyTuple_GetSlice
PyTuple_GetItem
PyString_FromFormat
PyMethod_New
PyObject_ClearWeakRefs
PyObject_GC_Del
PyObject_Free
_PyObject_GC_New
PyString_InternFromString
PyImport_AddModule
PyObject_GetAttrString
PyType_Ready
PyObject_SetAttrString
PyClass_Type
PyCapsule_New
PyObject_CallMethodObjArgs
PyDict_Values
PyNumber_InPlaceSubtract
PyNumber_Subtract
PyExc_RuntimeError
PyIter_Next
PyDict_Type
PyObject_GetIter
_PyObject_NextNotImplemented
PyErr_SetNone
PyExc_ImportError
PyObject_RichCompare
PyExc_UnboundLocalError
PyModule_GetDict
PyDict_New
PyObject_CallFunctionObjArgs
PyList_New
PyMethod_Type
PyTuple_Type
PyObject_GetItem
PyBaseString_Type
PyDict_GetItem
PyList_Type
PyErr_ExceptionMatches
PyErr_Clear
PyObject_SetItem
PyExc_OverflowError
PyUnicodeUCS2_FromUnicode
PyUnicodeUCS2_Decode
PyInt_Type
PyLong_Type
PyInt_FromLong
PyLong_FromLong
PyLong_FromLongLong
PyFloat_Type
PyFloat_FromDouble
PyNumber_InPlaceAdd
PyNumber_Add
PyErr_PrintEx
PyString_FromString
PyErr_WriteUnraisable
PyExc_StopIteration
PyErr_GivenExceptionMatches
PyDict_Items
PyFunction_Type
PyCFunction_Type
PyObject_Call
PyExc_SystemError
PyDict_Size
_Py_CheckRecursionLimit
_Py_CheckRecursiveCall
PyTuple_New
PyEval_EvalCodeEx
PyFrame_New
PyEval_EvalFrameEx
PyTraceBack_Type
PyErr_NormalizeException
_PyThreadState_Current
PyExc_BaseException
PyType_IsSubtype
PyDict_Next
PyString_Type
PyUnicodeUCS2_Compare
_PyString_Eq
PyDict_SetItem
PyString_AsString
PyExc_NameError
PyTuple_Pack
PySlice_New
PyCode_New
PyUnicode_Type
PyInt_FromSsize_t
PyObject_GC_Track
PyBaseObject_Type
PyObject_GC_UnTrack
PyEval_SaveThread
PyEval_RestoreThread
_Py_TrueStruct
PyThread_release_lock
PyGILState_Ensure
PyGILState_Release
PyThread_free_lock
PyMem_Free
_Py_NoneStruct
_Py_ZeroStruct
PyInstance_Type
_PyType_Lookup
PyExc_AttributeError
PyErr_SetObject
PyDict_Contains
PySequence_Contains
PyList_Append
PyObject_SetAttr
PyObject_GetAttr
PyCapsule_IsValid
PyExc_TypeError
PyErr_SetString
PyCapsule_GetPointer
PyExc_ValueError
PyErr_Format
PyCapsule_GetContext
PyErr_Occurred
PyCapsule_SetDestructor
PyCapsule_SetName
PySequence_Tuple

msvcr90

_read
_close
_dup
_write
_getcwd
_open
_CIpow
floor
_CIexp
_CIatan2
_CIatan
_CIacos
_CIasin
_CItan
_CIcos
_CIsin
_CIlog
_CIsqrt
_CIlog10
_errno
fwrite
_snprintf
memmove
_time64
_localtime64
_gmtime64
rand
sscanf
_vscprintf
vfprintf
_CIfmod
fprintf
_vsnprintf_s
__iob_func
_stat64i32
_mkdir
fopen
fclose
strncmp
malloc
sprintf
free
memcpy
strchr
memset
_fileno
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_vsnprintf
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
wcstombs
_lseeki64
strerror
_strnicmp
atoi
_stricmp
strncpy_s
strcat_s
strtoul
strcpy_s
strtol
calloc
sprintf_s
printf
fputc
_beginthread
_endthread
getenv
exit
realloc
_isnan
_fpclass
ferror
strncpy
_wstat64i32
_wfopen
fflush
strstr
_wopen
memchr
toupper
fread

advapi32

CryptGetHashParam
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData

kernel32

GetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
MultiByteToWideChar
EnumSystemLocalesA
FormatMessageA
GetLastError
LocalFree
GetVersionExA
TlsGetValue
InterlockedIncrement
GetCurrentProcess
WaitForSingleObject
InterlockedCompareExchange
GetCurrentThread
InitializeCriticalSection
TlsSetValue
Sleep
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
ReleaseMutex
TlsAlloc
CloseHandle
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
DisableThreadLibraryCalls
InterlockedExchange
IsValidCodePage
GetCPInfo
WideCharToMultiByte
IsDBCSLeadByteEx
CompareStringW

Exports

Exports

LxmlDocumentType
LxmlElementBaseType
LxmlElementClassLookupType
LxmlElementIteratorType
LxmlElementTagMatcherType
LxmlElementTreeType
LxmlElementType
LxmlFallbackElementClassLookupType
adoptExternalDocument
appendChild
appendChildToElement
attributeValue
attributeValueFromNsName
callLookupFallback
collectAttributes
deepcopyNodeToDocument
delAttribute
delAttributeFromNsName
documentOrRaise
elementFactory
elementTreeFactory
findChild
findChildBackwards
findChildForwards
findOrBuildNodeNsPrefix
getAttributeValue
getNsTag
getNsTagWithEmptyNs
hasChild
hasTail
hasText
initTagMatch
initetree
iteratorStoreNext
iterattributes
lookupDefaultElementClass
lookupNamespaceElementClass
makeElement
makeSubElement
namespacedName
namespacedNameFromNsName
newElementTree
nextElement
previousElement
pyunicode
rootNodeOrRaise
setAttributeValue
setElementClassLookupFunction
setNodeText
setTailText
tagMatches
tailOf
textOf
utf8

