nos_setup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

nos_setup.exe
Size

27.0MB
MD5

d58531ddd40daa8ca1c3569ac1c0c4d3
SHA1

07f4c058658f085d434e78febc2365f0b8f25802
SHA256

5051edf86f5e10baca635c7319b42e0cd2395c1293a9de6b0d45a8236f689207
SHA512

ee8168434b31dc9d3e708f182af33a59f29fdff706a63947ad78331e15e1fa0e10d048c7c93ef5c6edd1186bece840670fafb951ca496128814d7f3761e774c1
SSDEEP

786432:GhvmTZFh0juDs1OQc3KsHuuDH3Y4+I6Iao1:evG4uDs1OT3bHDL3Y4aro1

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/GetVersion.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/GetVersion.dll	upx

Unsigned PE 30 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$COMMONFILES/nProtect Shared/Engine/tyavexcept.bin
unpack001/$PLUGINSDIR/GetVersion.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$SYSDIR/TKIdsVt.sys
unpack001/$SYSDIR/TKIdsVt64.sys
unpack001/$SYSDIR/noska.sys
unpack001/$SYSDIR/noskp.sys
unpack001/$SYSDIR/noskp64.sys
unpack001/$SYSDIR/nosku.sys
unpack001/$SYSDIR/nosku64.sys
unpack001/$SYSDIR/np_ck32s.sys
unpack001/$SYSDIR/np_ck64s.sys
unpack001/$SYSDIR/tkfwvt.sys
unpack001/7z.dll
unpack001/coredll/network/x64/TKIdsVt64.sys
unpack001/coredll/network/x86/TKIdsVt.sys
unpack001/coredll/network/x86/tkfwvt.sys
unpack001/coredll/rtd/tyavexcept.bin
unpack001/ncert/certmgr.exe
unpack001/npk/noska.sys
unpack001/npk/noskp.sys
unpack001/npk/noskp64.sys
unpack001/npk/nosku.sys
unpack001/npk/nosku64.sys
unpack001/npk/np_ck32s.sys
unpack001/npk/np_ck64s.sys

Files

nos_setup.exe
.exe windows:4 windows x86 arch:x86

1f23f452093b5c1ff091a2f9fb4fa3e9

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b1:23:68:43:c9:c3:ea:7b:6b:45:58:fb:d6:a9:dc:2e:ac:ce:ff:e2:56:e3:0c:f2:07:6a:90:83:58:cb:5a:07
Signer

Actual PE Digest

b1:23:68:43:c9:c3:ea:7b:6b:45:58:fb:d6:a9:dc:2e:ac:ce:ff:e2:56:e3:0c:f2:07:6a:90:83:58:cb:5a:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
GetShortPathNameW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW

advapi32

AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/BWT.dll
.dll windows:4 windows x86 arch:x86

05195c4c68546332284aba78a64bfe4c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/07/2021, 00:00

Not After

27/07/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:6a:ca:0f:0a:72:79:b6:f0:e0:8c:5c:ff:e7:2f:d3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/06/2023, 00:00

Not After

07/06/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1f
Signer

Actual PE Digest

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\bwt\BWT.pdb

Imports

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpSetOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle

crypt32

CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertOpenSystemStoreW

rpcrt4

UuidCreate

kernel32

SetStdHandle
WriteConsoleA
OutputDebugStringW
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
lstrlenA
MultiByteToWideChar
CreateFileW
SizeofResource
GetFileSize
LockResource
SetFilePointer
LoadResource
ReadFile
FindResourceExW
CreateEventW
GetConsoleOutputCP
GetModuleHandleW
Sleep
SetEvent
lstrlenW
OutputDebugStringA
WideCharToMultiByte
FindResourceW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetWindowsDirectoryW
GetExitCodeThread
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
GetConsoleMode
GetConsoleCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetProcAddress
InterlockedIncrement
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
VirtualFree
VirtualAlloc
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LoadLibraryA

user32

UnregisterClassA

advapi32

RegSetValueExW
RevertToSelf
ImpersonateLoggedOnUser
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

BWTControl

Sections

.text
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/BWTTrustList.dat
$COMMONFILES/nProtect Shared/Engine/BwtTrust.dll
.dll windows:4 windows x86 arch:x86

03a1fe3fde0b98269544b8bec2d124a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/07/2017, 00:00

Not After

18/07/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19/07/2017, 00:00

Not After

18/07/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

Actual PE Digest

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5

Digest Algorithm

sha256

PE Digest Matches

true

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

Actual PE Digest

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\Release\BwtTrust.pdb

Imports

psapi

GetMappedFileNameW

kernel32

CreateFileMappingW
GetCurrentProcess
QueryDosDeviceW
GetLogicalDriveStringsW
SetEndOfFile
SetFilePointer
GetFileSize
WriteFile
GetDriveTypeW
GetLastError
MapViewOfFile
OutputDebugStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
SetEvent
FindClose
UnmapViewOfFile
SetFileAttributesW
DeleteFileW
GetFileAttributesW
CloseHandle
CreateFileW
CompareStringW
OpenFileMappingW
TlsSetValue
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
SetEnvironmentVariableA
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
FlushFileBuffers
CompareStringA

advapi32

RegQueryValueExW
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
RegOpenKeyExW

Exports

Exports

RequestService

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/NpBWT.dll
.dll windows:5 windows x86 arch:x86

a60200e3067da2c9a407d52e73c19fac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44
Signer

Actual PE Digest

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44

Digest Algorithm

sha256

PE Digest Matches

true

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a
Signer

Actual PE Digest

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpBWTStatic\Win32\NpBWT.pdb

Imports

kernel32

GetSystemInfo
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CreateFileMappingW
OpenFileMappingW
CloseHandle
VirtualFree
VirtualAlloc
FreeLibrary
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW

Exports

Exports

fnBWTControl

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/NpHttpsLib.dll
.dll windows:5 windows x86 arch:x86

3a841189ccd143ddc7a404c891883888

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:e0:11:65:24:ca:28:d5:b3:34:2b:3f:88:2d:bf:5c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/06/2022, 00:00

Not After

22/06/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:a9:f1:4f:e8:8b:6c:13:65:7f:ed:4b:26:97:d7:8e:ae:35:ec:36:aa:7b:97:ac:96:91:eb:2a:e9:15:f0:53
Signer

Actual PE Digest

0d:a9:f1:4f:e8:8b:6c:13:65:7f:ed:4b:26:97:d7:8e:ae:35:ec:36:aa:7b:97:ac:96:91:eb:2a:e9:15:f0:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpHttpsLibStatic_Ex\Win32\NpHttpsLib.pdb

Imports

advapi32

CryptGenRandom
CryptAcquireContextW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
CryptReleaseContext

crypt32

CertCloseStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext

ws2_32

htonl
closesocket
send
__WSAFDIsSet
select
listen
accept
freeaddrinfo
sendto
WSASetLastError
connect
socket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
getaddrinfo
ioctlsocket
gethostname
WSAIoctl
recv
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
recvfrom

wldap32

ord133
ord147
ord127
ord142
ord79
ord26
ord301
ord27
ord41
ord46
ord216
ord208
ord145
ord219
ord14
ord117
ord167

kernel32

GetCurrentDirectoryW
GetFullPathNameA
GetFullPathNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
GetDriveTypeW
FindFirstFileExW
GetTimeFormatA
GetDateFormatA
GetDriveTypeA
GetProcessHeap
FindFirstFileExA
CancelIo
GetOverlappedResult
CreateFileA
WaitNamedPipeA
SetHandleInformation
CreateEventA
CreateFileMappingA
SystemTimeToFileTime
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetModuleHandleExW
InterlockedExchangeAdd
InterlockedCompareExchange
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CloseHandle
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTime
FindFirstFileW
MoveFileExW
GetCurrentProcess
CreateDirectoryW
GetFileAttributesW
FindClose
FindNextFileW
DeleteFileW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetLastError
LCMapStringW
RaiseException
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetStringTypeW
GetTimeZoneInformation
RtlUnwind
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
GetSystemDirectoryW
QueryPerformanceFrequency
SleepEx
PeekNamedPipe
WaitForMultipleObjects
FormatMessageW
GetEnvironmentVariableA
CompareFileTime
DeleteFileA

bcrypt

BCryptGenRandom

user32

GetProcessWindowStation
MessageBoxW
FindWindowA
SendMessageA
GetUserObjectInformationW

Exports

Exports

fnCloseFTPList
fnCloseFtp
fnCloseHttps
fnCloseUidList
fnCreateDirectoryFtp
fnCreateFTPList
fnCreateUidList
fnDeleteDirectoryFtp
fnDeleteFileFtp
fnDeletePOP3Mail
fnGetBuffer
fnGetBufferData
fnGetBufferDataSize
fnGetCurlCode
fnGetFileFtp
fnGetFileListFtp
fnGetPOP3Mail
fnGetPOP3MailHdr
fnGetPOP3UIDList
fnIsFTPFileExist
fnOpenFtp
fnOpenHttps
fnPerform
fnPutFileFtp
fnPutFileRenameFtp
fnSendSmtpMail
fnSetCABundlePath
fnSetCipherList
fnSetConnectionClose
fnSetEnableRedirect
fnSetFTPPerm
fnSetHttpDownloadFile
fnSetHttpHeader
fnSetHttpTypeGet
fnSetHttpTypePost
fnSetHttpTypePostRaw
fnSetProxy
fnSetSFTPKeyFile
fnSetSSLVerifyPear
fnSetTimeoutMilliSec
fnSetUserAgent

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TYAVPU_000.bin
$COMMONFILES/nProtect Shared/Engine/TYAVP_001.bin
$COMMONFILES/nProtect Shared/Engine/TYAVSU_000.bin
$COMMONFILES/nProtect Shared/Engine/TeCtrl.dll
.dll windows:4 windows x86 arch:x86

4e311b2f179b73c588ae48280c8f522f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:e0:83:12:1b:01:64:a2:c5:87:64:5b:f5:7f:21:4a:c5:17:c5:7f:e2:d9:73:06:93:8f:a9:2b:ec:c6:c7:43
Signer

Actual PE Digest

84:e0:83:12:1b:01:64:a2:c5:87:64:5b:f5:7f:21:4a:c5:17:c5:7f:e2:d9:73:06:93:8f:a9:2b:ec:c6:c7:43

Digest Algorithm

sha256

PE Digest Matches

true

d4:3e:f8:54:2d:e4:f6:4f:20:3d:c3:9f:77:70:c3:fc:32:70:a3:88
Signer

Actual PE Digest

d4:3e:f8:54:2d:e4:f6:4f:20:3d:c3:9f:77:70:c3:fc:32:70:a3:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrl.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
GetModuleHandleA
OpenProcess
UnmapViewOfFile
QueryDosDeviceA
GetLogicalDriveStringsA
MapViewOfFile
CreateFileMappingA
TerminateThread
CreateThread
DuplicateHandle
LocalFree
LocalAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
SetEvent
InterlockedExchange
GetVersion
CreateMutexA
OpenMutexA
GlobalMemoryStatus
RemoveDirectoryA
FindClose
FindNextFileA
SetFileAttributesA
FindFirstFileA
CreateDirectoryA
GetTempPathA
Sleep
InitializeCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
GetModuleFileNameA
DeleteCriticalSection
CreateEventA
GetTickCount
GetCurrentProcess
lstrlenW
CompareStringA
CompareStringW
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
OutputDebugStringA
OutputDebugStringW
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
ResetEvent
ExpandEnvironmentStringsA
GetWindowsDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetConsoleOutputCP
WriteConsoleA
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetConsoleCtrlHandler
GetVersionExA
GetFileAttributesA
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetLastError
GlobalAlloc
SetLastError
GlobalFree
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetThreadLocale
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
CreateFileA
GetFileSize
ReadFile
TlsFree
CloseHandle
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
ExitProcess
WriteFile
GetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

wsprintfA
CharUpperW
CharLowerW
CharLowerA
CharUpperA
UnregisterClassA

advapi32

RegEnumKeyExA
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
AdjustTokenPrivileges
RegQueryInfoKeyA

shell32

SHGetFolderPathA

shlwapi

PathFindExtensionA
PathIsRelativeA

imagehlp

UnMapAndLoad
MapAndLoad

wintrust

WinVerifyTrust

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringA
CryptQueryObject

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureEx
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeEnableBWTV2
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryCureEx
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpeNewInstanceVersionEx
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetBWTCallBackEx
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TeCtrlu.dll
.dll windows:4 windows x86 arch:x86

282f3d67fc3d291640aecf724ae13725

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:9e:f8:26:94:7d:19:10:0d:0a:2a:2d:da:c2:bd:f8
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/01/2020, 00:00

Not After

03/02/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:a8:b6:54:dd:92:a8:dd:78:f7:ac:67:b4:09:de:61
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/07/2019, 00:00

Not After

13/07/2020, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

91:2b:47:0f:a3:51:8a:60:de:b0:11:f1:6f:cb:fe:75:96:30:80:54:8e:28:2c:fd:f6:da:25:56:6b:57:ef:42
Signer

Actual PE Digest

91:2b:47:0f:a3:51:8a:60:de:b0:11:f1:6f:cb:fe:75:96:30:80:54:8e:28:2c:fd:f6:da:25:56:6b:57:ef:42

Digest Algorithm

sha256

PE Digest Matches

true

28:1d:fa:5f:c3:1c:33:b3:fe:88:f3:d0:d1:b2:4e:9d:25:1e:26:ac
Signer

Actual PE Digest

28:1d:fa:5f:c3:1c:33:b3:fe:88:f3:d0:d1:b2:4e:9d:25:1e:26:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrlu.pdb

Imports

kernel32

GetCurrentProcess
UnmapViewOfFile
QueryDosDeviceW
GetLogicalDriveStringsW
MapViewOfFile
CreateFileMappingW
WaitForSingleObject
CreateRemoteThread
GetModuleHandleW
OpenProcess
TerminateThread
CreateThread
DuplicateHandle
lstrcpynW
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameW
CreateMutexW
OpenMutexW
DeleteCriticalSection
InitializeCriticalSection
GlobalMemoryStatus
CreateDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetTempPathW
CreateEventW
GetTickCount
GetVersionExW
TlsFree
TlsAlloc
lstrlenW
TlsSetValue
TlsGetValue
OutputDebugStringW
ResetEvent
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
ExitProcess
GetModuleFileNameA
lstrlenA
GetThreadLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
GlobalAlloc
SetLastError
CloseHandle
GlobalFree
CreateFileA
GetLastError
LoadLibraryW
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
GetSystemDirectoryW
GetProcAddress
FreeLibrary
CreateFileW
GetFileSize
ReadFile
WideCharToMultiByte
Sleep
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
WriteFile
GetStdHandle
LCMapStringA
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler

user32

GetActiveWindow
UnregisterClassA
MessageBoxA
wsprintfW

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges

shell32

SHGetFolderPathW

shlwapi

PathIsRelativeW
PathFindExtensionW

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringW

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureEx
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeDisableSkipScript
NpeEnableBWT
NpeEnableBWTEx
NpeEnableBWTV2
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryCureEx
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpeNewInstanceVersionEx
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetBWTCallBackEx
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 400KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/TySUtilu.dll
.dll windows:4 windows x86 arch:x86

a008632a5ab1b5de784efb061bb8f8e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/12/2011, 00:00

Not After

06/12/2012, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14
Signer

Actual PE Digest

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\TyScan\Sym\Release\TySUtilu.pdb

Imports

kernel32

CreateFileMappingW
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
MapViewOfFile
GetFileSize
WriteFile
SetLastError
SetFilePointer
ReadFile
GetLocalTime
UnmapViewOfFile
CloseHandle
GetFileAttributesW
CreateDirectoryW
GetLastError
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

Exports

Exports

TBP_Close_File
TBP_Delete_From_Repository
TBP_Get_Object_Count
TBP_Get_Size_Of_Repository
TBP_Insert_Object_File
TBP_Insert_Object_Reg_Key
TBP_Insert_Object_Reg_Value
TBP_Is_Repository_Capable
TBP_Make_Category
TBP_Open_File
TBP_Read_Category
TBP_Read_Object
TBP_Restore_All_Object
TBP_Restore_Object
TBP_Restore_ObjectEx
TBP_Traverse_Repository