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/select.pyd
.dll windows:5 windows x86 arch:x86

9dbd410a2a66b776abcaaaa7f98a2bfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\select.pdb

Imports

ws2_32

__WSAFDIsSet
select
WSAGetLastError

python27

PyModule_AddObject
PyErr_SetExcFromWindowsErr
PyList_New
PyObject_AsFileDescriptor
PyNumber_Check
PyFloat_AsDouble
PyTuple_Pack
PyErr_NewException
PyExc_TypeError
PyErr_Occurred
PyExc_ValueError
PyEval_SaveThread
_Py_NoneStruct
PyExc_OverflowError
PySequence_Fast
PyList_SetItem
PyEval_RestoreThread
Py_InitModule4
PyArg_UnpackTuple
PyErr_SetString

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

initselect

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lib/unicodedata.pyd
.dll windows:5 windows x86 arch:x86

a2ceecb817a4b1463ef85598f0a82d8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\unicodedata.pdb

Imports

python27

Py_InitModule4
PyExc_TypeError
PyModule_AddObject
PyErr_Format
PyModule_AddStringConstant
PyType_Type
_Py_ctype_toupper
_PyUnicodeUCS2_ToNumeric
PyUnicodeUCS2_Resize
PyErr_SetString
PyUnicodeUCS2_GetSize
PyObject_Free
PyExc_ValueError
PyOS_snprintf
PyArg_ParseTuple
_PyUnicodeUCS2_ToDigit
PyExc_KeyError
PyUnicode_Type
PyCapsule_New
PyObject_GenericGetAttr
Py_BuildValue
PyInt_FromLong
_PyUnicodeUCS2_ToDecimalDigit
_PyObject_New
PyFloat_FromDouble
PyUnicodeUCS2_FromUnicode
PyString_FromString

msvcr90

free
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
sprintf
strncmp
_encode_pointer
_malloc_crt
memcpy
_encoded_null
_decode_pointer
_initterm

kernel32

IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedExchange
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep

Exports

Exports

initunicodedata

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 650KB - Virtual size: 650KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libbz2.dll
.dll windows:6 windows x86 arch:x86

be2d5000caa15565fcd5719a3357a7dc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:b6:17:8f:f4:f5:96:be:91:57:e5:20:98:8a:f0:52
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/06/2018, 00:00

Not After

07/06/2020, 23:59

Subject

CN=Beijing Zhi Liang Technology Co.\, Ltd,OU=IT,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100094,STREET=\#4009-222\,4th Floor\, B Unit\, #1 Building #2 Yard\, Yong Cheng North Street Hai Dian Distict,L=Beijing,ST=Beijing,C=CN,2.5.4.18=#1306313030303934

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:87:b1:02:9e:6d:fd:ab:bd:05:35:73:7b:80:b2:35:3c:71:72:93:87:32:d4:77:4c:77:75:77:ab:b2:26:27
Signer

Actual PE Digest

6d:87:b1:02:9e:6d:fd:ab:bd:05:35:73:7b:80:b2:35:3c:71:72:93:87:32:d4:77:4c:77:75:77:ab:b2:26:27

Digest Algorithm

sha256

PE Digest Matches

true

11:bb:62:a4:42:ae:84:b9:1d:ab:65:d3:1e:ff:e0:2b:10:b9:b9:1f
Signer

Actual PE Digest

11:bb:62:a4:42:ae:84:b9:1d:ab:65:d3:1e:ff:e0:2b:10:b9:b9:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
GetStdHandle
GetFileType
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadFile
ReadConsoleW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
OutputDebugStringW
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
SetEndOfFile

Exports

Exports

BZ2_bzBuffToBuffCompress
BZ2_bzBuffToBuffDecompress
BZ2_bzCompress
BZ2_bzCompressEnd
BZ2_bzCompressInit
BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit
BZ2_bzRead
BZ2_bzReadClose
BZ2_bzReadGetUnused
BZ2_bzReadOpen
BZ2_bzWrite
BZ2_bzWriteClose
BZ2_bzWriteClose64
BZ2_bzWriteOpen
BZ2_bzclose
BZ2_bzdopen
BZ2_bzerror
BZ2_bzflush
BZ2_bzlibVersion
BZ2_bzopen
BZ2_bzread
BZ2_bzwrite

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcrypto-1_1.dll
.dll windows:6 windows x86 arch:x86

2b47e91f610a9ebbf26feb93f0b9e590

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

I:\Develop\Other\BeatTrojan2017\sqlcipher\openssl-1.1.0g\libcrypto-1_1.pdb

Imports

ws2_32

sendto
recvfrom
WSASetLastError
send
recv
shutdown
socket
setsockopt
listen
connect
closesocket
bind
accept
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
getsockopt
getsockname
ioctlsocket
getnameinfo
freeaddrinfo
getaddrinfo
ntohs

advapi32

CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

kernel32

CreateFileW
OutputDebugStringW
SetEnvironmentVariableA
WriteConsoleW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEndOfFile
GetFullPathNameA
EnumSystemLocalesW
TlsSetValue
FindFirstFileExW
SetFileAttributesW
GetFileAttributesExW
RtlUnwind
ConvertFiberToThread
ConvertThreadToFiber
SwitchToFiber
DeleteFiber
CreateFiber
FormatMessageW
GetSystemTime
SystemTimeToFileTime
GetLastError
SetLastError
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
CloseHandle
FreeLibrary
LoadLibraryA
LoadLibraryW
GetModuleHandleExW
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsFree
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
ExitProcess
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
HeapFree
HeapAlloc
EncodePointer
DecodePointer
AreFileApisANSI
SetConsoleCtrlHandler
HeapReAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
GetStartupInfoW
CreateSemaphoreW
RaiseException
FatalAppExitA
SetStdHandle
FlushFileBuffers
SetFilePointerEx
GetProcessHeap
GetModuleFileNameW
LoadLibraryExW
HeapSize