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/teexcept.dat
$COMMONFILES/nProtect Shared/Engine/tyav32u.dll
.dll windows:4 windows x86 arch:x86

0b1edb4b9c71aae343a81e21581d3bbe

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:e0:11:65:24:ca:28:d5:b3:34:2b:3f:88:2d:bf:5c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/06/2022, 00:00

Not After

22/06/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:6e:b7:a9:ec:cb:78:42:bd:68:2a:c7:56:c0:d9:0c:bb:cb:63:d1:0c:79:4c:04:a4:9b:b9:c6:5a:87:e4:c7
Signer

Actual PE Digest

5b:6e:b7:a9:ec:cb:78:42:bd:68:2a:c7:56:c0:d9:0c:bb:cb:63:d1:0c:79:4c:04:a4:9b:b9:c6:5a:87:e4:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
Module32NextW
Module32FirstW
Sleep
TerminateProcess
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
WaitForSingleObject
GetWindowsDirectoryW
MultiByteToWideChar
FindNextFileW
MoveFileW
GetLogicalDriveStringsW
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
SuspendThread
OpenThread
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
ResumeThread
VirtualProtectEx
GetThreadContext
GetCurrentProcess
VirtualQuery
OpenEventW
LoadLibraryA
GetSystemDirectoryA
OutputDebugStringW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetLocalTime
WriteConsoleW
GetFileAttributesW
OutputDebugStringA
FormatMessageW
GetSystemInfo
CreateFileA
SetFileTime
GetFileTime
FindFirstFileA
WritePrivateProfileStringW
MoveFileExW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
CreateEventW
QueryDosDeviceW
TerminateThread
CreateThread
DuplicateHandle
CreateRemoteThread
LocalFree
GetLogicalDrives
GetSystemDirectoryW
SetLastError
SetEvent
VirtualFree
VirtualAlloc
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetLongPathNameW
LeaveCriticalSection
EnterCriticalSection
OpenMutexW
CreateMutexW
OpenFileMappingW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetFileSize
SetEndOfFile
GetShortPathNameW
FindFirstFileW
FindClose
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
Process32FirstW
Process32NextW
OpenProcess
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTickCount
CopyFileW
GetLastError
WideCharToMultiByte
WriteFile
SetFilePointer
ReadFile
GetVersionExW
GetDriveTypeW
CreateFileW
CloseHandle
GetStdHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
RaiseException
SetConsoleCtrlHandler
GetOEMCP
GetACP
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetStdHandle
GetStartupInfoA
SetHandleCount
GlobalFree
GlobalAlloc
VirtualProtect
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
RtlUnwind
ExitProcess
GetFileType
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
TlsAlloc
TlsFree
DeleteFileA

advapi32

RegOpenKeyExW
IsTextUnicode
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetUserNameW
LookupAccountNameW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
GetTokenInformation
LookupAccountSidW
RegEnumKeyW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
FreeSid
SetSecurityDescriptorDacl
SetFileSecurityW
OpenThreadToken
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyW
OpenProcessToken
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW

ws2_32

WSCDeinstallProvider
WSCEnumProtocols
WSCInstallProvider
WSCGetProviderPath
WSACleanup

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

sfc

ord5

shlwapi

PathRemoveFileSpecW

imagehlp

MapFileAndCheckSumW

netapi32

NetLocalGroupAddMembers
NetUserGetLocalGroups
NetApiBufferFree

userenv

ExpandEnvironmentStringsForUserW

Exports

Exports

RecoverInlineHooking
TYAVSmartCure
TYAVSmartScan
TYAutoScanMemory
TYCheckBootVirus
TYCheckExceptList
TYCheckFile
TYCheckFileEx
TYCheckFileExW
TYCoreCheckBootVirus
TYCoreCheckFileCBCureEx
TYCoreCheckFileEx
TYCoreCheckFileExW
TYCoreGetEngineDateW
TYCoreInitEngine
TYCoreRecoveryBootVirus
TYCoreRecoveryFile
TYCoreRecoveryFileW
TYCoreSetOption
TYCoreSetReportCallBack
TYCoreUnInitEngine
TYCreateCache
TYCureMemory
TYCureProcess
TYDelInstance
TYDisablePattern
TYDisableSkipScript
TYEnableNetworkScan
TYFlushBWTCache
TYGetBWTVer
TYGetBWTVerEx
TYGetBootInfo
TYGetEngineDate
TYGetEngineDateW
TYGetFileCRC
TYGetFileCRCEX
TYGetFileCRCEX2
TYGetFilePosCRC
TYGetPatternNum
TYInitEngine
TYListFile
TYListFileCRC
TYNewInstance
TYRecoveryBootVirus
TYRecoveryFile
TYRecoveryFileW
TYScanMemory
TYScanProcess
TYSetLiveUpdate
TYSetLoadLibDir
TYSetOption
TYSetServerSideScriptScan
TYSetTkDrvLoadLibDir
TYSetUPExtractPolicy
TYSetYaraEnable
TYStopNetworkScan
TYUnInitEngine

Sections

.text
Size: 868KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 672KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/tyavcuremap.dat
$COMMONFILES/nProtect Shared/Engine/tyavexcept.bin
.dll windows:4 windows x86 arch:x86

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/nProtect Shared/Engine/tyavexcept.dat
$PLUGINSDIR/GetVersion.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsServicePackMajor
WindowsServicePackMinor
WindowsType
WindowsVersion

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/npPb.dll
.dll windows:4 windows x86 arch:x86

00db911b28a8cd6b64fe48e8520f85bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f
Signer

Actual PE Digest

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f

Digest Algorithm

sha256

PE Digest Matches

true

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc
Signer

Actual PE Digest

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nppb\release\nppb.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/npcf_win_32u.dll
.dll windows:5 windows x86 arch:x86

208abebe9e49ddc3d981d2f38dcadd87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd
Signer

Actual PE Digest

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd

Digest Algorithm

sha256

PE Digest Matches

true

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e
Signer

Actual PE Digest

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\INCA\Project\SVN\DevGroup\dev-crt\nProtect_Crypto_재인증_20180912\05.암호모듈_소스\Windows\dll\bin\Release\np_cu_f.pdb

Imports

kernel32

FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
GetModuleHandleA
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
GetSystemTime
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingA
GetCurrentProcess
TerminateThread
Sleep
CreateThread
IsProcessorFeaturePresent
GetStringTypeW
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapReAlloc
LCMapStringW

user32

FindWindowA
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/npeNSISUtil.dll
.dll windows:4 windows x86 arch:x86

b189c78d4f325e9f274c93b357e58328

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d8:1f:b6:ae:d0:e1:7c:88:e2:a5:89:09:eb:72:69
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/10/2021, 00:00

Not After

10/10/2022, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:9e:25:7c:30:ad:1f:06:aa:31:45:64:58:6c:6d:51:7c:9f:c9:14:b4:1f:79:e4:0f:fa:aa:e7:10:cf:bc:1f
Signer

Actual PE Digest

8c:9e:25:7c:30:ad:1f:06:aa:31:45:64:58:6c:6d:51:7c:9f:c9:14:b4:1f:79:e4:0f:fa:aa:e7:10:cf:bc:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npeNSISUtil\build\bin\release\npeNSISUtil.pdb

Imports

kernel32

GetSystemInfo
lstrcmpiW
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
Sleep
GetTickCount
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
GlobalAlloc
CloseHandle
lstrcpynW
ReadFile
TerminateThread
CreateProcessW
lstrcpyW
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
VirtualQuery
OutputDebugStringW
FormatMessageW
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetModuleHandleA
GetCurrentProcess
GetSystemWow64DirectoryW
CreateMutexW
ReleaseMutex
LocalFree
LocalAlloc
CreateFileW
GetFileSize
WriteFile
SetFilePointer
MoveFileW
CreatePipe
DeleteFileW
FindFirstFileW
FindClose
GetFileAttributesW
SetFileAttributesW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
GetCurrentProcessId
TerminateProcess
GetLocaleInfoW
EnumUILanguagesW
GetUserDefaultLCID
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpiA
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
GetStartupInfoA
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GlobalFree
CreateThread
OpenMutexW
GetSystemDirectoryW
GetLastError
FreeLibrary
GetProcAddress
SetLastError
LoadLibraryW

user32

PostMessageW
FindWindowW
GetSystemMetrics
IsWindowVisible
GetWindowTextLengthW
GetWindow
GetWindowLongW
GetWindowThreadProcessId
MessageBoxW

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyW
RegQueryInfoKeyW
RegEnumValueW
GetLengthSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
OpenSCManagerW
GetUserNameW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
CreateProcessAsUserW
GetSidIdentifierAuthority
LookupAccountSidW
IsValidSid
QueryServiceStatus
DeleteService
ControlService
RegOpenKeyExW
RegQueryValueExW
EnumDependentServicesW
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
CloseServiceHandle
SetKernelObjectSecurity
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
GetKernelObjectSecurity

shell32

ShellExecuteW
SHGetFolderPathW

shlwapi

PathFileExistsW
PathIsDirectoryW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

crypt32

CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext

ws2_32

gethostbyname
WSAStartup
WSACleanup
inet_ntoa

iphlpapi

GetAdaptersInfo
GetNetworkParams

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetGetJoinInformation
NetLocalGroupGetMembers

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock

ole32

CoTaskMemFree

Exports

Exports

Execute
FindDevice
FindProcess
KillProcess
KillProcessByMsg
addCertMS
browserKill
compareVersion
compareVersionList
createService
deleteService
executeIExplore
executeIExploreX64
getIPByHostName
getLanguage
getLoginUserSHFolderPath
getModuleList
getOSBitType
getOption
getPendingRegFindValue
getSHA1FromFile
getSHA2FromFile
getUserAppDataLowPathCanBeElevatedByUAC
is64Bit
isARM64Bit
isEualsGWIPAndDNSIP
isExistCertFF
isExistCertFF2nd
isExistCertMS
isLoadDrv
isModuleLoadBrowser
isTilonPc
isVistaOrLater
killProcessName
load
openMutex
setNPN55UpdateVer
setWindowsFirewallAllowed
startService
stopService
unload
verifyINCASign
verifyINCAVerisignSubjectName
verifyVerisign

Sections

.text
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npPb.dll
.dll windows:4 windows x86 arch:x86

00db911b28a8cd6b64fe48e8520f85bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f
Signer

Actual PE Digest

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f

Digest Algorithm

sha256

PE Digest Matches

true

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc
Signer

Actual PE Digest

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nppb\release\nppb.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/INCAInternet UnInstall/nProtect Online Security/npcf_win_32u.dll
.dll windows:5 windows x86 arch:x86

208abebe9e49ddc3d981d2f38dcadd87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd
Signer

Actual PE Digest

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd

Digest Algorithm

sha256

PE Digest Matches

true

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e
Signer

Actual PE Digest

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\INCA\Project\SVN\DevGroup\dev-crt\nProtect_Crypto_재인증_20180912\05.암호모듈_소스\Windows\dll\bin\Release\np_cu_f.pdb

Imports

kernel32

FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
GetModuleHandleA
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
GetSystemTime
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingA
GetCurrentProcess
TerminateThread
Sleep
CreateThread
IsProcessorFeaturePresent
GetStringTypeW
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapReAlloc
LCMapStringW

user32

FindWindowA
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKIdsVt.sys
.sys windows:6 windows x86 arch:x86

8331d5998c10571b3beb9e3476ddc75b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\project\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\i386\TKIdsVt.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
IoQueueWorkItem
IoAllocateWorkItem
IoFreeWorkItem
strncmp
strncpy
KeReleaseMutex
KeWaitForSingleObject
islower
DbgBreakPoint
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
PsLookupProcessByProcessId
KeTickCount
KeBugCheckEx
RtlUnwind
PsGetCurrentProcessId
KeInitializeEvent
KeInitializeMutex
DbgPrint
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
memchr
IoGetCurrentProcess
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_strnicmp
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
memcpy
MmMapLockedPagesSpecifyCache
KeReadStateEvent
KeSetEvent
ZwUnloadDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
ExFreePoolWithTag
memset
ExAllocatePoolWithTag
RtlCopyUnicodeString

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpmEngineClose0
FwpsInjectNetworkSendAsync0
FwpsFreeCloneNetBufferList0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpsCalloutRegister0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKIdsVt64.sys
.sys windows:6 windows x64 arch:x64

140fce8178f0e46bd287d5f8849654be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\project\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\amd64\TKIdsVt64.pdb

Imports

ntoskrnl.exe

memchr
DbgPrint
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
strncmp
KeReleaseMutex
strncpy
KeWaitForSingleObject
DbgBreakPoint
islower
IoBuildDeviceIoControlRequest
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
PsLookupProcessByProcessId
KeBugCheckEx
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
_strnicmp
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
IoGetCurrentProcess
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
RtlCopyUnicodeString
IoCreateSymbolicLink
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeReleaseSpinLock
IoIs32bitProcess
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReadStateEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
ExAllocatePoolWithTag
MmUnmapLockedPages
__C_specific_handler

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectNetworkSendAsync0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpsCalloutRegister0
FwpmTransactionCommit0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineClose0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpsFreeCloneNetBufferList0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpsCalloutUnregisterById0

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKNetCfg64.exe
$SYSDIR/TKTool2k.sys
.sys windows:6 windows x86 arch:x86

d9a12bd346b9522bd63c7d74b98a85b2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/11/2012, 00:00

Not After

28/12/2013, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95
Signer

Actual PE Digest

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\i386\TKTool2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoRegisterShutdownNotification
IoRegisterPlugPlayNotification
memcpy
RtlCopyUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
memset
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwOpenKey
KeTickCount
DbgPrint
RtlAnsiCharToUnicodeChar
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
IoDeleteSymbolicLink
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwDeleteValueKey
RtlUnwind
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/TKTool2k64.sys
.sys windows:6 windows x64 arch:x64

2ca3150ee7102c46d43e4d7e618f906b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/11/2012, 00:00

Not After

28/12/2013, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36
Signer

Actual PE Digest

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\amd64\TKTool2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
RtlInitUnicodeString
IoDeleteDevice
ZwUnloadDriver
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwClose
ZwQueryInformationFile
ZwOpenKey
KeBugCheckEx
DbgPrint
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySymbolicLinkObject
ZwDeleteValueKey
ZwOpenSymbolicLinkObject
ZwQueryValueKey
IofCompleteRequest
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noska.sys
.sys windows:6 windows x86 arch:x86

848f63553a9a79bfa946f6e3fd4cc6d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxa\npkakl\npkfxa\objfre\i386\noska.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
RtlUpcaseUnicodeStringToOemString
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
MmIsAddressValid
ObQueryNameString
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlFreeOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noskp.sys
.sys windows:6 windows x86 arch:x86

3e0386df9884d55ec70a30793a2d0b94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\i386\noskp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
memcpy
rand
srand
KeInsertQueue
IofCompleteRequest
KeRemoveQueue
KeReadStateQueue
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
KeInitializeQueue
KeRundownQueue
KeBugCheck
ObfReferenceObject
IoCreateNotificationEvent
RtlInitUnicodeString
ObReferenceObjectByHandle
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
ExDeleteNPagedLookasideList
ZwClose
PsCreateSystemThread
KeInitializeMutex
ExFreePoolWithTag
KeInitializeDpc
IoCreateSymbolicLink
IoCreateDevice
KeInsertQueueDpc
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoDriverObjectType
ObReferenceObjectByName
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
ExAllocatePool
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
memset
PsGetVersion
ExInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
HalGetInterruptVector

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 818B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/noskp64.sys
.sys windows:6 windows x64 arch:x64

d960af87a6417c1a1024d41a28a81713

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\amd64\noskp64.pdb

Imports

ntoskrnl.exe

KeRemoveQueue
IoDeleteSymbolicLink
ExFreePoolWithTag
IoCreateNotificationEvent
KeInitializeMutex
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeDpc
ExpInterlockedPopEntrySList
KeReleaseMutex
PsCreateSystemThread
rand
ExEventObjectType
ZwClose
srand
KeBugCheck
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
KeInitializeQueue
PsGetVersion
ObfReferenceObject
ExAllocatePoolWithTag
IoCreateDevice
ExDeleteNPagedLookasideList
KeInsertQueue
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeReleaseSpinLock
IoDriverObjectType
IoGetDeviceObjectPointer
KeInsertQueueDpc
ObfDereferenceObject
ObReferenceObjectByName
IofCallDriver
KeAcquireSpinLockRaiseToDpc
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
RtlFreeUnicodeString
ZwUnmapViewOfSection
ExAllocatePool
ZwCreateSection
ZwOpenFile
KeBugCheckEx
IoCreateSymbolicLink
KeReadStateQueue

hal

KeQueryPerformanceCounter

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/nosku.sys
.sys windows:6 windows x86 arch:x86

1ea8c2e6c9edb3fe0bf59d5eb22ef720

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\i386\nosku.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
IoReleaseRemoveLockEx
IofCallDriver
IoAcquireRemoveLockEx
KeRemoveQueue
KeReadStateQueue
KeSetEvent
KeInitializeQueue
KeRundownQueue
ObfReferenceObject
IoCreateNotificationEvent
ObReferenceObjectByHandle
ExEventObjectType
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExAllocatePool
RtlCompareMemory
memcpy
IoDetachDevice
KeInsertQueue
PoStartNextPowerIrp
IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
PsGetVersion
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExfInterlockedInsertHeadList
DbgPrint
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwQuerySystemInformation
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
_vsnprintf
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByName
IoDriverObjectType
MmIsAddressValid
KeTickCount
KeBugCheckEx
srand
rand
ExAllocatePoolWithTag
ExFreePoolWithTag
memset
ExInterlockedPushEntrySList
PoCallDriver
ExInterlockedPopEntrySList
RtlUnwind

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter

usbd.sys

_USBD_ParseConfigurationDescriptorEx@28

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/nosku64.sys
.sys windows:6 windows x64 arch:x64

ec39ad5d8bda55614b3c9c35201693c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\amd64\nosku64.pdb

Imports

ntoskrnl.exe

IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
IoCreateNotificationEvent
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
ExpInterlockedPopEntrySList
IoDetachDevice
ExAllocatePool
rand
ExEventObjectType
PoStartNextPowerIrp
srand
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
KeInitializeQueue
PoCallDriver
PsGetVersion
KeRemoveQueue
ObfReferenceObject
IoCreateSymbolicLink
IoInitializeRemoveLockEx
IoCreateDevice
ExDeleteNPagedLookasideList
IofCallDriver
KeInsertQueue
KeAcquireSpinLockRaiseToDpc
ExInterlockedInsertHeadList
DbgPrint
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
RtlFreeUnicodeString
ZwUnmapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlUnicodeStringToAnsiString
IoDriverObjectType
_vsnprintf
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
KeBugCheckEx
IoAcquireRemoveLockEx
ExAllocatePoolWithTag
RtlCompareMemory
KeReadStateQueue
_local_unwind
RtlUnwindEx

hal

KeQueryPerformanceCounter

usbd.sys

USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/np_ck32s.sys
.sys windows:6 windows x86 arch:x86

42b4bd40fdd480615a488ee2a1f82a1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\dev-crt_cur\nprotect_crypto_재인증_20180912\05.암호모듈_소스\windows\sys\bin\Release\i386\np_ck32s.pdb

Imports

ntoskrnl.exe

MmIsAddressValid
memset
ZwQuerySystemInformation
ZwClose
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
KeDelayExecutionThread
KdDebuggerEnabled
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
PsCreateSystemThread
ExAllocatePoolWithTag
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
memcpy
RtlRandom
KeTickCount
KeQuerySystemTime
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
DbgPrint
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

_NpDecPK@32
_NpDecSymk@28
_NpDestroy@4
_NpEncPK@32
_NpEncSymk@28
_NpGetInfo@8
_NpGetState@8
_NpHMAC@32
_NpHash@24
_NpInit@4
_NpPKGen@16
_NpRandom@12
_NpSKGen@12
_NpSelfTest@4
_NpSignPK@24
_NpVerifyPK@24

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 896B - Virtual size: 818B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/np_ck64s.sys
.sys windows:6 windows x64 arch:x64

e2cb6be3e814f248b538f342e408382c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\dev-crt_cur\nprotect_crypto_재인증_20180912\05.암호모듈_소스\windows\sys\bin\Release_x64\amd64\np_ck64s.pdb

Imports

ntoskrnl.exe

RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
PsCreateSystemThread
KdDebuggerEnabled
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
MmIsAddressValid
ExFreePoolWithTag
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
DbgPrint
RtlRandom
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
ObfDereferenceObject
ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

NpDecPK
NpDecSymk
NpDestroy
NpEncPK
NpEncSymk
NpGetInfo
NpGetState
NpHMAC
NpHash
NpInit
NpPKGen
NpRandom
NpSKGen
NpSelfTest
NpSignPK
NpVerifyPK

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 357B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/npkakl.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/11/2014, 00:00

Not After

10/11/2015, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f
Signer

Actual PE Digest

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkeycrypt\drivers\5.0\nt\npkakl\npkakl\objfre\i386\npkakl.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/npkfxa.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/11/2014, 00:00

Not After

10/11/2015, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a
Signer

Actual PE Digest

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkfx65\sys\npkfxa\npkakl\npkfxa\objfre\i386\npkfxa.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/tkfwvt.sys
.sys windows:6 windows x86 arch:x86

693fb0fcbb8287796e5bc1a0bb41d9ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\project\nos-d\engdev_0801_tkfw\trunk\2.0\bin\free\i386\tkfwvt.pdb

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsCreateSystemThread
PsGetCurrentThreadId
KeClearEvent
PsLookupProcessByProcessId
KeBugCheckEx
RtlUnwind
ZwOpenKey
ZwQueryValueKey
strncpy
KeQuerySystemTime
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ExAllocatePoolWithTag
RtlCompareMemory
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoRegisterShutdownNotification
ZwClose
MmIsAddressValid
KeReleaseMutex
DbgBreakPoint
memchr
_allmul
_alldiv
KeTickCount
KeQueryTimeIncrement
DbgPrint
_strnicmp
PsGetVersion
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeMutex
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInitializeEvent
PsGetCurrentProcessId
KeReadStateEvent
ZwUnloadDriver
memcpy
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeDelayExecutionThread
KeSetEvent
KeWaitForSingleObject
ObfDereferenceObject
memset
RtlCopyUnicodeString
ObQueryNameString
IoGetCurrentProcess
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnicodeToMultiByteN

hal

KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFSendNetBufferListsComplete
NdisFSendNetBufferLists

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpmEngineClose0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsCalloutRegister0
FwpsFreeCloneNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleCreate0

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$WINDIR/System32/TKCtrl2k64.sys
$WINDIR/System32/TKFWFV.inf
$WINDIR/System32/TKFWFV64.sys
$WINDIR/System32/TKFWVT64.sys
$WINDIR/System32/TKFsAv64.sys
$WINDIR/System32/TKFsFt64.sys
$WINDIR/System32/TKIdsVt64.sys
$WINDIR/System32/TKNetCfg64.exe
$WINDIR/System32/TKRgAc2k64.sys
$WINDIR/System32/TKRgFtXp64.sys
$WINDIR/System32/TKSPXP64.sys
$WINDIR/System32/TKToolU.dll
.dll windows:4 windows x86 arch:x86

224251205182372c8d4f973e64b69a78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea
Signer

Actual PE Digest

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea

Digest Algorithm

sha256

PE Digest Matches

true

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c
Signer

Actual PE Digest

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\project\nos-d\engdev_0607_tktool\trunk\1.0\dll\tktool\x86\releaseu\TKToolU.pdb

Imports

kernel32

SetLastError
GetTickCount
GetVolumeNameForVolumeMountPointW
FreeLibrary
GetCurrentProcess
GetSystemInfo
GetVersionExW
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
Sleep
CreateFileA
IsBadWritePtr
IsBadReadPtr
WriteFile
GetFileAttributesW
GetVolumeInformationW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetVersion
GetDriveTypeW
CloseHandle
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FormatMessageW
LocalFree
CreateFileW
GetSystemDirectoryW
GetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

IsCharUpperW
MessageBoxW
PostQuitMessage
IsCharAlphaW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenSCManagerW

Exports

Exports

TKToolClose
TKToolDrvFClose
TKToolDrvFindClose
TKToolDrvFindFirstFile
TKToolDrvFindFirstFileEx
TKToolDrvFindNextFile
TKToolDrvFopen
TKToolDrvFopenEx
TKToolDrvFread
TKToolDrvFseek
TKToolDrvFwrite
TKToolDrvGetFileSize
TKToolDrvGetFileSizeEx
TKToolEnumHiddenProcesses
TKToolEnumKernelModeHiddenProcesses
TKToolEnumProcesses
TKToolEnumProcessesEx
TKToolEnumUserModeHiddenProcesses
TKToolFindClose
TKToolFindFirstFile
TKToolFindNextFile
TKToolGetDllVersion
TKToolGetDrvVersion
TKToolInit
TKToolInitCharacterSet
TKToolLoadAtStartUp
TKToolLoadDriver
TKToolLoadDriverEx
TKToolMoveFileAfterReboot
TKToolRcvDeleteFile
TKToolRcvGetModNameFromAddr
TKToolRcvRecoverSdt
TKToolRebootCure
TKToolRecoverKernelModeHiddenProcess
TKToolRemvStoreFinal
TKToolSetCurPathForImagePath
TKToolTerminateProcess
TKToolTerminateThread
TKToolUnloadDriver

Sections

.text
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$WINDIR/System32/TkPcFtCb64.sys
7z.dll
.dll windows:4 windows x86 arch:x86

6121a49841bf6f5b3700c1ebbb28be41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CharPrevExA
CharPrevA
CharNextA
CharLowerW
CharLowerA
CharUpperW
CharUpperA

oleaut32

SysFreeString
SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocString

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
strcmp
memset
memcmp
_purecall
memmove
memcpy
__CxxFrameHandler
free
_CxxThrowException
malloc

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
CreateEventA
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FileTimeToLocalFileTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetVersionExA
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleA
GetProcAddress
GetSystemInfo
CompareFileTime
WriteFile
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
SetFileAttributesA
DeleteFileA
GetTempPathA
GetTempFileNameA
CreateFileA

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/armx64/TKCtrl2k64.sys
coredll/armx64/TKFWFV.inf
coredll/armx64/TKFWFV64.sys
coredll/armx64/TKFWVT64.sys
coredll/armx64/TKFsAv64.sys
coredll/armx64/TKFsFt64.sys
coredll/armx64/TKIdsVt64.sys
coredll/armx64/TKNetCfg64.exe
coredll/armx64/TKRgAc2k64.sys
coredll/armx64/TKRgFtXp64.sys
coredll/armx64/TKSPXP64.sys
coredll/armx64/TKToolU.dll
.dll windows:4 windows x86 arch:x86

224251205182372c8d4f973e64b69a78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea
Signer

Actual PE Digest

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea

Digest Algorithm

sha256

PE Digest Matches

true

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c
Signer

Actual PE Digest

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\project\nos-d\engdev_0607_tktool\trunk\1.0\dll\tktool\x86\releaseu\TKToolU.pdb

Imports

kernel32

SetLastError
GetTickCount
GetVolumeNameForVolumeMountPointW
FreeLibrary
GetCurrentProcess
GetSystemInfo
GetVersionExW
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
Sleep
CreateFileA
IsBadWritePtr
IsBadReadPtr
WriteFile
GetFileAttributesW
GetVolumeInformationW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetVersion
GetDriveTypeW
CloseHandle
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FormatMessageW
LocalFree
CreateFileW
GetSystemDirectoryW
GetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

IsCharUpperW
MessageBoxW
PostQuitMessage
IsCharAlphaW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenSCManagerW

Exports

Exports

TKToolClose
TKToolDrvFClose
TKToolDrvFindClose
TKToolDrvFindFirstFile
TKToolDrvFindFirstFileEx
TKToolDrvFindNextFile
TKToolDrvFopen
TKToolDrvFopenEx
TKToolDrvFread
TKToolDrvFseek
TKToolDrvFwrite
TKToolDrvGetFileSize
TKToolDrvGetFileSizeEx
TKToolEnumHiddenProcesses
TKToolEnumKernelModeHiddenProcesses
TKToolEnumProcesses
TKToolEnumProcessesEx
TKToolEnumUserModeHiddenProcesses
TKToolFindClose
TKToolFindFirstFile
TKToolFindNextFile
TKToolGetDllVersion
TKToolGetDrvVersion
TKToolInit
TKToolInitCharacterSet
TKToolLoadAtStartUp
TKToolLoadDriver
TKToolLoadDriverEx
TKToolMoveFileAfterReboot
TKToolRcvDeleteFile
TKToolRcvGetModNameFromAddr
TKToolRcvRecoverSdt
TKToolRebootCure
TKToolRecoverKernelModeHiddenProcess
TKToolRemvStoreFinal
TKToolSetCurPathForImagePath
TKToolTerminateProcess
TKToolTerminateThread
TKToolUnloadDriver

Sections

.text
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/armx64/TkPcFtCb64.sys
coredll/armx64/noske64.exe
coredll/armx64_dll/TKNetCfg64.exe
coredll/armx64_dll/TKToolU.dll
.dll windows:4 windows x86 arch:x86

224251205182372c8d4f973e64b69a78

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea
Signer

Actual PE Digest

24:8e:46:c0:6a:2d:45:e3:50:50:08:e6:be:50:f2:ce:8b:63:7f:ff:91:26:77:86:5c:24:d9:86:3a:8b:f3:ea

Digest Algorithm

sha256

PE Digest Matches

true

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c
Signer

Actual PE Digest

d6:c1:1c:07:cb:c5:be:c1:d0:33:b5:08:a0:5a:fc:63:9d:4a:e9:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\project\nos-d\engdev_0607_tktool\trunk\1.0\dll\tktool\x86\releaseu\TKToolU.pdb

Imports

kernel32

SetLastError
GetTickCount
GetVolumeNameForVolumeMountPointW
FreeLibrary
GetCurrentProcess
GetSystemInfo
GetVersionExW
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
Sleep
CreateFileA
IsBadWritePtr
IsBadReadPtr
WriteFile
GetFileAttributesW
GetVolumeInformationW
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetVersion
GetDriveTypeW
CloseHandle
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FormatMessageW
LocalFree
CreateFileW
GetSystemDirectoryW
GetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

IsCharUpperW
MessageBoxW
PostQuitMessage
IsCharAlphaW

advapi32

DeleteService
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
CreateServiceW
CloseServiceHandle
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
OpenSCManagerW

Exports

Exports

TKToolClose
TKToolDrvFClose
TKToolDrvFindClose
TKToolDrvFindFirstFile
TKToolDrvFindFirstFileEx
TKToolDrvFindNextFile
TKToolDrvFopen
TKToolDrvFopenEx
TKToolDrvFread
TKToolDrvFseek
TKToolDrvFwrite
TKToolDrvGetFileSize
TKToolDrvGetFileSizeEx
TKToolEnumHiddenProcesses
TKToolEnumKernelModeHiddenProcesses
TKToolEnumProcesses
TKToolEnumProcessesEx
TKToolEnumUserModeHiddenProcesses
TKToolFindClose
TKToolFindFirstFile
TKToolFindNextFile
TKToolGetDllVersion
TKToolGetDrvVersion
TKToolInit
TKToolInitCharacterSet
TKToolLoadAtStartUp
TKToolLoadDriver
TKToolLoadDriverEx
TKToolMoveFileAfterReboot
TKToolRcvDeleteFile
TKToolRcvGetModNameFromAddr
TKToolRcvRecoverSdt
TKToolRebootCure
TKToolRecoverKernelModeHiddenProcess
TKToolRemvStoreFinal
TKToolSetCurPathForImagePath
TKToolTerminateProcess
TKToolTerminateThread
TKToolUnloadDriver

Sections

.text
Size: 236KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x64/TKFWFV.inf
coredll/network/x64/TKIdsVt64.sys
.sys windows:6 windows x64 arch:x64

140fce8178f0e46bd287d5f8849654be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\project\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\amd64\TKIdsVt64.pdb