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_to_generalizedtime
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_write
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_write
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_is_current_thread
BN_BLINDING_lock
BN_BLINDING_new
BN_BLINDING_set_current_thread
BN_BLINDING_set_flags
BN_BLINDING_unlock
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_secure_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_abs_is_word
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2binpad
BN_bn2dec
BN_bn2hex
BN_bn2lebinpad
BN_bn2mpi

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
python27.dll
.dll windows:5 windows x86 arch:x86

cde145f8094b2dd2b805036a4ba9eb72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build27\cpython\PCBuild\python27.pdb

Imports

kernel32

FindFirstFileW
SystemTimeToFileTime
SetEnvironmentVariableW
CreateDirectoryW
WaitForSingleObject
GetFileAttributesExA
GenerateConsoleCtrlEvent
SetFileTime
GetProcessTimes
OpenProcess
GetFileAttributesA
GetExitCodeProcess
GetFileAttributesW
CreateProcessA
TerminateProcess
CreateFileW
GetEnvironmentVariableA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetCurrentDirectoryW
SetLastError
MoveFileW
RemoveDirectoryA
SetFileAttributesA
FindClose
GetFileType
MoveFileA
SetCurrentDirectoryW
RemoveDirectoryW
CreatePipe
SetEnvironmentVariableA
GetModuleFileNameA
FindNextFileA
FindNextFileW
GetCurrentDirectoryA
GetFileAttributesExW
GetVersion
DeleteFileW
GetFileInformationByHandle
CreateFileA
SetFileAttributesW
DeleteFileA
SetEvent
Sleep
CreateEventA
ResetEvent
SetConsoleCtrlHandler
WideCharToMultiByte
IsDBCSLeadByte
MultiByteToWideChar
GetStdHandle
GetProcAddress
GetModuleHandleA
ExpandEnvironmentStringsW
GetModuleHandleW
OutputDebugStringA
SetErrorMode
FreeLibrary
FormatMessageA
LoadLibraryExA
LocalFree
OutputDebugStringW
GetConsoleCP
GetConsoleOutputCP
GetVersionExA
TlsGetValue
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
GetProcessHeap
TlsSetValue
GetCurrentThreadId
TlsAlloc
TlsFree
GetCurrentProcessId
GetTickCount
IsDebuggerPresent
GetFullPathNameA
GetFullPathNameW
CloseHandle
DuplicateHandle
GetSystemInfo
CreateFileMappingA
GetLastError
FlushViewOfFile
GetCurrentProcess
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
GetACP
GetLocaleInfoA
QueryPerformanceFrequency
GetSystemTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
GetSystemTimeAsFileTime

user32

CharPrevA
LoadStringA

advapi32

RegCloseKey
RegConnectRegistryA
RegFlushKey
RegLoadKeyA
RegEnumValueA
RegSaveKeyA
RegQueryValueA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegSetValueA
CryptReleaseContext

shell32

ShellExecuteA
ShellExecuteW

msvcr90

fputs
fprintf
strchr
free
malloc
ungetc
fflush
fgetc
fopen
isdigit
fwrite
fclose
_finite
wcscoll
localeconv
strcoll
isalpha
isupper
islower
memmove
strxfrm
_errno
_copysign
_isnan
_HUGE
_time64
sprintf
isalnum
tolower
realloc
isspace
fread
ferror
clearerr
memchr
ldexp
_hypot
feof
strtol
getc
_gmtime64
ceil
modf
_localtime64
_fstat64i32
strerror
__iob_func
strtok
setvbuf
_setmode
getenv
sqrt
cos
tanh
sinh
tan
cosh
acos
floor
frexp
atan
exp
fabs
asin
sin
_get_osfhandle
abort
_stricmp
tmpfile
_wcsicmp
strncat
_lseeki64
_environ
_tempnam
_wopen
tmpnam
strncmp
_msize
_cwait
__pioinfo
_spawnve
system
_exit
strncpy
wcsrchr
_spawnv
_commit
strrchr
_open_osfhandle
wcsncmp
_stat64i32
_fdopen
toupper
_mktime64
_ctime64
clock
asctime
_ftime64
strftime
ftell
fseek
_snprintf
wcstombs
fgetpos
_wfopen
fsetpos
fgets
_fileno
__control87_2
fputc
isxdigit
printf
exit
strstr
atoi
_mbstrlen
_getche
_getwch
_putch
_locking
_heapmin
_ungetch
_getwche
_kbhit
_putwch
_getch
__sys_nerr
__sys_errlist
putc
_vsnprintf
strpbrk
rewind
_resetstkoflw
signal
strtoul
vfprintf
_endthreadex
_beginthreadex
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_CIlog10
_CIfmod
_CIsqrt
_CIcosh
_CItan
_CItanh
setlocale
_getcwd
_isatty
_lseek
_execve
_putenv
_read
_umask
_close
_open
_getpid
_dup
_execv
_write
_dup2
_tzset
_tzname
_timezone
_daylight
_strdup
_strnicmp
_unlink
memset
memcpy
_CIsin
_CIcos
_CIlog
_CIexp
_CIatan2
_CIpow
_CIsinh