Imports

ntoskrnl.exe

memchr
DbgPrint
KeInitializeMutex
KeInitializeEvent
PsGetCurrentProcessId
ObfDereferenceObject
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
strncmp
KeReleaseMutex
strncpy
KeWaitForSingleObject
DbgBreakPoint
islower
IoBuildDeviceIoControlRequest
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
PsLookupProcessByProcessId
KeBugCheckEx
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExQueryDepthSList
ExDeleteNPagedLookasideList
_strnicmp
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeUnicodeString
IoGetCurrentProcess
KeAcquireSpinLockRaiseToDpc
IoAllocateMdl
IoCreateDevice
RtlCopyUnicodeString
IoCreateSymbolicLink
ObReferenceObjectByHandle
IofCompleteRequest
MmMapLockedPagesSpecifyCache
ZwUnloadDriver
IoFreeMdl
MmBuildMdlForNonPagedPool
KeReleaseSpinLock
IoIs32bitProcess
KeSetEvent
IoDeleteDevice
RtlInitUnicodeString
KeReadStateEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
ExAllocatePoolWithTag
MmUnmapLockedPages
__C_specific_handler

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectNetworkSendAsync0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpsCalloutRegister0
FwpmTransactionCommit0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineClose0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpsFreeCloneNetBufferList0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpsCalloutUnregisterById0

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKIdsVt.sys
.sys windows:6 windows x86 arch:x86

8331d5998c10571b3beb9e3476ddc75b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\project\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\i386\TKIdsVt.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
IoQueueWorkItem
IoAllocateWorkItem
IoFreeWorkItem
strncmp
strncpy
KeReleaseMutex
KeWaitForSingleObject
islower
DbgBreakPoint
PsSetCreateProcessNotifyRoutine
IoGetDeviceObjectPointer
IofCallDriver
IoBuildDeviceIoControlRequest
PsLookupProcessByProcessId
KeTickCount
KeBugCheckEx
RtlUnwind
PsGetCurrentProcessId
KeInitializeEvent
KeInitializeMutex
DbgPrint
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
memchr
IoGetCurrentProcess
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_strnicmp
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
memcpy
MmMapLockedPagesSpecifyCache
KeReadStateEvent
KeSetEvent
ZwUnloadDriver
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
ExFreePoolWithTag
memset
ExAllocatePoolWithTag
RtlCopyUnicodeString

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock

ndis.sys

NdisMSleep
NdisRetreatNetBufferDataStart
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpsQueryPacketInjectionState0
FwpmEngineClose0
FwpsInjectNetworkSendAsync0
FwpsFreeCloneNetBufferList0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpsInjectionHandleCreate0
FwpsCalloutRegister0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/network/x86/TKNetCfg64.exe
coredll/network/x86/tkfwvt.sys
.sys windows:6 windows x86 arch:x86

693fb0fcbb8287796e5bc1a0bb41d9ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\project\nos-d\engdev_0801_tkfw\trunk\2.0\bin\free\i386\tkfwvt.pdb

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsCreateSystemThread
PsGetCurrentThreadId
KeClearEvent
PsLookupProcessByProcessId
KeBugCheckEx
RtlUnwind
ZwOpenKey
ZwQueryValueKey
strncpy
KeQuerySystemTime
ExSystemTimeToLocalTime
RtlTimeToTimeFields
ExAllocatePoolWithTag
RtlCompareMemory
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetDeviceObjectPointer
PsSetCreateProcessNotifyRoutine
IoRegisterShutdownNotification
ZwClose
MmIsAddressValid
KeReleaseMutex
DbgBreakPoint
memchr
_allmul
_alldiv
KeTickCount
KeQueryTimeIncrement
DbgPrint
_strnicmp
PsGetVersion
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
KeInitializeMutex
ObReferenceObjectByHandle
MmUnmapLockedPages
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInitializeEvent
PsGetCurrentProcessId
KeReadStateEvent
ZwUnloadDriver
memcpy
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeDelayExecutionThread
KeSetEvent
KeWaitForSingleObject
ObfDereferenceObject
memset
RtlCopyUnicodeString
ObQueryNameString
IoGetCurrentProcess
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
RtlUnicodeToMultiByteN

hal

KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeMemory
NdisAllocateMemoryWithTag
NdisMSleep
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisFIndicateReceiveNetBufferLists
NdisFReturnNetBufferLists
NdisFSendNetBufferListsComplete
NdisFSendNetBufferLists

fwpkclnt.sys

FwpsInjectionHandleDestroy0
FwpmEngineClose0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineOpen0
FwpsCalloutUnregisterById0
FwpmFilterAdd0
FwpmCalloutAdd0
FwpsCalloutRegister0
FwpsFreeCloneNetBufferList0
FwpsAllocateCloneNetBufferList0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectionHandleCreate0

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x64/TKTool2k64.sys
.sys windows:6 windows x64 arch:x64

2ca3150ee7102c46d43e4d7e618f906b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/11/2012, 00:00

Not After

28/12/2013, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36
Signer

Actual PE Digest

be:18:07:50:e1:7a:07:56:67:6b:b7:c4:b3:49:8b:d2:e0:c7:86:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\amd64\TKTool2k64.pdb

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
RtlInitUnicodeString
IoDeleteDevice
ZwUnloadDriver
IoCreateSymbolicLink
RtlCopyUnicodeString
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwClose
ZwQueryInformationFile
ZwOpenKey
KeBugCheckEx
DbgPrint
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQuerySymbolicLinkObject
ZwDeleteValueKey
ZwOpenSymbolicLinkObject
ZwQueryValueKey
IofCompleteRequest
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/protect/x86/TKTool2k.sys
.sys windows:6 windows x86 arch:x86

d9a12bd346b9522bd63c7d74b98a85b2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a8:38:f4:1d:b8:be:e0:6f:50:a5:f1:ef:c7:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/11/2012, 00:00

Not After

28/12/2013, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95
Signer

Actual PE Digest

9a:2f:42:49:3a:cd:af:aa:00:eb:b1:8d:77:dc:7a:4c:6a:0e:24:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\isarcsys\en6047~1\branches\if1_rb~3.01_\bin\free\i386\TKTool2k.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoRegisterShutdownNotification
IoRegisterPlugPlayNotification
memcpy
RtlCopyUnicodeString
IoCreateSymbolicLink
IoCreateDevice
ZwUnloadDriver
memset
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
ZwEnumerateValueKey
ZwOpenKey
KeTickCount
DbgPrint
RtlAnsiCharToUnicodeChar
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
IoDeleteSymbolicLink
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryValueKey
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwDeleteValueKey
RtlUnwind
KeBugCheckEx
IoDeleteDevice

hal

KeGetCurrentIrql

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/BWT.dll
.dll windows:4 windows x86 arch:x86

05195c4c68546332284aba78a64bfe4c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/07/2021, 00:00

Not After

27/07/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:6a:ca:0f:0a:72:79:b6:f0:e0:8c:5c:ff:e7:2f:d3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/06/2023, 00:00

Not After

07/06/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1f
Signer

Actual PE Digest

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\bwt\BWT.pdb

Imports

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpSetOption
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCloseHandle

crypt32

CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertOpenSystemStoreW

rpcrt4

UuidCreate

kernel32

SetStdHandle
WriteConsoleA
OutputDebugStringW
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
lstrlenA
MultiByteToWideChar
CreateFileW
SizeofResource
GetFileSize
LockResource
SetFilePointer
LoadResource
ReadFile
FindResourceExW
CreateEventW
GetConsoleOutputCP
GetModuleHandleW
Sleep
SetEvent
lstrlenW
OutputDebugStringA
WideCharToMultiByte
FindResourceW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetWindowsDirectoryW
GetExitCodeThread
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
GetConsoleMode
GetConsoleCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetProcAddress
InterlockedIncrement
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
VirtualFree
VirtualAlloc
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LoadLibraryA

user32

UnregisterClassA

advapi32

RegSetValueExW
RevertToSelf
ImpersonateLoggedOnUser
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

Exports

Exports

BWTControl

Sections

.text
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/BWTTrustList.dat
coredll/rtd/BwtTrust.dll
.dll windows:4 windows x86 arch:x86

03a1fe3fde0b98269544b8bec2d124a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/07/2017, 00:00

Not After

18/07/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19/07/2017, 00:00

Not After

18/07/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

Actual PE Digest

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5

Digest Algorithm

sha256

PE Digest Matches

true

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

Actual PE Digest

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\BWT\Bin\Release\BwtTrust.pdb

Imports

psapi

GetMappedFileNameW

kernel32

CreateFileMappingW
GetCurrentProcess
QueryDosDeviceW
GetLogicalDriveStringsW
SetEndOfFile
SetFilePointer
GetFileSize
WriteFile
GetDriveTypeW
GetLastError
MapViewOfFile
OutputDebugStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
SetEvent
FindClose
UnmapViewOfFile
SetFileAttributesW
DeleteFileW
GetFileAttributesW
CloseHandle
CreateFileW
CompareStringW
OpenFileMappingW
TlsSetValue
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
SetEnvironmentVariableA
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
CreateFileA
FlushFileBuffers
CompareStringA

advapi32

RegQueryValueExW
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
RegOpenKeyExW

Exports

Exports

RequestService

Sections

.text
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/NpBWT.dll
.dll windows:5 windows x86 arch:x86

a60200e3067da2c9a407d52e73c19fac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44
Signer

Actual PE Digest

c5:1e:57:68:b4:12:59:90:8a:3e:b2:ba:ec:28:d6:54:1f:50:de:9b:1f:fe:c7:03:19:7f:2f:f3:23:18:50:44

Digest Algorithm

sha256

PE Digest Matches

true

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a
Signer

Actual PE Digest

a6:9e:b1:85:dc:9b:b1:21:a1:29:36:a0:2a:7f:3d:18:7b:70:18:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpBWTStatic\Win32\NpBWT.pdb

Imports

kernel32

GetSystemInfo
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CreateFileMappingW
OpenFileMappingW
CloseHandle
VirtualFree
VirtualAlloc
FreeLibrary
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetModuleHandleW
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW

Exports

Exports

fnBWTControl

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/NpHttpsLib.dll
.dll windows:5 windows x86 arch:x86

3a841189ccd143ddc7a404c891883888

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:e0:11:65:24:ca:28:d5:b3:34:2b:3f:88:2d:bf:5c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/06/2022, 00:00

Not After

22/06/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:a9:f1:4f:e8:8b:6c:13:65:7f:ed:4b:26:97:d7:8e:ae:35:ec:36:aa:7b:97:ac:96:91:eb:2a:e9:15:f0:53
Signer

Actual PE Digest

0d:a9:f1:4f:e8:8b:6c:13:65:7f:ed:4b:26:97:d7:8e:ae:35:ec:36:aa:7b:97:ac:96:91:eb:2a:e9:15:f0:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PROJECT\aegis\Binary\NpHttpsLibStatic_Ex\Win32\NpHttpsLib.pdb

Imports

advapi32

CryptGenRandom
CryptAcquireContextW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
CryptReleaseContext

crypt32

CertCloseStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext

ws2_32

htonl
closesocket
send
__WSAFDIsSet
select
listen
accept
freeaddrinfo
sendto
WSASetLastError
connect
socket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
getaddrinfo
ioctlsocket
gethostname
WSAIoctl
recv
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
recvfrom

wldap32

ord133
ord147
ord127
ord142
ord79
ord26
ord301
ord27
ord41
ord46
ord216
ord208
ord145
ord219
ord14
ord117
ord167

kernel32

GetCurrentDirectoryW
GetFullPathNameA
GetFullPathNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
GetDriveTypeW
FindFirstFileExW
GetTimeFormatA
GetDateFormatA
GetDriveTypeA
GetProcessHeap
FindFirstFileExA
CancelIo
GetOverlappedResult
CreateFileA
WaitNamedPipeA
SetHandleInformation
CreateEventA
CreateFileMappingA
SystemTimeToFileTime
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetModuleHandleExW
InterlockedExchangeAdd
InterlockedCompareExchange
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
MapViewOfFile
UnmapViewOfFile
GetLastError
CloseHandle
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetSystemTime
FindFirstFileW
MoveFileExW
GetCurrentProcess
CreateDirectoryW
GetFileAttributesW
FindClose
FindNextFileW
DeleteFileW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
SetLastError
LCMapStringW
RaiseException
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetStringTypeW
GetTimeZoneInformation
RtlUnwind
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
GetSystemDirectoryW
QueryPerformanceFrequency
SleepEx
PeekNamedPipe
WaitForMultipleObjects
FormatMessageW
GetEnvironmentVariableA
CompareFileTime
DeleteFileA

bcrypt

BCryptGenRandom

user32

GetProcessWindowStation
MessageBoxW
FindWindowA
SendMessageA
GetUserObjectInformationW

Exports

Exports

fnCloseFTPList
fnCloseFtp
fnCloseHttps
fnCloseUidList
fnCreateDirectoryFtp
fnCreateFTPList
fnCreateUidList
fnDeleteDirectoryFtp
fnDeleteFileFtp
fnDeletePOP3Mail
fnGetBuffer
fnGetBufferData
fnGetBufferDataSize
fnGetCurlCode
fnGetFileFtp
fnGetFileListFtp
fnGetPOP3Mail
fnGetPOP3MailHdr
fnGetPOP3UIDList
fnIsFTPFileExist
fnOpenFtp
fnOpenHttps
fnPerform
fnPutFileFtp
fnPutFileRenameFtp
fnSendSmtpMail
fnSetCABundlePath
fnSetCipherList
fnSetConnectionClose
fnSetEnableRedirect
fnSetFTPPerm
fnSetHttpDownloadFile
fnSetHttpHeader
fnSetHttpTypeGet
fnSetHttpTypePost
fnSetHttpTypePostRaw
fnSetProxy
fnSetSFTPKeyFile
fnSetSSLVerifyPear
fnSetTimeoutMilliSec
fnSetUserAgent

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TYAVPU_000.bin
coredll/rtd/TYAVP_001.bin
coredll/rtd/TYAVSU_000.bin
coredll/rtd/TeCtrl.dll
.dll windows:4 windows x86 arch:x86

4e311b2f179b73c588ae48280c8f522f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

84:e0:83:12:1b:01:64:a2:c5:87:64:5b:f5:7f:21:4a:c5:17:c5:7f:e2:d9:73:06:93:8f:a9:2b:ec:c6:c7:43
Signer

Actual PE Digest

84:e0:83:12:1b:01:64:a2:c5:87:64:5b:f5:7f:21:4a:c5:17:c5:7f:e2:d9:73:06:93:8f:a9:2b:ec:c6:c7:43

Digest Algorithm

sha256

PE Digest Matches

true

d4:3e:f8:54:2d:e4:f6:4f:20:3d:c3:9f:77:70:c3:fc:32:70:a3:88
Signer

Actual PE Digest

d4:3e:f8:54:2d:e4:f6:4f:20:3d:c3:9f:77:70:c3:fc:32:70:a3:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrl.pdb

Imports

kernel32

WaitForSingleObject
CreateRemoteThread
GetModuleHandleA
OpenProcess
UnmapViewOfFile
QueryDosDeviceA
GetLogicalDriveStringsA
MapViewOfFile
CreateFileMappingA
TerminateThread
CreateThread
DuplicateHandle
LocalFree
LocalAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
SetEvent
InterlockedExchange
GetVersion
CreateMutexA
OpenMutexA
GlobalMemoryStatus
RemoveDirectoryA
FindClose
FindNextFileA
SetFileAttributesA
FindFirstFileA
CreateDirectoryA
GetTempPathA
Sleep
InitializeCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
GetModuleFileNameA
DeleteCriticalSection
CreateEventA
GetTickCount
GetCurrentProcess
lstrlenW
CompareStringA
CompareStringW
lstrcmpiA
lstrcmpiW
lstrlenA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
OutputDebugStringA
OutputDebugStringW
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
ResetEvent
ExpandEnvironmentStringsA
GetWindowsDirectoryA
Module32Next
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetConsoleOutputCP
WriteConsoleA
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetConsoleCtrlHandler
GetVersionExA
GetFileAttributesA
DeleteFileA
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetLastError
GlobalAlloc
SetLastError
GlobalFree
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetThreadLocale
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
CreateFileA
GetFileSize
ReadFile
TlsFree
CloseHandle
RaiseException
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
ExitProcess
WriteFile
GetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA

user32

wsprintfA
CharUpperW
CharLowerW
CharLowerA
CharUpperA
UnregisterClassA

advapi32

RegEnumKeyExA
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
AdjustTokenPrivileges
RegQueryInfoKeyA

shell32

SHGetFolderPathA

shlwapi

PathFindExtensionA
PathIsRelativeA

imagehlp

UnMapAndLoad
MapAndLoad

wintrust

WinVerifyTrust

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringA
CryptQueryObject

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureEx
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeEnableBWT
NpeEnableBWTEx
NpeEnableBWTV2
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryCureEx
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpeNewInstanceVersionEx
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetBWTCallBackEx
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TeCtrlu.dll
.dll windows:4 windows x86 arch:x86

282f3d67fc3d291640aecf724ae13725

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:9e:f8:26:94:7d:19:10:0d:0a:2a:2d:da:c2:bd:f8
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/01/2020, 00:00

Not After

03/02/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:a8:b6:54:dd:92:a8:dd:78:f7:ac:67:b4:09:de:61
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/07/2019, 00:00

Not After

13/07/2020, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

91:2b:47:0f:a3:51:8a:60:de:b0:11:f1:6f:cb:fe:75:96:30:80:54:8e:28:2c:fd:f6:da:25:56:6b:57:ef:42
Signer

Actual PE Digest

91:2b:47:0f:a3:51:8a:60:de:b0:11:f1:6f:cb:fe:75:96:30:80:54:8e:28:2c:fd:f6:da:25:56:6b:57:ef:42

Digest Algorithm

sha256

PE Digest Matches

true

28:1d:fa:5f:c3:1c:33:b3:fe:88:f3:d0:d1:b2:4e:9d:25:1e:26:ac
Signer

Actual PE Digest

28:1d:fa:5f:c3:1c:33:b3:fe:88:f3:d0:d1:b2:4e:9d:25:1e:26:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PROJECT\tectrl\Sym\Release\TeCtrlu.pdb

Imports

kernel32

GetCurrentProcess
UnmapViewOfFile
QueryDosDeviceW
GetLogicalDriveStringsW
MapViewOfFile
CreateFileMappingW
WaitForSingleObject
CreateRemoteThread
GetModuleHandleW
OpenProcess
TerminateThread
CreateThread
DuplicateHandle
lstrcpynW
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameW
CreateMutexW
OpenMutexW
DeleteCriticalSection
InitializeCriticalSection
GlobalMemoryStatus
CreateDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetTempPathW
CreateEventW
GetTickCount
GetVersionExW
TlsFree
TlsAlloc
lstrlenW
TlsSetValue
TlsGetValue
OutputDebugStringW
ResetEvent
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
ExitProcess
GetModuleFileNameA
lstrlenA
GetThreadLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
GlobalAlloc
SetLastError
CloseHandle
GlobalFree
CreateFileA
GetLastError
LoadLibraryW
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
GetSystemDirectoryW
GetProcAddress
FreeLibrary
CreateFileW
GetFileSize
ReadFile
WideCharToMultiByte
Sleep
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
WriteFile
GetStdHandle
LCMapStringA
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler

user32

GetActiveWindow
UnregisterClassA
MessageBoxA
wsprintfW

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges

shell32

SHGetFolderPathW

shlwapi

PathIsRelativeW
PathFindExtensionW

imagehlp

MapAndLoad
UnMapAndLoad

wintrust

WinVerifyTrust

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertGetNameStringW

Exports

Exports

NPAS_Clsid2MalwareName
NPAS_CreateClsidList
NPAS_CreateMD5List
NPAS_CreateMalname2ClsidList
NPAS_FreeClsidList
NPAS_FreeMD5List
NPAS_FreeMalnameList
NPAVEnableBWT
NPAVGetBWTVer
NpeAutoMemScan
NpeBWTDepotClear
NpeBWTDepotCommit
NpeBWTDepotCure
NpeBWTDepotQuery
NpeBWTDepotRollBack
NpeCheckExceptList
NpeCreateBitCache
NpeCure
NpeCureEx
NpeCureProcess
NpeDeleteInstance
NpeDisablePatternNPAV
NpeDisableSkipScript
NpeEnableBWT
NpeEnableBWTEx
NpeEnableBWTV2
NpeFindOwnerProc
NpeFlushBWTCache
NpeFlushBWTCacheOldVersion
NpeFree
NpeGetBWTDepotEnable
NpeGetBWTVer
NpeGetFailEngineInstFlag
NpeGetHashLog
NpeGetRestoreList
NpeGetScannedCount
NpeGetVer
NpeLoad
NpeMemoryCure
NpeMemoryCureEx
NpeMemoryScan
NpeNewInstance
NpeNewInstanceEx
NpeNewInstanceVersion
NpeNewInstanceVersionEx
NpePauseProc
NpePauseRegistry
NpePauseSSmartScan
NpeProcScan
NpeRegistryScan
NpeResumeProc
NpeResumeRegistry
NpeResumeSSmartScan
NpeSQuickScan
NpeSSmartScan
NpeScan
NpeScanProcess
NpeSetArchiveOption
NpeSetAsyncMode
NpeSetBDCorePluginPath
NpeSetBWTCallBack
NpeSetBWTCallBackEx
NpeSetEnginePath
NpeSetHashLog
NpeSetImpersonate
NpeSetLiveUpdate
NpeSetLoadLibDir
NpeSetOption
NpeSetOptionEx
NpeSetProxy
NpeSetScanMode
NpeSetWOWRedirect
NpeStopNetworkscan
NpeStopProc
NpeStopRegistry
NpeStopSSmartScan
NpeStopScan
NpeUnLoad

Sections

.text
Size: 400KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/TySUtilu.dll
.dll windows:4 windows x86 arch:x86

a008632a5ab1b5de784efb061bb8f8e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:3c:35:ee:d5:f9:f5:75:ba:46:fa:bc:8d:47:cb:6e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/12/2011, 00:00

Not After

06/12/2012, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14
Signer

Actual PE Digest

1a:f2:f2:41:0b:ac:de:a0:78:74:75:5e:0e:17:a9:5d:29:23:6e:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\TyScan\Sym\Release\TySUtilu.pdb

Imports

kernel32

CreateFileMappingW
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
MapViewOfFile
GetFileSize
WriteFile
SetLastError
SetFilePointer
ReadFile
GetLocalTime
UnmapViewOfFile
CloseHandle
GetFileAttributesW
CreateDirectoryW
GetLastError
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
FlushFileBuffers

advapi32

RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

Exports

Exports

TBP_Close_File
TBP_Delete_From_Repository
TBP_Get_Object_Count
TBP_Get_Size_Of_Repository
TBP_Insert_Object_File
TBP_Insert_Object_Reg_Key
TBP_Insert_Object_Reg_Value
TBP_Is_Repository_Capable
TBP_Make_Category
TBP_Open_File
TBP_Read_Category
TBP_Read_Object
TBP_Restore_All_Object
TBP_Restore_Object
TBP_Restore_ObjectEx
TBP_Traverse_Repository

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/teexcept.dat
coredll/rtd/tyav32u.dll
.dll windows:4 windows x86 arch:x86

0b1edb4b9c71aae343a81e21581d3bbe

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:e0:11:65:24:ca:28:d5:b3:34:2b:3f:88:2d:bf:5c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

23/06/2022, 00:00

Not After

22/06/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:6e:b7:a9:ec:cb:78:42:bd:68:2a:c7:56:c0:d9:0c:bb:cb:63:d1:0c:79:4c:04:a4:9b:b9:c6:5a:87:e4:c7
Signer

Actual PE Digest

5b:6e:b7:a9:ec:cb:78:42:bd:68:2a:c7:56:c0:d9:0c:bb:cb:63:d1:0c:79:4c:04:a4:9b:b9:c6:5a:87:e4:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThread
Module32NextW
Module32FirstW
Sleep
TerminateProcess
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
WaitForSingleObject
GetWindowsDirectoryW
MultiByteToWideChar
FindNextFileW
MoveFileW
GetLogicalDriveStringsW
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
SuspendThread
OpenThread
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryW
ResumeThread
VirtualProtectEx
GetThreadContext
GetCurrentProcess
VirtualQuery
OpenEventW
LoadLibraryA
GetSystemDirectoryA
OutputDebugStringW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
GetLocalTime
WriteConsoleW
GetFileAttributesW
OutputDebugStringA
FormatMessageW
GetSystemInfo
CreateFileA
SetFileTime
GetFileTime
FindFirstFileA
WritePrivateProfileStringW
MoveFileExW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
CreateEventW
QueryDosDeviceW
TerminateThread
CreateThread
DuplicateHandle
CreateRemoteThread
LocalFree
GetLogicalDrives
GetSystemDirectoryW
SetLastError
SetEvent
VirtualFree
VirtualAlloc
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetLongPathNameW
LeaveCriticalSection
EnterCriticalSection
OpenMutexW
CreateMutexW
OpenFileMappingW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetFileSize
SetEndOfFile
GetShortPathNameW
FindFirstFileW
FindClose
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
Process32FirstW
Process32NextW
OpenProcess
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTickCount
CopyFileW
GetLastError
WideCharToMultiByte
WriteFile
SetFilePointer
ReadFile
GetVersionExW
GetDriveTypeW
CreateFileW
CloseHandle
GetStdHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
RaiseException
SetConsoleCtrlHandler
GetOEMCP
GetACP
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetStdHandle
GetStartupInfoA
SetHandleCount
GlobalFree
GlobalAlloc
VirtualProtect
IsBadReadPtr
InterlockedDecrement
InterlockedIncrement
RtlUnwind
ExitProcess
GetFileType
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
TlsAlloc
TlsFree
DeleteFileA

advapi32

RegOpenKeyExW
IsTextUnicode
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetUserNameW
LookupAccountNameW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
GetTokenInformation
LookupAccountSidW
RegEnumKeyW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
FreeSid
SetSecurityDescriptorDacl
SetFileSecurityW
OpenThreadToken
ImpersonateSelf
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyW
OpenProcessToken
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW

ws2_32

WSCDeinstallProvider
WSCEnumProtocols
WSCInstallProvider
WSCGetProviderPath
WSACleanup

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

sfc

ord5

shlwapi

PathRemoveFileSpecW

imagehlp

MapFileAndCheckSumW

netapi32

NetLocalGroupAddMembers
NetUserGetLocalGroups
NetApiBufferFree

userenv

ExpandEnvironmentStringsForUserW

Exports

Exports

RecoverInlineHooking
TYAVSmartCure
TYAVSmartScan
TYAutoScanMemory
TYCheckBootVirus
TYCheckExceptList
TYCheckFile
TYCheckFileEx
TYCheckFileExW
TYCoreCheckBootVirus
TYCoreCheckFileCBCureEx
TYCoreCheckFileEx
TYCoreCheckFileExW
TYCoreGetEngineDateW
TYCoreInitEngine
TYCoreRecoveryBootVirus
TYCoreRecoveryFile
TYCoreRecoveryFileW
TYCoreSetOption
TYCoreSetReportCallBack
TYCoreUnInitEngine
TYCreateCache
TYCureMemory
TYCureProcess
TYDelInstance
TYDisablePattern
TYDisableSkipScript
TYEnableNetworkScan
TYFlushBWTCache
TYGetBWTVer
TYGetBWTVerEx
TYGetBootInfo
TYGetEngineDate
TYGetEngineDateW
TYGetFileCRC
TYGetFileCRCEX
TYGetFileCRCEX2
TYGetFilePosCRC
TYGetPatternNum
TYInitEngine
TYListFile
TYListFileCRC
TYNewInstance
TYRecoveryBootVirus
TYRecoveryFile
TYRecoveryFileW
TYScanMemory
TYScanProcess
TYSetLiveUpdate
TYSetLoadLibDir
TYSetOption
TYSetServerSideScriptScan
TYSetTkDrvLoadLibDir
TYSetUPExtractPolicy
TYSetYaraEnable
TYStopNetworkScan
TYUnInitEngine

Sections

.text
Size: 868KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 672KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/tyavcuremap.dat
coredll/rtd/tyavexcept.bin
.dll windows:4 windows x86 arch:x86

5c54715227e960c5019e7a45d4b9d02a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
coredll/rtd/tyavexcept.dat
ncert/Root Certification Authority.cer
ncert/Thawte.cer
ncert/cap.npb
ncert/certmgr.exe
.exe windows:6 windows x86 arch:x86

7a7c6506fbb24dc5a3e42f717ca920c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

CertMgr.pdb

Imports

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

Sleep
InterlockedCompareExchange
RtlUnwind
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
MapViewOfFile
CreateFileMappingA
GetFileSize
WriteFile
WideCharToMultiByte
InterlockedExchange
GetSystemTime
SystemTimeToFileTime
CompareFileTime
MultiByteToWideChar
FileTimeToLocalFileTime
CreateFileW
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
GetLastError
SetLastError
GetModuleHandleA

msvcrt

_controlfp
?terminate@@YAXXZ
malloc
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
scanf
memcpy
_wasctime
memset
_wtol
printf
wprintf
towupper
realloc
free
strtok
_vsnwprintf
_wcsicmp
vwprintf

user32

LoadStringA
LoadStringW

crypt32

CryptInitOIDFunctionSet
CertFreeCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObject
CertFreeCRLContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertFreeCTLContext
CertAddCRLContextToStore
CertAddCTLContextToStore
CertEnumCTLsInStore
CertAddCertificateContextToStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertDeleteCTLFromStore
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CryptStringToBinaryW
CertCloseStore
CertAddEncodedCRLToStore
CertOpenStore
CertAddEncodedCertificateToStore
CertAddEncodedCTLToStore
CertRDNValueToStrW
CryptDecodeObject
CryptFindOIDInfo
CryptFreeOIDFunctionAddress
CryptGetOIDFunctionAddress
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSIPLoad
CryptSIPRetrieveSubjectGuid
CertGetCertificateContextProperty
CertEnumCertificateContextProperties
CertRDNValueToStrA
CertSaveStore
CertGetPublicKeyLength
CryptHashPublicKeyInfo
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CertGetCTLContextProperty
CertFindCTLInStore
CryptInstallOIDFunctionAddress

cryptui

CryptUIDlgCertMgr

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/certutil.exe
.exe windows:6 windows x86 arch:x86

e3a088f00827d99d5fe555c4e7139852

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:f9:1a:be:7f:c8:45:04:b5:0e:13:c3:5d:ac:20:11:73:33:c6:29:e3:b3:c3:f0:49:75:90:99:dd:63:39:22
Signer

Actual PE Digest

7f:f9:1a:be:7f:c8:45:04:b5:0e:13:c3:5d:ac:20:11:73:33:c6:29:e3:b3:c3:f0:49:75:90:99:dd:63:39:22