Exports

Exports

PyAST_Compile
PyAST_FromNode
PyArena_AddPyObject
PyArena_Free
PyArena_Malloc
PyArena_New
PyArg_Parse
PyArg_ParseTuple
PyArg_ParseTupleAndKeywords
PyArg_UnpackTuple
PyArg_VaParse
PyArg_VaParseTupleAndKeywords
PyBaseObject_Type
PyBaseString_Type
PyBool_FromLong
PyBool_Type
PyBuffer_FillContiguousStrides
PyBuffer_FillInfo
PyBuffer_FromContiguous
PyBuffer_FromMemory
PyBuffer_FromObject
PyBuffer_FromReadWriteMemory
PyBuffer_FromReadWriteObject
PyBuffer_GetPointer
PyBuffer_IsContiguous
PyBuffer_New
PyBuffer_Release
PyBuffer_ToContiguous
PyBuffer_Type
PyByteArrayIter_Type
PyByteArray_AsString
PyByteArray_Concat
PyByteArray_Fini
PyByteArray_FromObject
PyByteArray_FromStringAndSize
PyByteArray_Init
PyByteArray_Resize
PyByteArray_Size
PyByteArray_Type
PyCFunction_Call
PyCFunction_ClearFreeList
PyCFunction_Fini
PyCFunction_GetFlags
PyCFunction_GetFunction
PyCFunction_GetSelf
PyCFunction_New
PyCFunction_NewEx
PyCFunction_Type
PyCObject_AsVoidPtr
PyCObject_FromVoidPtr
PyCObject_FromVoidPtrAndDesc
PyCObject_GetDesc
PyCObject_Import
PyCObject_SetVoidPtr
PyCObject_Type
PyCallIter_New
PyCallIter_Type
PyCallable_Check
PyCapsule_GetContext
PyCapsule_GetDestructor
PyCapsule_GetName
PyCapsule_GetPointer
PyCapsule_Import
PyCapsule_IsValid
PyCapsule_New
PyCapsule_SetContext
PyCapsule_SetDestructor
PyCapsule_SetName
PyCapsule_SetPointer
PyCapsule_Type
PyCell_Get
PyCell_New
PyCell_Set
PyCell_Type
PyClassMethod_New
PyClassMethod_Type
PyClass_IsSubclass
PyClass_New
PyClass_Type
PyCode_Addr2Line
PyCode_New
PyCode_NewEmpty
PyCode_Optimize
PyCode_Type
PyCodec_BackslashReplaceErrors
PyCodec_Decode
PyCodec_Decoder
PyCodec_Encode
PyCodec_Encoder
PyCodec_IgnoreErrors
PyCodec_IncrementalDecoder
PyCodec_IncrementalEncoder
PyCodec_LookupError
PyCodec_Register
PyCodec_RegisterError
PyCodec_ReplaceErrors
PyCodec_StreamReader
PyCodec_StreamWriter
PyCodec_StrictErrors
PyCodec_XMLCharRefReplaceErrors
PyComplex_AsCComplex
PyComplex_FromCComplex
PyComplex_FromDoubles
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDescr_NewClassMethod
PyDescr_NewGetSet
PyDescr_NewMember
PyDescr_NewMethod
PyDescr_NewWrapper
PyDictItems_Type
PyDictIterItem_Type
PyDictIterKey_Type
PyDictIterValue_Type
PyDictKeys_Type
PyDictProxy_New
PyDictProxy_Type
PyDictValues_Type
PyDict_Clear
PyDict_Contains
PyDict_Copy
PyDict_DelItem
PyDict_DelItemString
PyDict_Fini
PyDict_GetItem
PyDict_GetItemString
PyDict_Items
PyDict_Keys
PyDict_Merge
PyDict_MergeFromSeq2
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyDict_Update
PyDict_Values
PyEllipsis_Type
PyEnum_Type
PyErr_BadArgument
PyErr_BadInternalCall
PyErr_CheckSignals
PyErr_Clear
PyErr_Display
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NewException
PyErr_NewExceptionWithDoc
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Print
PyErr_PrintEx
PyErr_ProgramText
PyErr_Restore
PyErr_SetExcFromWindowsErr
PyErr_SetExcFromWindowsErrWithFilename
PyErr_SetExcFromWindowsErrWithFilenameObject
PyErr_SetExcFromWindowsErrWithUnicodeFilename
PyErr_SetFromErrno
PyErr_SetFromErrnoWithFilename
PyErr_SetFromErrnoWithFilenameObject
PyErr_SetFromErrnoWithUnicodeFilename
PyErr_SetFromWindowsErr
PyErr_SetFromWindowsErrWithFilename
PyErr_SetFromWindowsErrWithUnicodeFilename
PyErr_SetInterrupt
PyErr_SetNone
PyErr_SetObject
PyErr_SetString
PyErr_SyntaxLocation
PyErr_Warn
PyErr_WarnEx
PyErr_WarnExplicit
PyErr_WriteUnraisable
PyEval_AcquireLock
PyEval_AcquireThread
PyEval_CallFunction
PyEval_CallMethod
PyEval_CallObjectWithKeywords
PyEval_EvalCode
PyEval_EvalCodeEx
PyEval_EvalFrame
PyEval_EvalFrameEx
PyEval_GetBuiltins
PyEval_GetCallStats
PyEval_GetFrame
PyEval_GetFuncDesc
PyEval_GetFuncName
PyEval_GetGlobals
PyEval_GetLocals
PyEval_GetRestricted
PyEval_InitThreads
PyEval_MergeCompilerFlags
PyEval_ReInitThreads
PyEval_ReleaseLock
PyEval_ReleaseThread
PyEval_RestoreThread
PyEval_SaveThread
PyEval_SetProfile
PyEval_SetTrace
PyEval_ThreadsInitialized
PyExc_ArithmeticError
PyExc_AssertionError
PyExc_AttributeError
PyExc_BaseException
PyExc_BufferError
PyExc_BytesWarning
PyExc_DeprecationWarning
PyExc_EOFError
PyExc_EnvironmentError
PyExc_Exception
PyExc_FloatingPointError
PyExc_FutureWarning
PyExc_GeneratorExit
PyExc_IOError
PyExc_ImportError
PyExc_ImportWarning
PyExc_IndentationError
PyExc_IndexError
PyExc_KeyError
PyExc_KeyboardInterrupt
PyExc_LookupError
PyExc_MemoryError
PyExc_MemoryErrorInst
PyExc_NameError
PyExc_NotImplementedError
PyExc_OSError
PyExc_OverflowError
PyExc_PendingDeprecationWarning
PyExc_RecursionErrorInst
PyExc_ReferenceError
PyExc_RuntimeError
PyExc_RuntimeWarning
PyExc_StandardError
PyExc_StopIteration
PyExc_SyntaxError
PyExc_SyntaxWarning
PyExc_SystemError
PyExc_SystemExit
PyExc_TabError
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_UnicodeDecodeError