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nssutil3

PORT_Free_Util
PORT_Strdup_Util
PORT_SetError_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
SECOID_AddEntry_Util
CERT_GenTime2FormattedAscii_Util
DER_GeneralizedTimeToTime_Util
DER_UTCTimeToTime_Util
ATOB_ConvertAsciiToItem_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
SEC_QuickDERDecodeItem_Util
SECOID_FindOID_Util
SECITEM_ReallocItemV2
NSS_Get_SECOID_AlgorithmIDTemplate_Util
DER_GetInteger_Util
SEC_ASN1Decode_Util
ATOB_AsciiToData_Util
DER_AsciiToTime_Util
SEC_ASN1DecodeItem_Util
SECOID_GetAlgorithmTag_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDTag_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
SECITEM_ZfreeItem_Util
SECITEM_CompareItem_Util
SECITEM_AllocItem_Util
PORT_DestroyCheapArena
PORT_InitCheapArena
PORT_ZAlloc_Util
PORT_Realloc_Util
PORT_Alloc_Util
NSS_Get_SEC_IA5StringTemplate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_StringToOID
SECOID_FindOIDByTag_Util
SECITEM_FreeItem_Util
SECITEM_CopyItem_Util
PORT_ArenaStrdup_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_ArenaGrow_Util
NSS_Get_SEC_ObjectIDTemplate_Util

ssl3

SSL_OptionSetDefault

smime3

CERT_DecodeCertFromPackage

nss3

PK11_ImportCert
PK11_ListCerts
PK11_ListCertsInSlot
PK11_GetSlotFromPrivateKey
PK11_ReadRawAttribute
PK11_GetLowLevelKeyIDForPrivateKey
CERT_CreateValidity
CERT_DestroyValidity
CERT_CreateCertificate
CERT_DestroyCertificate
CERT_CreateCertificateRequest
CERT_DestroyCertificateRequest
CERT_StartCertificateRequestAttributes
CERT_FinishCertificateRequestAttributes
CERT_GetCertificateRequestExtensions
CERT_GetCertKeyType
CERT_GetDefaultCertDB
CERT_FindCertByDERCert
CERT_EncodeUserNotice
CERT_FindCertByNicknameOrEmailAddrCX
CERT_VerifySignedDataWithPublicKeyInfo
CERT_VerifyCertificate
CERT_GetCertEmailAddress
CERT_GetCommonName
CERT_GetCountryName
CERT_GetStateName
CERT_GetOrgName
CERT_ChangeCertTrust
CERT_StartCertExtensions
CERT_FinishExtensions
CERT_MergeExtensions
CERT_CertChainFromCert
CERT_DestroyCertificateList
CERT_DecodeTrustString
CERT_SaveSMimeProfile
CERT_DestroyCertList
CERT_CreateSubjectCertList
SEC_DerSignDataWithAlgorithmID
SEC_GetSignatureAlgorithmOidTag
SEC_CreateSignatureAlgorithmParameters
SEC_DeletePermCertificate
NSS_Initialize
NSS_InitWithMerge
NSS_Shutdown
PK11_RandomUpdate
PK11_GenerateKeyPairWithOpFlags
PK11_GetCertFromPrivateKey
NSS_Get_SECKEY_RSAPSSParamsTemplate
SECKEY_CreateSubjectPublicKeyInfo
SEC_PKCS5IsAlgorithmPBEAlgTag
CERT_NameToAscii
CERT_GetOidString
CERT_Hexify
CERT_NewTempCertificate
CERT_GetCertTrust
CERT_DestroyOidSequence
CERT_DecodeBasicConstraintValue
CERT_DecodeAuthKeyID
CERT_DecodeCRLDistributionPoints
CERT_DecodeOidSequence
CERT_DecodeAltNameExtension
CERT_DecodeNameConstraintsExtension
CERT_DecodeAuthInfoAccessExtension
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
PK11_GetFirstSafe
PK11_GetNextSafe
PK11_CheckUserPassword
PK11_ChangePW
PK11_ProtectedAuthenticationPath
PK11_IsFIPS
PK11_FindCertInSlot
PK11_HasAttributeSet
PK11_HashBuf
PK11_GetAllSlotsForCert
CERT_DestroyCertificatePoliciesExtension
CERT_DecodeUserNotice
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DestroyUserNotice
CERT_EncodeInfoAccessExtension
PK11_FindCertsFromEmailAddress
PK11_FindCertFromNickname
PK11_ListPrivateKeysInSlot
PK11_ListPrivKeysInSlot
PK11_FindKeyByDERCert
PK11_FindKeyByKeyID
PK11_FindKeyByAnyCert
__PK11_SetCertificateNickname
PK11_GetPrivateKeyNickname
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DestroyMergeLog
PK11_CreateMergeLog
PK11_MergeTokens
SECMOD_CloseUserDB
SECMOD_OpenUserDB
PK11_GetAllTokens
PK11_IsPresent
PK11_NeedUserInit
PK11_IsRemovable
PK11_IsFriendly
PK11_NeedLogin
PK11_GetSlotName
PK11_GetTokenURI
PK11_GetTokenName
PK11_IsInternal
PK11_FindSlotByName
PK11_Authenticate
PK11_ResetToken
PK11_SetPasswordFunc
PK11_InitPin
PK11_IsLoggedIn
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_FreeSlotList
SECKEY_DestroyPrivateKeyList
SECKEY_GetPrivateKeyType
SECKEY_DestroyPublicKey
SECKEY_DestroyPrivateKey
CERT_EncodePolicyMappingExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodePolicyConstraintsExtension
CERT_GetGeneralNameTypeFromString
CERT_EncodeCRLDistributionPoints
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_AddExtensionByOID
CERT_AddExtension
CERT_EncodeSubjectKeyID
CERT_DestroyName
CERT_CopyName
CERT_CopyRDN
CERT_AsciiToName
SECKEY_ConvertToPublicKey
SECKEY_DestroySubjectPublicKeyInfo
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CertificateRequestTemplate
CERT_EncodeNameConstraintsExtension
CERT_EncodeNoticeReference
SECKEY_ExtractPublicKey
CERT_EncodeCertPoliciesExtension
CERT_FindCertByNicknameOrEmailAddr

libnspr4

PR_GetOpenFileInfo
PR_Close
PR_snprintf
PR_StringToNetAddr
PR_GetError
PR_GetOSError
PR_ErrorToString
PR_Now
PR_ExplodeTime
PR_ImplodeTime
PR_GMTParameters
PR_GetSpecialFD
PR_IsNetAddrType
PR_NetAddrToString
PR_GetEnvSecure
PR_FormatTime
PR_ErrorToName
PR_GetErrorText
PR_GetErrorTextLength
PR_Open
PR_Read
PR_fprintf
PR_smprintf_free
PR_smprintf
PR_Cleanup
PR_Init
PR_Write

libplc4

PL_strfree
PL_strndup
PL_strncasecmp
PL_strlen
PL_strdup
PL_strcmp
PL_CreateLongOptState
PL_DestroyOptState
PL_GetNextOpt

libplds4

PL_ArenaFinish

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent

vcruntime140

__current_exception_context
strstr
strchr
memcpy
strrchr
_except_handler4_common
memset
__current_exception

api-ms-win-crt-stdio-l1-1-0

puts
__stdio_common_vfprintf
fclose
__stdio_common_vsprintf
_fileno
_isatty
__acrt_iob_func
__p__commode
fputs
getc
_set_fmode
fopen
fgets
fflush

api-ms-win-crt-string-l1-1-0

tolower
isprint
isspace
strpbrk
strncpy
strncmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_set_app_type
__p___argv
_get_initial_narrow_environment
_exit
strerror
_c_exit
_register_thread_local_exe_atexit_callback
_errno
_initialize_narrow_environment
_initterm_e
exit
_initterm
_cexit
terminate
_seh_filter_exe
_controlfp_s
__p___argc
_crt_atexit
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/dc-rootca.cer
ncert/dcrootca.cer
ncert/digi_trust.cer
ncert/freebl3.dll
.dll windows:5 windows x86 arch:x86

2eeccde7045497286a94c3da73129103

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

40:d2:17:3e:61:cc:d1:eb:0f:5a:41:68:b7:df:97:2d:f3:4c:a4:95:7b:6c:9d:a2:ec:2b:05:8d:2e:d6:b0:fc
Signer

Actual PE Digest

40:d2:17:3e:61:cc:d1:eb:0f:5a:41:68:b7:df:97:2d:f3:4c:a4:95:7b:6c:9d:a2:ec:2b:05:8d:2e:d6:b0:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SystemFunction036

libnspr4

PR_DestroyLock
PR_Lock
PR_Unlock
PR_GetEnvSecure
PR_NewLock
PR_DestroyCondVar
PR_WaitCondVar
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_CallOnce
PR_NewCondVar

nssutil3

PORT_Alloc_Util
PORT_Free_Util
PORT_ZFree_Util
PORT_SetError_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaZAlloc_Util
PORT_ZAlloc_Util
SECITEM_CompareItem_Util
PORT_ZAllocAlignedOffset_Util
NSS_SecureMemcmpZero
NSS_SecureMemcmp
SECOID_FindOIDTag_Util
PORT_ArenaAlloc_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
PORT_GetError_Util
SECITEM_CopyItem_Util
SECITEM_AllocItem_Util

kernel32

IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetComputerNameA
GlobalMemoryStatus
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
QueryPerformanceCounter
GetVolumeInformationA
GetLogicalDrives
GetDiskFreeSpaceA

vcruntime140

memcpy
__std_type_info_destroy_list
_except_handler4_common
memset

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initialize_onexit_table
abort
_execute_onexit_table
_initialize_narrow_environment
_cexit
_initterm

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/libnspr4.dll
.dll windows:6 windows x86 arch:x86

eaccc938d8fcf88d70d208c8ed4a50d4

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:6b:e1:df:97:6b:2b:1a:44:86:a8:a1:fa:5c:f0:d7:4b:66:cb:4c:7d:d7:24:f3:83:4d:00:f3:b4:87:53:82
Signer

Actual PE Digest

d2:6b:e1:df:97:6b:2b:1a:44:86:a8:a1:fa:5c:f0:d7:4b:66:cb:4c:7d:d7:24:f3:83:4d:00:f3:b4:87:53:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

OpenProcessToken
AddAccessAllowedAce
AllocateAndInitializeSid
CopySid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner

ws2_32

__WSAFDIsSet
gethostname
socket
listen
getsockopt
getsockname
ioctlsocket
bind
accept
getprotobyname
getprotobynumber
gethostbyname
gethostbyaddr
ntohs
ntohl
htons
htonl
WSAGetLastError
closesocket
getpeername
recv
recvfrom
select
send
sendto
setsockopt
shutdown
WSAStartup
WSASetLastError
WSACleanup
connect

mswsock

AcceptEx
GetAcceptExSockaddrs
TransmitFile

winmm

timeGetTime

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
SetThreadAffinityMask
ConvertThreadToFiber
CreateFiber
SwitchToFiber
GetProcessAffinityMask
TlsFree
TlsAlloc
ResumeThread
SuspendThread
SetThreadPriority
GetCurrentThread
CreateEventA
SetLastError
RaiseException
DuplicateHandle
IsDebuggerPresent
MoveFileA
GetLogicalDriveStringsA
lstrlenA
DeleteFiber
WaitForMultipleObjects
Sleep
ResetEvent
CancelIo
GetOverlappedResult
PostQueuedCompletionStatus
ReadFile
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DebugBreak
OutputDebugStringA
TlsGetValue
TlsSetValue
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
GetSystemInfo
GlobalMemoryStatusEx
CloseHandle
CreatePipe
GetStdHandle
TryEnterCriticalSection
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetSystemTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
FormatMessageA
CreateFileMappingA
SystemTimeToFileTime
GetCurrentProcess
ReleaseSemaphore
CreateSemaphoreA
GetThreadContext
CreateDirectoryA
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetDriveTypeA
GetFileAttributesExA
GetFileInformationByHandle
LockFileEx
RemoveDirectoryA
SetFilePointer
UnlockFileEx
WriteFile
GetVolumeInformationA
GetHandleInformation
SetHandleInformation
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatus

vcruntime140

memset
memcpy
__std_type_info_destroy_list
_except_handler4_common
memmove
strstr
strrchr
memchr
strchr

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi

api-ms-win-crt-runtime-l1-1-0

_initterm
exit
_initialize_onexit_table
__fpe_flt_rounds
_errno
strerror
_initialize_narrow_environment
_configure_narrow_argv
abort
_seh_filter_dll
_cexit
_initterm_e
_execute_onexit_table
_endthreadex
_beginthreadex
_exit

api-ms-win-crt-stdio-l1-1-0

setvbuf
fflush
__stdio_common_vsprintf
fclose
fwrite
fopen
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free
realloc
calloc
malloc

api-ms-win-crt-string-l1-1-0

_stricmp
isspace
isdigit
_strdup
strncmp
strpbrk
isalpha
tolower

api-ms-win-crt-environment-l1-1-0

getenv
__p__environ
_putenv

api-ms-win-crt-time-l1-1-0

_mktime64
strftime
_time64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_access

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbsdec

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_DuplicateEnvironment
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetEnvSecure
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetPrefLoopbackAddrInfo
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadName
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_GetVersion
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NTFast_Accept
PR_NTFast_AcceptRead
PR_NTFast_AcceptRead_WithTimeoutCallback
PR_NTFast_UpdateAcceptContext
PR_NT_CancelIo
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetCurrentThreadName
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_SyncMemMap
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/libplc4.dll
.dll windows:6 windows x86 arch:x86

ffcaaeb2ca285859220a06a68888322c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f3:05:de:90:60:89:a5:26:39:ef:a1:b7:c9:67:7a:ca:24:97:4a:38:9c:54:6f:79:13:2f:40:ba:fe:9f:b8:3d
Signer

Actual PE Digest

f3:05:de:90:60:89:a5:26:39:ef:a1:b7:c9:67:7a:ca:24:97:4a:38:9c:54:6f:79:13:2f:40:ba:fe:9f:b8:3d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_SetError
PR_Calloc
PR_ErrorToName
PR_GetOSError
PR_GetError
PR_fprintf
PR_GetSpecialFD
PR_Free
PR_Malloc

kernel32

IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

vcruntime140

strchr
strstr
__std_type_info_destroy_list
memcpy
strrchr
memset
_except_handler4_common

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-string-l1-1-0

strncmp
strpbrk

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initterm
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/libplds4.dll
.dll windows:6 windows x86 arch:x86

668bf70d23e574e0a079effa6f3b2010

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:b2:bc:b0:90:5d:63:2c:32:18:50:2f:34:0c:b3:8d:6b:26:4d:2c:1b:d5:36:ed:d2:c8:e4:4c:e6:b4:11:f8
Signer

Actual PE Digest

7f:b2:bc:b0:90:5d:63:2c:32:18:50:2f:34:0c:b3:8d:6b:26:4d:2c:1b:d5:36:ed:d2:c8:e4:4c:e6:b4:11:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_CeilingLog2
PR_Free
PR_Malloc

kernel32

TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter

vcruntime140

_except_handler4_common
memcpy
__std_type_info_destroy_list
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_seh_filter_dll
_initterm
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
PL_SizeOfArenaPoolExcludingPool
libVersionPoint

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/nprotect-root_ca.cer
ncert/nprotect-rootca.cer
ncert/nss3.dll
.dll windows:5 windows x86 arch:x86

2d522a0ab4d34479ae1941af3806ba7c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

74:05:4f:a4:f7:20:d6:c9:d9:7f:b8:c4:83:3a:af:eb:07:09:5e:de:fc:47:e9:83:cc:bb:7a:a1:4a:d6:d4:93
Signer