PyExc_UnicodeEncodeError
PyExc_UnicodeError
PyExc_UnicodeTranslateError
PyExc_UnicodeWarning
PyExc_UserWarning
PyExc_ValueError
PyExc_Warning
PyExc_WindowsError
PyExc_ZeroDivisionError
PyFile_AsFile
PyFile_DecUseCount
PyFile_FromFile
PyFile_FromString
PyFile_GetLine
PyFile_IncUseCount
PyFile_Name
PyFile_SetBufSize
PyFile_SetEncoding
PyFile_SetEncodingAndErrors
PyFile_SoftSpace
PyFile_Type
PyFile_WriteObject
PyFile_WriteString
PyFloat_AsDouble
PyFloat_AsReprString
PyFloat_AsString
PyFloat_ClearFreeList
PyFloat_Fini
PyFloat_FromDouble
PyFloat_FromString
PyFloat_GetInfo
PyFloat_GetMax
PyFloat_GetMin
PyFloat_Type
PyFrame_BlockPop
PyFrame_BlockSetup
PyFrame_ClearFreeList
PyFrame_FastToLocals
PyFrame_Fini
PyFrame_GetLineNumber
PyFrame_LocalsToFast
PyFrame_New
PyFrame_Type
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetClosure
PyFunction_GetCode
PyFunction_GetDefaults
PyFunction_GetGlobals
PyFunction_GetModule
PyFunction_New
PyFunction_SetClosure
PyFunction_SetDefaults
PyFunction_Type
PyFuture_FromAST
PyGC_Collect
PyGILState_Ensure
PyGILState_GetThisThreadState
PyGILState_Release
PyGen_NeedsFinalizing
PyGen_New
PyGen_Type
PyGetSetDescr_Type
PyImport_AddModule
PyImport_AppendInittab
PyImport_Cleanup
PyImport_ExecCodeModule
PyImport_ExecCodeModuleEx
PyImport_ExtendInittab
PyImport_FrozenModules
PyImport_GetImporter
PyImport_GetMagicNumber
PyImport_GetModuleDict
PyImport_Import
PyImport_ImportFrozenModule
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleNoBlock
PyImport_Inittab
PyImport_ReloadModule
PyInstance_New
PyInstance_NewRaw
PyInstance_Type
PyInt_AsLong
PyInt_AsSsize_t
PyInt_AsUnsignedLongLongMask
PyInt_AsUnsignedLongMask
PyInt_ClearFreeList
PyInt_Fini
PyInt_FromLong
PyInt_FromSize_t
PyInt_FromSsize_t
PyInt_FromString
PyInt_FromUnicode
PyInt_GetMax
PyInt_Type
PyInterpreterState_Clear
PyInterpreterState_Delete
PyInterpreterState_Head
PyInterpreterState_New
PyInterpreterState_Next
PyInterpreterState_ThreadHead
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_Fini
PyList_GetItem
PyList_GetSlice
PyList_Insert
PyList_New
PyList_Reverse
PyList_SetItem
PyList_SetSlice
PyList_Size
PyList_Sort
PyList_Type
PyLong_AsDouble
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsLongLong
PyLong_AsLongLongAndOverflow
PyLong_AsSsize_t
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyLong_AsUnsignedLongLongMask
PyLong_AsUnsignedLongMask
PyLong_AsVoidPtr
PyLong_FromDouble
PyLong_FromLong
PyLong_FromLongLong
PyLong_FromSize_t
PyLong_FromSsize_t
PyLong_FromString
PyLong_FromUnicode
PyLong_FromUnsignedLong
PyLong_FromUnsignedLongLong
PyLong_FromVoidPtr
PyLong_GetInfo
PyLong_Type
PyMapping_Check
PyMapping_GetItemString
PyMapping_HasKey
PyMapping_HasKeyString
PyMapping_Length
PyMapping_SetItemString
PyMapping_Size
PyMarshal_ReadLastObjectFromFile
PyMarshal_ReadLongFromFile
PyMarshal_ReadObjectFromFile
PyMarshal_ReadObjectFromString
PyMarshal_ReadShortFromFile
PyMarshal_WriteLongToFile
PyMarshal_WriteObjectToFile
PyMarshal_WriteObjectToString
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemberDescr_Type
PyMember_Get
PyMember_GetOne
PyMember_Set
PyMember_SetOne
PyMemoryView_FromBuffer
PyMemoryView_FromObject
PyMemoryView_GetContiguous
PyMemoryView_Type
PyMethod_Class
PyMethod_ClearFreeList
PyMethod_Fini
PyMethod_Function
PyMethod_New
PyMethod_Self
PyMethod_Type
PyModule_AddIntConstant
PyModule_AddObject
PyModule_AddStringConstant
PyModule_GetDict
PyModule_GetFilename
PyModule_GetName
PyModule_New
PyModule_Type
PyNode_AddChild
PyNode_Compile
PyNode_Free
PyNode_ListTree
PyNode_New
PyNullImporter_Type
PyNumber_Absolute
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_Check
PyNumber_Coerce
PyNumber_CoerceEx
PyNumber_Divide
PyNumber_Divmod
PyNumber_Float
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceDivide
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Index
PyNumber_Int
PyNumber_Invert
PyNumber_Long
PyNumber_Lshift
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_ToBase
PyNumber_TrueDivide
PyNumber_Xor
PyOS_AfterFork
PyOS_CheckStack
PyOS_FiniInterrupts
PyOS_InitInterrupts
PyOS_InputHook
PyOS_InterruptOccurred
PyOS_Readline
PyOS_ReadlineFunctionPointer
PyOS_ascii_atof
PyOS_ascii_formatd
PyOS_ascii_strtod
PyOS_double_to_string
PyOS_getsig
PyOS_mystricmp
PyOS_mystrnicmp
PyOS_setsig
PyOS_snprintf
PyOS_string_to_double
PyOS_strtol
PyOS_strtoul
PyOS_vsnprintf
PyObject_AsCharBuffer
PyObject_AsFileDescriptor
PyObject_AsReadBuffer
PyObject_AsWriteBuffer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 849KB - Virtual size: 848KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 330KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tmp/vcredist_x86.exe
.exe windows:5 windows x86 arch:x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a
Signer

Actual PE Digest

d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.2MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uninst.exe
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:41:a6:50:2d:74:00:55:2f:9f:de:4e:8a:c4:27:bb
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/02/2019, 00:00

Not After

14/02/2022, 23:59

Subject

SERIALNUMBER=91110108MA01C3DB41,CN=Beijing Zhi Liang Technology Co.\, Ltd,O=Beijing Zhi Liang Technology Co.\, Ltd,POSTALCODE=100095,STREET=Rm 4009-222\, 4F\, Block B\, Building 1\, No.2 Yongcheng North Rd\, Haidian Dist.\,,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a7:a7:7f:57:4d:25:20:68:6b:bc:c3:69:77:f5:ca:85:4c:06:62:29:a0:1f:8a:8a:4a:e2:f6:0c:6b:45:dd:92
Signer

Actual PE Digest

a7:a7:7f:57:4d:25:20:68:6b:bc:c3:69:77:f5:ca:85:4c:06:62:29:a0:1f:8a:8a:4a:e2:f6:0c:6b:45:dd:92

Digest Algorithm

sha256

PE Digest Matches

true

d9:f1:bd:7d:72:b9:71:6f:0d:4d:7f:3d:09:25:3f:c2:8a:3e:b9:84
Signer

Actual PE Digest

d9:f1:bd:7d:72:b9:71:6f:0d:4d:7f:3d:09:25:3f:c2:8a:3e:b9:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 788KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BgWorker.dll
.dll windows:4 windows x86 arch:x86

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread

user32

IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects

Exports

Exports

CallAndWait

Sections

.text
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsNiuniuSkin.dll
.dll windows:5 windows x86 arch:x86

d5c478d000c5c26f099a32477a25dc97

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

73:09:a2:53:fc:80:74:f3:53:a6:0d:5b:a0:4d:e2:97
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

10/10/2016, 00:00

Not After

09/12/2019, 23:59

Subject

CN=Shao zhengjun,OU=Individual Developer,O=No Organization Affiliation,L=Shenzhen,ST=Guang Dong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:86:89:46:8e:90:7a:0e:b2:b2:b8:2b:e4:7b:b4:49:1e:f6:66:d9
Signer

Actual PE Digest

86:86:89:46:8e:90:7a:0e:b2:b2:b8:2b:e4:7b:b4:49:1e:f6:66:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\NiuNiuCapture\niuniu_src\nsNiuniuSkin\plugin\nsNiuniuDui\bin\nsNiuniuDUI.pdb

Imports

kernel32

TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapAlloc
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetModuleFileNameA
SetFilePointer
CloseHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
CreateFileW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
LoadLibraryA
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
TlsAlloc
MulDiv
lstrlenW
LoadLibraryW
GetCurrentDirectoryW
GetFileSize
GlobalUnlock
GlobalLock
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
LocalFree
FormatMessageW
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryW
GetFileAttributesW
SetFileTime
lstrcmpiW
GetLocalTime
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
RtlUnwind
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InterlockedDecrement
InterlockedIncrement
TlsGetValue
GetProcAddress
CreateFileA
GetModuleHandleW
GetModuleHandleA
lstrcpyW
GlobalFree
lstrcpynW
WideCharToMultiByte
GlobalAlloc
ExitProcess
MultiByteToWideChar
lstrlenA

user32

GetCaretBlinkTime
KillTimer
GetFocus
ReleaseCapture
GetCursorPos
MapWindowPoints
IsWindowVisible
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetActiveWindow
InvalidateRect
SetCapture
FillRect
DrawTextW
CharPrevW
SetRect
UpdateLayeredWindow
MoveWindow
GetWindowRgn
SetForegroundWindow
IsWindowEnabled
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
GetWindowTextLengthW
GetWindowTextW
EqualRect
MessageBoxW
SetWindowRgn
IsZoomed
IsIconic
GetCaretPos
CreatePopupMenu
AppendMenuW
EnableMenuItem
TrackPopupMenu
DestroyMenu
IntersectRect
CharNextW
SetTimer
PtInRect
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetCursor
UnionRect
InflateRect
OffsetRect
SetPropW
GetPropW
GetWindowLongW
CallWindowProcW
GetClassInfoExW
RegisterClassExW
LoadCursorW
RegisterClassW
GetSystemMetrics
LoadImageW
SendMessageW
GetParent
MonitorFromWindow
GetMonitorInfoW
GetWindow
EnableWindow
SetFocus
PostQuitMessage
ShowWindow
SetWindowLongW
CreateWindowExW
DefWindowProcW
UpdateWindow
GetClientRect
GetDC
ScreenToClient
DispatchMessageW
SetWindowTextW
IsWindow
SetWindowPos
TranslateMessage
PostMessageW
GetMessageW
GetWindowRect
DestroyWindow
GetKeyState
ReleaseDC
wsprintfW
GetSysColor

shell32

SHBrowseForFolderW
DragQueryFileW
SHGetPathFromIDListW

ole32

OleDuplicateData
RegisterDragDrop
CreateStreamOnHGlobal
ReleaseStgMedium
CLSIDFromString
OleLockRunning
CoCreateInstance
DoDragDrop
CoInitialize
CLSIDFromProgID

gdi32

BitBlt
CloseEnhMetaFile
SaveDC
SelectObject
RestoreDC
GetTextMetricsW
GetObjectW
DeleteObject
CreateFontIndirectW
AddFontMemResourceEx
SetWindowOrgEx
CreateCompatibleDC
GetDeviceCaps
PlayEnhMetaFile
CreateCompatibleBitmap
GetEnhMetaFileHeader
CreateDIBitmap
GetStockObject
CreateRoundRectRgn
CreatePen
DeleteDC
RemoveFontMemResourceEx
SetBitmapBits
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
GetObjectA
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
GdiFlush
PtInRegion
CreateRectRgn
GetBitmapBits
CreateEnhMetaFileW