Actual PE Digest

74:05:4f:a4:f7:20:d6:c9:d9:7f:b8:c4:83:3a:af:eb:07:09:5e:de:fc:47:e9:83:cc:bb:7a:a1:4a:d6:d4:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess

vcruntime140

__std_type_info_destroy_list
memset
_except_handler4_common
strrchr
memmove
strstr
strchr
memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

tolower
strncpy
isspace
strncmp
isdigit

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-stdio-l1-1-0

fflush
fclose
__acrt_iob_func
__stdio_common_vfprintf
fopen

api-ms-win-crt-utility-l1-1-0

qsort

libnspr4

PR_CallOnce
PR_smprintf
PR_smprintf_free
PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_NewCondVar
PR_WaitCondVar
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_Now
PR_TicksPerSecond
PR_SecondsToInterval
PR_Close
PR_Write
PR_NewTCPSocket
PR_Connect
PR_Recv
PR_snprintf
PR_StringToNetAddr
PR_GetHostByName
PR_EnumerateHostEnt
PR_InitializeNetAddr
PR_NewMonitor
PR_DestroyMonitor
PR_EnterMonitor
PR_ExitMonitor
PR_IntervalNow
PR_GetEnvSecure
PR_CallOnceWithArg
PR_Sleep
PR_SetErrorText
PR_htonll
PR_SetEnv
PR_IntervalToSeconds
PR_IntervalToMilliseconds
PR_IntervalToMicroseconds
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_UnloadLibrary
PR_FindSymbol
PR_NewLogModule
PR_LogPrint
PR_NetAddrToString
PR_ConvertIPv4AddrToIPv6
PR_htonl
PR_DestroyCondVar
PR_GetCurrentThread
PR_NewThreadPrivateIndex
PR_SetThreadPrivate
PR_GetThreadPrivate
PR_Calloc
PR_Free

libplc4

PL_strncasecmp
PL_Base64Encode
PL_strncpyz
PL_strcatn
PL_strlen
PL_strcasecmp

libplds4

PL_NewHashTable
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableRemove
PL_HashTableLookup
PL_CompareValues
PL_HashTableEnumerateEntries
PL_InitArenaPool
PL_FinishArenaPool
PL_ArenaAllocate
PL_ArenaRelease
PL_HashString
PL_CompareStrings

nssutil3

PORT_Alloc_Util
PORT_Realloc_Util
PORT_ZAlloc_Util
PORT_Free_Util
PORT_ZFree_Util
PORT_Strdup_Util
PORT_SetError_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
PORT_ArenaStrdup_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_UCS2_ASCIIConversion_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_UCS2_UTF8Conversion_Util
NSS_PutEnv_Util
SECITEM_AllocItem_Util
SECITEM_CompareItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_CopyItem_Util
SECITEM_DupItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_FreeItem_Util
SECITEM_ZfreeItem_Util
SECOID_FindOID_Util
SECOID_FindOIDTag_Util
SECOID_FindOIDByTag_Util
SECOID_SetAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_DestroyAlgorithmID_Util
SECOID_CompareAlgorithmID_Util
SECOID_FindOIDTagDescription_Util
SECOID_AddEntry_Util
SGN_CreateDigestInfo_Util
SGN_DestroyDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CompareDigestInfo_Util
DER_Encode_Util
DER_Lengths_Util
DER_GetInteger_Util
DER_TimeToUTCTime_Util
DER_AsciiToTime_Util
DER_UTCTimeToTime_Util
DER_UTCTimeToAscii_Util
DER_UTCDayToAscii_Util
DER_GeneralizedDayToAscii_Util
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToGeneralizedTimeArena_Util
DER_GeneralizedTimeToTime_Util
CERT_GenTime2FormattedAscii_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1Decode_Util
SEC_ASN1DecodeItem_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1Encode_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1DecodeInteger_Util
SEC_ASN1LengthLength_Util
BTOA_DataToAscii_Util
ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
NSSBase64Decoder_Create_Util
NSSBase64Encoder_Create_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Update_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Encoder_Destroy_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_New_Util
NSSRWLock_Destroy_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_HaveWriteLock_Util
SECOID_Init
SECOID_Shutdown
NSS_InitializePRErrorTable
NSSUTIL_DoubleEscape
NSS_IsPolicyLocked
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
PORT_InitCheapArena
PORT_DestroyCheapArena
NSS_GetAlgorithmPolicy
DER_SetUInteger
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_ObjectIDTemplate_Util
_SGN_VerifyPKCS1DigestInfo
SGN_DecodeDigestInfo
SECOID_FindOIDByMechanism
PK11URI_ParseURI
PK11URI_DestroyURI
PK11URI_GetPathAttribute
PK11URI_GetPathAttributeItem
PK11URI_CreateURI
PK11URI_FormatURI
SECITEM_MakeItem
NSS_SetAlgorithmPolicy
NSS_LockPolicy
NSSUTIL_ArgFetchValue
NSSUTIL_ArgStrip
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgGetLabel
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgIsBlank
NSSUTIL_ArgHasFlag
NSSUTIL_ArgReadLong
NSSUTIL_EscapeSize
NSSUTIL_Escape
NSSUTIL_DoubleEscapeSize
NSSUTIL_ArgParseSlotInfo
NSSUTIL_MkSlotString
NSSUTIL_ArgParseModuleSpecEx
NSSUTIL_MkModuleSpec
NSSUTIL_AddNSSFlagToModuleSpec
NSSUTIL_ArgParseCipherFlags
NSSUTIL_MkNSSString
PORT_LoadLibraryFromOrigin
_NSSUTIL_UTF8ToWide
NSS_Get_SEC_SkipTemplate
SECITEM_Hash
SECITEM_HashCompare
PORT_RegExpValid
PORT_RegExpCaseSearch
SECOID_KnownCertExtenOID
PORT_UCS4_UTF8Conversion
PORT_ISO88591_UTF8Conversion
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_T61StringTemplate
DER_StoreHeader
DER_LengthLength
SEC_StringToOID
DER_GetUInteger

Exports

Exports

ATOB_AsciiToData
ATOB_ConvertAsciiToItem
BTOA_ConvertItemToAscii
BTOA_DataToAscii
CERT_AddCertToListHead
CERT_AddCertToListHeadWithData
CERT_AddCertToListSorted
CERT_AddCertToListTail
CERT_AddCertToListTailWithData
CERT_AddExtension
CERT_AddExtensionByOID
CERT_AddOCSPAcceptableResponses
CERT_AddOKDomainName
CERT_AddRDN
CERT_AllocCERTRevocationFlags
CERT_AsciiToName
CERT_CRLCacheRefreshIssuer
CERT_CacheCRL
CERT_CacheOCSPResponseFromSideChannel
CERT_CertChainFromCert
CERT_CertListFromCert
CERT_CertTimesValid
CERT_ChangeCertTrust
CERT_CheckCertUsage
CERT_CheckCertValidTimes
CERT_CheckNameSpace
CERT_CheckOCSPStatus
CERT_ClearOCSPCache
CERT_CompareAVA
CERT_CompareCerts
CERT_CompareName
CERT_CompareValidityTimes
CERT_CompleteCRLDecodeEntries
CERT_CopyName
CERT_CopyRDN
CERT_CreateAVA
CERT_CreateCertificate
CERT_CreateCertificateRequest
CERT_CreateEncodedOCSPErrorResponse
CERT_CreateEncodedOCSPSuccessResponse
CERT_CreateName
CERT_CreateOCSPCertID
CERT_CreateOCSPRequest
CERT_CreateOCSPSingleResponseGood
CERT_CreateOCSPSingleResponseRevoked
CERT_CreateOCSPSingleResponseUnknown
CERT_CreateRDN
CERT_CreateSubjectCertList
CERT_CreateValidity
CERT_DecodeAVAValue
CERT_DecodeAltNameExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeAuthKeyID
CERT_DecodeBasicConstraintValue
CERT_DecodeCRLDistributionPoints
CERT_DecodeCertificatePoliciesExtension
CERT_DecodeDERCrl
CERT_DecodeDERCrlWithFlags
CERT_DecodeGeneralName
CERT_DecodeNameConstraintsExtension
CERT_DecodeOCSPRequest
CERT_DecodeOCSPResponse
CERT_DecodeOidSequence
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DecodeTrustString
CERT_DecodeUserNotice
CERT_DerNameToAscii
CERT_DestroyCERTRevocationFlags
CERT_DestroyCertArray
CERT_DestroyCertList
CERT_DestroyCertificate
CERT_DestroyCertificateList
CERT_DestroyCertificatePoliciesExtension
CERT_DestroyCertificateRequest
CERT_DestroyName
CERT_DestroyOCSPCertID
CERT_DestroyOCSPRequest
CERT_DestroyOCSPResponse
CERT_DestroyOidSequence
CERT_DestroyUserNotice
CERT_DestroyValidity
CERT_DisableOCSPChecking
CERT_DisableOCSPDefaultResponder
CERT_DistNamesFromCertList
CERT_DupCertList
CERT_DupCertificate
CERT_DupDistNames
CERT_EnableOCSPChecking
CERT_EnableOCSPDefaultResponder
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeCRLDistributionPoints
CERT_EncodeCertPoliciesExtension
CERT_EncodeGeneralName
CERT_EncodeInfoAccessExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodeNameConstraintsExtension
CERT_EncodeNoticeReference
CERT_EncodeOCSPRequest
CERT_EncodePolicyConstraintsExtension
CERT_EncodePolicyMappingExtension
CERT_EncodeSubjectKeyID
CERT_EncodeUserNotice
CERT_ExtractPublicKey
CERT_FilterCertListByCANames
CERT_FilterCertListByCertList
CERT_FilterCertListByNickname
CERT_FilterCertListByUsage
CERT_FilterCertListForUserCerts
CERT_FindCRLEntryReasonExten
CERT_FindCRLNumberExten
CERT_FindCertByDERCert
CERT_FindCertByIssuerAndSN
CERT_FindCertByIssuerAndSNCX
CERT_FindCertByName
CERT_FindCertByNickname
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertByNicknameOrEmailAddrCX
CERT_FindCertByNicknameOrEmailAddrForUsage
CERT_FindCertByNicknameOrEmailAddrForUsageCX
CERT_FindCertBySubjectKeyID
CERT_FindCertExtension
CERT_FindCertIssuer
CERT_FindKeyUsageExtension
CERT_FindNameConstraintsExten
CERT_FindSMimeProfile
CERT_FindSubjectKeyIDExtension
CERT_FindUserCertByUsage
CERT_FindUserCertsByUsage
CERT_FinishCertificateRequestAttributes
CERT_FinishExtensions
CERT_ForcePostMethodForOCSP
CERT_FormatName
CERT_FreeDistNames
CERT_FreeNicknames
CERT_GenTime2FormattedAscii
CERT_GetAVATag
CERT_GetCertChainFromCert
CERT_GetCertEmailAddress
CERT_GetCertIsPerm
CERT_GetCertIsTemp
CERT_GetCertIssuerAndSN
CERT_GetCertKeyType
CERT_GetCertNicknames
CERT_GetCertTimes
CERT_GetCertTrust
CERT_GetCertUid
CERT_GetCertificateDer
CERT_GetCertificateNames
CERT_GetCertificateRequestExtensions
CERT_GetClassicOCSPDisabledPolicy
CERT_GetClassicOCSPEnabledHardFailurePolicy
CERT_GetClassicOCSPEnabledSoftFailurePolicy
CERT_GetCommonName
CERT_GetConstrainedCertificateNames
CERT_GetCountryName
CERT_GetDBContentVersion
CERT_GetDefaultCertDB
CERT_GetDomainComponentName
CERT_GetEncodedOCSPResponse
CERT_GetFirstEmailAddress
CERT_GetGeneralNameTypeFromString
CERT_GetImposedNameConstraints
CERT_GetLocalityName
CERT_GetNextEmailAddress
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
CERT_GetOCSPAuthorityInfoAccessLocation
CERT_GetOCSPResponseStatus
CERT_GetOCSPStatusForCertID
CERT_GetOidString
CERT_GetOrgName
CERT_GetOrgUnitName
CERT_GetPKIXVerifyNistRevocationPolicy
CERT_GetPrevGeneralName
CERT_GetPrevNameConstraint
CERT_GetSSLCACerts
CERT_GetSlopTime
CERT_GetStateName
CERT_GetSubjectNameDigest
CERT_GetSubjectPublicKeyDigest
CERT_GetUsePKIXForValidation
CERT_GetValidDNSPatternsFromCert
CERT_Hexify
CERT_ImportCAChain
CERT_ImportCAChainTrusted
CERT_ImportCRL
CERT_ImportCerts
CERT_IsCACert
CERT_IsCADERCert
CERT_IsInList
CERT_IsRootDERCert
CERT_IsUserCert
CERT_KeyFromDERCrl
CERT_MakeCANickname
CERT_MergeExtensions
CERT_NameToAscii
CERT_NameToAsciiInvertible
CERT_NewCertList
CERT_NewTempCertificate
CERT_NicknameStringsFromCertList
CERT_OCSPCacheSettings
CERT_OpenCertDBFilename
CERT_PKIXVerifyCert
CERT_PostOCSPRequest
CERT_RFC1485_EscapeAndQuote
CERT_RegisterAlternateOCSPAIAInfoCallBack
CERT_RemoveCertListNode
CERT_SaveSMimeProfile
CERT_SetOCSPDefaultResponder
CERT_SetOCSPFailureMode
CERT_SetOCSPTimeout
CERT_SetSlopTime
CERT_SetUsePKIXForValidation
CERT_StartCRLEntryExtensions
CERT_StartCRLExtensions
CERT_StartCertExtensions
CERT_StartCertificateRequestAttributes
CERT_UncacheCRL
CERT_VerifyCACertForUsage
CERT_VerifyCert
CERT_VerifyCertName
CERT_VerifyCertNow
CERT_VerifyCertificate
CERT_VerifyCertificateNow
CERT_VerifyOCSPResponseSignature
CERT_VerifySignedData
CERT_VerifySignedDataWithPublicKey
CERT_VerifySignedDataWithPublicKeyInfo
DER_AsciiToTime
DER_DecodeTimeChoice
DER_Encode
DER_EncodeTimeChoice
DER_GeneralizedDayToAscii
DER_GeneralizedTimeToTime
DER_GetInteger
DER_Lengths
DER_TimeChoiceDayToAscii
DER_TimeToGeneralizedTime
DER_TimeToGeneralizedTimeArena
DER_TimeToUTCTime
DER_UTCDayToAscii
DER_UTCTimeToAscii
DER_UTCTimeToTime
DSAU_DecodeDerSig
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSig
DSAU_EncodeDerSigWithLen
HASH_Begin
HASH_Clone
HASH_Create
HASH_Destroy
HASH_End
HASH_GetHMACOidTagByHashOidTag
HASH_GetHashObject
HASH_GetHashObjectByOidTag
HASH_GetHashOidTagByHashType
HASH_GetHashTypeByOidTag
HASH_GetType
HASH_HashBuf
HASH_ResultLen
HASH_ResultLenByOidTag
HASH_ResultLenContext
HASH_Update
NSSBase64Decoder_Create
NSSBase64Decoder_Destroy
NSSBase64Decoder_Update
NSSBase64Encoder_Create
NSSBase64Encoder_Destroy
NSSBase64Encoder_Update
NSSBase64_DecodeBuffer
NSSBase64_EncodeItem
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
NSS_GetVersion
NSS_Get_CERT_CertificateRequestTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CrlTemplate
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_NameTemplate
NSS_Get_CERT_SequenceOfCertExtensionTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_CERT_SignedCrlTemplate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SECKEY_DSAPublicKeyTemplate
NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_RSAPSSParamsTemplate
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_AnyTemplate
NSS_Get_SEC_BMPStringTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_BooleanTemplate
NSS_Get_SEC_GeneralizedTimeTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_IntegerTemplate
NSS_Get_SEC_NullTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToAnyTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
NSS_Get_SEC_SignedCertificateTemplate
NSS_Get_SEC_UTCTimeTemplate
NSS_Get_SEC_UTF8StringTemplate
NSS_Get_sgn_DigestInfoTemplate
NSS_Init
NSS_InitContext
NSS_InitReadWrite
NSS_InitWithMerge
NSS_Initialize
NSS_IsInitialized
NSS_NoDB_Init
NSS_OptionGet
NSS_OptionSet
NSS_PutEnv
NSS_RegisterShutdown
NSS_Shutdown
NSS_ShutdownContext
NSS_UnregisterShutdown
NSS_VersionCheck
PBE_CreateContext
PBE_DestroyContext
PBE_GenerateBits
PK11SDR_Decrypt
PK11SDR_Encrypt
PK11_AEADOp
PK11_AEADRawOp
PK11_AlgtagToMechanism
PK11_Authenticate
PK11_BlockData
PK11_ChangePW
PK11_CheckSSOPassword
PK11_CheckUserPassword
PK11_CipherOp
PK11_CloneContext
PK11_ConfigurePKCS11
PK11_ContextGetFIPSStatus
PK11_ConvertSessionPrivKeyToTokenPrivKey
PK11_ConvertSessionSymKeyToTokenSymKey
PK11_CopySymKeyForSigning
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_CreateContextByPrivKey
PK11_CreateContextByPubKey
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_CreateGenericObject
PK11_CreateManagedGenericObject
PK11_CreateMergeLog
PK11_CreatePBEAlgorithmID
PK11_CreatePBEParams
PK11_CreatePBEV2AlgorithmID
PK11_DEREncodePublicKey
PK11_Decrypt
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DeleteTokenPublicKey
PK11_DeleteTokenSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_DeriveWithFlagsPerm
PK11_DeriveWithTemplate
PK11_DestroyContext
PK11_DestroyGenericObject
PK11_DestroyGenericObjects
PK11_DestroyMergeLog
PK11_DestroyObject
PK11_DestroyPBEParams
PK11_DestroyTokenObject
PK11_DigestBegin
PK11_DigestFinal
PK11_DigestKey
PK11_DigestOp
PK11_DoesMechanism
PK11_Encrypt
PK11_ExportDERPrivateKeyInfo
PK11_ExportEncryptedPrivKeyInfo
PK11_ExportEncryptedPrivKeyInfoV2
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfoV2
PK11_ExportPrivKeyInfo
PK11_ExportPrivateKeyInfo
PK11_ExtractKeyValue
PK11_Finalize
PK11_FindBestKEAMatch
PK11_FindCertAndKeyByRecipientList
PK11_FindCertAndKeyByRecipientListNew
PK11_FindCertByIssuerAndSN
PK11_FindCertFromDERCert
PK11_FindCertFromDERCertItem
PK11_FindCertFromNickname
PK11_FindCertFromURI
PK11_FindCertInSlot
PK11_FindCertsFromEmailAddress
PK11_FindCertsFromNickname
PK11_FindCertsFromURI
PK11_FindEncodedCertInSlot
PK11_FindFixedKey
PK11_FindGenericObjects
PK11_FindKeyByAnyCert
PK11_FindKeyByDERCert
PK11_FindKeyByKeyID
PK11_FindObjectForCert
PK11_FindPrivateKeyFromCert
PK11_FindRawCertsWithSubject
PK11_FindSlotByName
PK11_FindSlotsByNames
PK11_FortezzaHasKEA
PK11_FortezzaMapSig
PK11_FreeSlot
PK11_FreeSlotList
PK11_FreeSlotListElement
PK11_FreeSymKey
PK11_GenerateFortezzaIV
PK11_GenerateKeyPair
PK11_GenerateKeyPairWithFlags
PK11_GenerateKeyPairWithOpFlags
PK11_GenerateNewParam
PK11_GenerateRandom
PK11_GenerateRandomOnSlot
PK11_GetAllSlotsForCert
PK11_GetAllTokens
PK11_GetBestKeyLength
PK11_GetBestSlot
PK11_GetBestSlotMultiple
PK11_GetBestSlotMultipleWithAttributes
PK11_GetBestSlotWithAttributes
PK11_GetBestWrapMechanism
PK11_GetBlockSize
PK11_GetCertFromPrivateKey
PK11_GetCertsMatchingPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetDefaultArray
PK11_GetDefaultFlags
PK11_GetDisabledReason
PK11_GetFirstSafe
PK11_GetIVLength
PK11_GetInternalKeySlot
PK11_GetInternalSlot
PK11_GetKeyData
PK11_GetKeyGen
PK11_GetKeyLength
PK11_GetKeyStrength
PK11_GetKeyType
PK11_GetLowLevelKeyIDForCert
PK11_GetLowLevelKeyIDForPrivateKey
PK11_GetMechanism
PK11_GetMinimumPwdLength
PK11_GetModInfo
PK11_GetModule
PK11_GetModuleID
PK11_GetModuleURI
PK11_GetNextGenericObject
PK11_GetNextSafe
PK11_GetNextSymKey
PK11_GetObjectHandle
PK11_GetPBECryptoMechanism
PK11_GetPBEIV
PK11_GetPQGParamsFromPrivateKey
PK11_GetPadMechanism
PK11_GetPrevGenericObject
PK11_GetPrivateKeyNickname
PK11_GetPrivateModulusLen
PK11_GetPublicKeyNickname
PK11_GetSlotFromKey
PK11_GetSlotFromPrivateKey
PK11_GetSlotID
PK11_GetSlotInfo
PK11_GetSlotName
PK11_GetSlotPWValues
PK11_GetSlotSeries
PK11_GetSymKeyHandle
PK11_GetSymKeyNickname
PK11_GetSymKeyType
PK11_GetSymKeyUserData
PK11_GetTokenInfo
PK11_GetTokenName
PK11_GetTokenURI
PK11_GetWindow
PK11_GetWrapKey
PK11_HPKE_Deserialize
PK11_HPKE_DestroyContext
PK11_HPKE_ExportContext
PK11_HPKE_ExportSecret
PK11_HPKE_GetEncapPubKey
PK11_HPKE_ImportContext
PK11_HPKE_NewContext
PK11_HPKE_Open