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipAlloc
GdipFree
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipDeleteBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCloneBrush
GdipCreateSolidFill
GdipDeletePen
GdipDrawRectangleI
GdipSetPenMode
GdipCreatePen1
GdipDeleteFont
GdipDeleteStringFormat
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDrawImageRectI
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem

Exports

Exports

BindCallBack
BindCallBackEx
ExitDUISetup
GetControlAttribute
GetWindowSize
InitSkinPage
InitSkinSubPage
ResetLicenseFile
SelectInstallDir
SelectInstallDirEx
SetControlAttribute
SetWindowSize
SetWindowTile
ShowPage
ShowPageItem
ShowSkinSubPage
StringHelper

Sections

.text
Size: 729KB - Virtual size: 729KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

d6b0243dd90845123f35b66da1032c84

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
lstrcpynW
GlobalAlloc

user32

wsprintfW

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1024B - Virtual size: 993B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/skin.zip
.zip
arrow_down.png
.png
arrow_up.png
.png
bgbottom.png
.png
bk_shadow.png
.png
configpage.xml
default.xml
.xml
finishpage.xml
finishpage_xp.xml
form/bg.png
.png
form/bk_down.png
.png
form/btn_down_hovered.png
.png
form/btn_down_normal.png
.png
form/btn_down_pressed.png
.png
form/btn_installation_disable.png
.png
form/btn_installation_hovered.png
.png
form/btn_installation_normal.png
.png
form/btn_installation_pressed.png
.png
form/btn_path_hovered.png
.png
form/btn_path_normal.png
.png
form/btn_path_pressed.png
.png
form/btn_up_hovered.png
.png
form/btn_up_normal.png
.png
form/btn_up_pressed.png
.png
form/error.png
.png
form/fg.png
.png
form/infor.png
.png
form/ok.png
.png
form/pic.png
.png
form/question.png
.png
form/uninstall.png
.png
form/warning.png
.png
install.xml
installingpage.xml
license_bg.png
.png
licensepage.xml
msgBox.xml
.xml
msgWarning.png
.png
process_bottom.png
.png
process_top.png
.png
public/bk/bk_shadow.png
.png
public/button/btn_global_green_80x30_hovered.png
.png
public/button/btn_global_green_80x30_normal.png
.png
public/button/btn_global_green_80x30_pushed.png
.png
public/button/btn_global_white_80x30_hovered.png
.png
public/button/btn_global_white_80x30_normal.png
.png
public/button/btn_global_white_80x30_pushed.png
.png
public/button/btn_wnd_close_hovered.png
.png
public/button/btn_wnd_close_pushed.png
.png
public/button/btn_wnd_gray_close.png
.png
public/button/btn_wnd_gray_max.png
.png
public/button/btn_wnd_gray_max_hovered.png
.png
public/button/btn_wnd_gray_max_pushed.png
.png
public/button/btn_wnd_gray_min.png
.png
public/button/btn_wnd_gray_min_hovered.png
.png
public/button/btn_wnd_gray_min_pushed.png
.png
public/button/btn_wnd_gray_restore.png
.png
public/button/btn_wnd_gray_restore_hovered.png
.png
public/button/btn_wnd_gray_restore_pushed.png
.png
public/button/btn_wnd_white_close.png
.png
public/button/btn_wnd_white_min.png
.png
public/button/btn_wnd_white_min_hovered.png
.png
public/button/btn_wnd_white_min_pushed.png
.png
public/caption/caption_public.png
.png
public/checkbox/check_green_no.png
.png
public/checkbox/check_green_yes.png
.png
public/checkbox/check_no.png
.png
public/checkbox/check_yes.png
.png
public/checkbox/check_yes1.png
.png
public/edit/edit0.png
.png
public/vsrcollbar/bk_hovered.png
.png
public/vsrcollbar/bk_normal.png
.png
public/vsrcollbar/thumb_hovered.png
.png
public/vsrcollbar/thumb_normal.png
.png
scroll.png
.png
uninst_process_bottom.png
.png
uninst_process_top.png
.png
uninstallfinishpage.xml
uninstallingpage.xml
uninstallpage.xml
update.ini
vcomp120.dll
.dll windows:6 windows x86 arch:x86

ba61db1fb6534c776fac68630fc61afe

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:34:60:89:67:b0:04:1c:3a:6b:b9:36:aa:45:2b:77:e6:5a:9a:99:7f:37:f8:61:ce:ed:4c:10:b9:16:81:3b
Signer

Actual PE Digest

cf:34:60:89:67:b0:04:1c:3a:6b:b9:36:aa:45:2b:77:e6:5a:9a:99:7f:37:f8:61:ce:ed:4c:10:b9:16:81:3b

Digest Algorithm

sha256

PE Digest Matches

true

5c:02:88:19:ee:1e:0d:f5:d9:14:7e:39:fb:ea:02:78:76:e6:d2:1c
Signer

Actual PE Digest

5c:02:88:19:ee:1e:0d:f5:d9:14:7e:39:fb:ea:02:78:76:e6:d2:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

vcomp120.i386.pdb

Imports

kernel32

FormatMessageW
OutputDebugStringW
LocalAlloc
LocalFree
GetConsoleWindow
GetConsoleScreenBufferInfo
WriteConsoleW
WideCharToMultiByte
WriteFile
GetLastError
GetCurrentThreadId
HeapFree
GetProcessHeap
UnhandledExceptionFilter
CloseHandle
WaitForSingleObjectEx
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTickCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
Sleep
SwitchToThread
ExitProcess
GetStdHandle
CreateThread
QueueUserWorkItem
CreateEventW
GetNativeSystemInfo
QueryPerformanceFrequency
GetSystemTimeAdjustment
GetEnvironmentVariableW
lstrlenW
lstrcmpiW
GetStringTypeExW
ResetEvent
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
LoadLibraryExW
FindClose
GetModuleFileNameW
FindResourceExW
LoadResource
ReadFile
HeapSize
GetCurrentProcessId
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetModuleHandleExW
SetStdHandle
RtlUnwind
HeapReAlloc
FlushFileBuffers
CreateFileW
LCMapStringW
ReadConsoleW

user32

MessageBoxW

Exports

Exports

C2VectParallel
_vcomp_atomic_add_i1
_vcomp_atomic_add_i2
_vcomp_atomic_add_i4
_vcomp_atomic_add_i8
_vcomp_atomic_add_r4
_vcomp_atomic_add_r8
_vcomp_atomic_and_i1
_vcomp_atomic_and_i2
_vcomp_atomic_and_i4
_vcomp_atomic_and_i8
_vcomp_atomic_div_i1
_vcomp_atomic_div_i2
_vcomp_atomic_div_i4
_vcomp_atomic_div_i8
_vcomp_atomic_div_r4
_vcomp_atomic_div_r8
_vcomp_atomic_div_ui1
_vcomp_atomic_div_ui2
_vcomp_atomic_div_ui4
_vcomp_atomic_div_ui8
_vcomp_atomic_mul_i1
_vcomp_atomic_mul_i2
_vcomp_atomic_mul_i4
_vcomp_atomic_mul_i8
_vcomp_atomic_mul_r4
_vcomp_atomic_mul_r8
_vcomp_atomic_or_i1
_vcomp_atomic_or_i2
_vcomp_atomic_or_i4
_vcomp_atomic_or_i8
_vcomp_atomic_shl_i1
_vcomp_atomic_shl_i2
_vcomp_atomic_shl_i4
_vcomp_atomic_shl_i8
_vcomp_atomic_shr_i1
_vcomp_atomic_shr_i2
_vcomp_atomic_shr_i4
_vcomp_atomic_shr_i8
_vcomp_atomic_shr_ui1
_vcomp_atomic_shr_ui2
_vcomp_atomic_shr_ui4
_vcomp_atomic_shr_ui8
_vcomp_atomic_sub_i1
_vcomp_atomic_sub_i2
_vcomp_atomic_sub_i4
_vcomp_atomic_sub_i8
_vcomp_atomic_sub_r4
_vcomp_atomic_sub_r8
_vcomp_atomic_xor_i1
_vcomp_atomic_xor_i2
_vcomp_atomic_xor_i4
_vcomp_atomic_xor_i8
_vcomp_barrier
_vcomp_copyprivate_broadcast
_vcomp_copyprivate_receive
_vcomp_enter_critsect
_vcomp_flush
_vcomp_for_dynamic_init
_vcomp_for_dynamic_init_i8
_vcomp_for_dynamic_next
_vcomp_for_dynamic_next_i8
_vcomp_for_static_end
_vcomp_for_static_init
_vcomp_for_static_init_i8
_vcomp_for_static_simple_init
_vcomp_for_static_simple_init_i8
_vcomp_fork
_vcomp_get_thread_num
_vcomp_leave_critsect
_vcomp_master_barrier
_vcomp_master_begin
_vcomp_master_end
_vcomp_ordered_begin
_vcomp_ordered_end
_vcomp_ordered_loop_end
_vcomp_reduction_i1
_vcomp_reduction_i2
_vcomp_reduction_i4
_vcomp_reduction_i8
_vcomp_reduction_r4
_vcomp_reduction_r8
_vcomp_reduction_u1
_vcomp_reduction_u2
_vcomp_reduction_u4
_vcomp_reduction_u8
_vcomp_sections_init
_vcomp_sections_next
_vcomp_set_num_threads
_vcomp_single_begin
_vcomp_single_end
omp_destroy_lock
omp_destroy_nest_lock
omp_get_dynamic
omp_get_max_threads
omp_get_nested
omp_get_num_procs
omp_get_num_threads
omp_get_thread_num
omp_get_wtick
omp_get_wtime
omp_in_parallel
omp_init_lock
omp_init_nest_lock
omp_set_dynamic
omp_set_lock
omp_set_nest_lock
omp_set_nested
omp_set_num_threads
omp_test_lock
omp_test_nest_lock
omp_unset_lock
omp_unset_nest_lock

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wvsetting.ini

Sharing

General

Malware Config

Signatures

Files

be41bf7b8cc010b614bd36bbca606973

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:caCertificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:caCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

52:4d:38:1d:77:77:46:2a:e9:ca:6b:cc:b4:8c:1e:30:c7:33:f5:63:70:ac:6d:9c:69:67:ce:4d:a1:cd:87:4cSigner

92:2f:08:e9:36:df:d0:c3:f1:00:aa:df:b0:f1:48:f2:5e:66:85:64Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 458KB

.ndata Size: - Virtual size: 788KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 4KB - Virtual size: 3KB

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 987B

.reloc Size: 512B - Virtual size: 66B

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

82:bd:f2:c6:f8:d1:85:5c:e4:7f:e4:e6:aa:46:5c:ca
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

52:4d:38:1d:77:77:46:2a:e9:ca:6b:cc:b4:8c:1e:30:c7:33:f5:63:70:ac:6d:9c:69:67:ce:4d:a1:cd:87:4c
Signer

92:2f:08:e9:36:df:d0:c3:f1:00:aa:df:b0:f1:48:f2:5e:66:85:64
Signer

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 788KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 1024B - Virtual size: 987B

.reloc
Size: 512B - Virtual size: 66B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

73:09:a2:53:fc:80:74:f3:53:a6:0d:5b:a0:4d:e2:97
Certificate

86:86:89:46:8e:90:7a:0e:b2:b2:b8:2b:e4:7b:b4:49:1e:f6:66:d9
Signer

.text
Size: 729KB - Virtual size: 729KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 11KB - Virtual size: 21KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 40KB - Virtual size: 40KB

.text
Size: 1024B - Virtual size: 993B

.rdata
Size: 1024B - Virtual size: 566B

.data
Size: 512B - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 218B

.text
Size: 218KB - Virtual size: 218KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 12KB - Virtual size: 30KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 22KB - Virtual size: 21KB