Sections

.text
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/nssckbi.dll
.dll windows:5 windows x86 arch:x86

ab8a9df014dff33b69e5310f088156a3

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:79:72:54:53:fe:14:37:65:1c:cf:97:b3:32:20:cb:81:e6:0c:be:6e:45:14:9a:f4:29:c0:ab:1d:76:05:91
Signer

Actual PE Digest

c3:79:72:54:53:fe:14:37:65:1c:cf:97:b3:32:20:cb:81:e6:0c:be:6e:45:14:9a:f4:29:c0:ab:1d:76:05:91

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess

vcruntime140

memcpy
memset
memmove
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit

libnspr4

PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_Calloc
PR_Free
PR_NewThreadPrivateIndex
PR_SetThreadPrivate
PR_GetThreadPrivate
PR_CallOnce

libplc4

PL_strlen

libplds4

PL_NewHashTable
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableRemove
PL_HashTableLookup
PL_HashTableEnumerateEntries
PL_CompareValues
PL_InitArenaPool
PL_FinishArenaPool
PL_ArenaAllocate

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/nssutil3.dll
.dll windows:5 windows x86 arch:x86

2361772421bbab85dfaf201b5b651497

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

db:a1:f7:d1:53:56:7f:60:3b:12:cd:08:0c:66:35:c2:12:a5:2b:2a:4c:6f:af:10:1b:cb:a4:c2:49:0f:39:35
Signer

Actual PE Digest

db:a1:f7:d1:53:56:7f:60:3b:12:cd:08:0c:66:35:c2:12:a5:2b:2a:4c:6f:af:10:1b:cb:a4:c2:49:0f:39:35

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
SetEnvironmentVariableA
MultiByteToWideChar
MoveFileW
DeleteFileW

vcruntime140

_except_handler4_common
__std_type_info_destroy_list
memcpy
strchr
strrchr
strstr
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_cexit
_initterm
_execute_onexit_table
_initterm_e
_initialize_narrow_environment
_seh_filter_dll
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

isalpha
isalnum
toupper
tolower
strncpy
strncmp
strncat
isdigit
strcmp
isspace

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-stdio-l1-1-0

fclose
feof
fgets
fputs
fwrite
__stdio_common_vfprintf
_close
_wopen
_wfopen

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-filesystem-l1-1-0

_wstat64i32
_waccess

libnspr4

PR_SetError
PR_Malloc
PR_Calloc
PR_Realloc
PR_Free
PR_ExplodeTime
PR_LocalTimeParameters
PR_GMTParameters
PR_FormatTime
PR_ImplodeTime
PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_NewCondVar
PR_DestroyCondVar
PR_WaitCondVar
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_GetCurrentThread
PR_smprintf
PR_smprintf_free
PR_GetEnvSecure
PR_ErrorInstallTable
PR_CallOnce
PR_GetError
PR_snprintf
PR_LoadLibraryWithFlags
PR_GetLibraryFilePathname
PR_GetDirectorySeparator

libplc4

PL_strncasecmp
PL_strpbrk
PL_strlen
PL_strcasecmp

libplds4

PL_NewHashTable
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableLookup
PL_HashTableLookupConst
PL_CompareValues
PL_InitArenaPool
PL_FreeArenaPool
PL_FinishArenaPool
PL_ArenaAllocate
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool

Exports

Exports

ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
CERT_GenTime2FormattedAscii_Util
DER_AsciiToTime_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
DER_Encode_Util
DER_GeneralizedDayToAscii_Util
DER_GeneralizedTimeToTime_Util
DER_GetInteger_Util
DER_GetUInteger
DER_LengthLength
DER_Lengths_Util
DER_SetUInteger
DER_StoreHeader
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToUTCTime_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
NSSBase64Decoder_Create_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_Destroy_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_New_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSSUTIL_AddNSSFlagToModuleSpec
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgFetchValue
NSSUTIL_ArgGetLabel
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgParseCipherFlags
NSSUTIL_ArgParseModuleSpec
NSSUTIL_ArgParseModuleSpecEx
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgReadLong
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_DoModuleDBFunction
NSSUTIL_DoubleEscape
NSSUTIL_DoubleEscapeSize
NSSUTIL_Escape
NSSUTIL_EscapeSize
NSSUTIL_GetVersion
NSSUTIL_MkModuleSpec
NSSUTIL_MkNSSString
NSSUTIL_MkSlotString
NSSUTIL_Quote
NSSUTIL_QuoteSize
NSS_GetAlgorithmPolicy
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_BooleanTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_SkipTemplate
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_InitializePRErrorTable
NSS_IsPolicyLocked
NSS_LockPolicy
NSS_PutEnv_Util
NSS_SecureMemcmp
NSS_SecureMemcmpZero
NSS_SetAlgorithmPolicy
PK11URI_CreateURI
PK11URI_DestroyURI
PK11URI_FormatURI
PK11URI_GetPathAttribute
PK11URI_GetPathAttributeItem
PK11URI_GetQueryAttribute
PK11URI_GetQueryAttributeItem
PK11URI_ParseURI
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaZAlloc_Util
PORT_DestroyCheapArena
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_ISO88591_UTF8Conversion
PORT_InitCheapArena
PORT_LoadLibraryFromOrigin
PORT_NewArena_Util
PORT_Realloc_Util
PORT_RegExpCaseSearch
PORT_RegExpSearch
PORT_RegExpValid
PORT_SetError_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_Strdup_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS4_UTF8Conversion
PORT_ZAllocAlignedOffset_Util
PORT_ZAllocAligned_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocArray
SECITEM_AllocItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupArray
SECITEM_DupItem_Util
SECITEM_FreeArray
SECITEM_FreeItem_Util
SECITEM_Hash
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_MakeItem
SECITEM_ReallocItem
SECITEM_ReallocItemV2
SECITEM_ZfreeArray
SECITEM_ZfreeItem_Util
SECOID_AddEntry_Util
SECOID_CompareAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_FindOIDByTag_Util
SECOID_FindOIDTagDescription_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_KnownCertExtenOID
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeInteger_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderSetMaximumElementSize
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1LengthLength_Util
SEC_QuickDERDecodeItem_Util
SEC_StringToOID
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CreateDigestInfo_Util
SGN_DecodeDigestInfo
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
_NSSUTIL_Access
_NSSUTIL_EvaluateConfigDir
_NSSUTIL_GetSecmodName
_NSSUTIL_UTF8ToWide
_SGN_VerifyPKCS1DigestInfo

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/smime3.dll
.dll windows:5 windows x86 arch:x86

8cc0328ae49d903f53bf6d12f4530763

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:fa:a5:a7:51:b0:74:34:b6:fd:d7:09:76:28:4b:89:c7:56:98:13:0c:8b:31:ba:6f:08:3f:85:af:60:10:77
Signer

Actual PE Digest

1d:fa:a5:a7:51:b0:74:34:b6:fd:d7:09:76:28:4b:89:c7:56:98:13:0c:8b:31:ba:6f:08:3f:85:af:60:10:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess

vcruntime140

__std_type_info_destroy_list
memset
_except_handler4_common
memcpy
memmove
strchr

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_seh_filter_dll
_cexit
_initterm
_execute_onexit_table
_initterm_e

libnspr4

PR_NewLock
PR_DestroyLock
PR_Lock
PR_Unlock
PR_CallOnce
PR_Now

libplc4

PL_strncasecmp

libplds4

PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableLookupConst
PL_CompareValues
PL_NewHashTable

nss3

NSS_Get_CERT_IssuerAndSNTemplate
PK11_GetKeyStrength
CERT_ExtractPublicKey
CERT_FindCertByIssuerAndSN
CERT_GetCertIssuerAndSN
CERT_FindSMimeProfile
SECKEY_PublicKeyStrengthInBits
SECKEY_DestroyPublicKey
SECKEY_GetPublicKeyType
NSS_VersionCheck
PK11_FreeSymKey
PK11_ReferenceSymKey
HASH_GetHashObjectByOidTag
PK11_CreatePBEAlgorithmID
SEC_PKCS5IsAlgorithmPBEAlgTag
PK11_FreeSlot
PK11_GetBestSlot
PK11_AlgtagToMechanism
PK11_KeyGen
PK11_FindCertAndKeyByRecipientListNew
PK11_SetPasswordFunc
CERT_DestroyCertificate
CERT_DupCertificate
CERT_FindSubjectKeyIDExtension
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CopyPrivateKey
SECKEY_CopyPublicKey
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_DestroyPrivateKey
PK11_FindPrivateKeyFromCert
CERT_FindCertByDERCert
CERT_VerifyCert
CERT_CertChainFromCert
CERT_DestroyCertificateList
CERT_DestroyCertArray
CERT_ImportCerts
CERT_NewCertList
CERT_DestroyCertList
CERT_AddCertToListTail
CERT_FilterCertListByUsage
CERT_GetDefaultCertDB
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
CERT_CertListFromCert
CERT_SaveSMimeProfile
SECKEY_GetPrivateKeyType
PK11_FindKeyByAnyCert
SEC_SignData
SGN_Digest
SEC_GetSignatureAlgorithmOidTag
VFY_VerifyDigestDirect
VFY_VerifyDigestWithAlgorithmID
VFY_VerifyDataDirect
VFY_VerifyDataWithAlgorithmID
NSS_RegisterShutdown
NSS_Get_CERT_SetOfSignedCrlTemplate
PK11_IsHW
PK11_GetBlockSize
PK11_ParamFromAlgid
PK11_GenerateNewParam
PK11_ParamToAlgid
PK11_GetSymKeyUserData
PK11_GetSlotFromKey
PK11_DestroyContext
PK11_CreateContextBySymKey
PK11_CipherOp
PK11_GetPBECryptoMechanism
SEC_PKCS5IsAlgorithmPBEAlg
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PubUnwrapSymKey
NSS_Get_CERT_TimeChoiceTemplate
SECKEY_DestroyPrivateKeyInfo
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
HASH_GetHMACOidTagByHashOidTag
PK11_ReferenceSlot
PK11_GetInternalKeySlot
PK11_GetInternalSlot
PK11_IsInternal
PK11_SetSymKeyUserData
PK11_ExportPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfoV2
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreatePBEParams
PK11_DestroyPBEParams
PK11_PBEKeyGen
NSS_OptionGet
CERT_NewTempCertificate
__CERT_DecodeDERCertificate
CERT_IsCADERCert
CERT_IsRootDERCert
PK11_GetTokenName
PK11_ImportPublicKey
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_TraverseCertsForSubjectInSlot
PK11_ImportCertForKeyToSlot
PK11_TraverseCertsForNicknameInSlot
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
PK11_CreatePBEV2AlgorithmID
PK11_FindCertAndKeyByRecipientList
HASH_ResultLen
HASH_GetHashTypeByOidTag

nssutil3

NSS_Get_SEC_OctetStringTemplate_Util
PORT_ZAlloc_Util
PORT_Free_Util
PORT_SetError_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaZAlloc_Util
SECITEM_FreeItem_Util
SECOID_FindOIDTag_Util
SECOID_FindOIDByTag_Util
SECOID_GetAlgorithmTag_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1EncodeItem_Util
SECITEM_AllocItem_Util
SECITEM_CopyItem_Util
SECOID_FindOID_Util
SECOID_SetAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECITEM_ItemsAreEqual_Util
SECOID_CompareAlgorithmID_Util
PORT_Alloc_Util
PORT_GetError_Util
PORT_ArenaAlloc_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SECITEM_ArenaDupItem_Util
SEC_ASN1EncodeInteger_Util
PORT_ArenaGrow_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SECOID_DestroyAlgorithmID_Util
SEC_ASN1DecodeInteger_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_Strdup_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
PORT_ArenaStrdup_Util
SECITEM_CompareItem_Util
SECITEM_ZfreeItem_Util
SGN_CreateDigestInfo_Util
SGN_DestroyDigestInfo_Util
SGN_CopyDigestInfo_Util
PORT_Realloc_Util
PORT_ZFree_Util
SECITEM_DupItem_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecodeItem_Util
DER_GetInteger_Util
NSS_GetAlgorithmPolicy
NSS_SetAlgorithmPolicy
NSS_Get_sgn_DigestInfoTemplate_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1Encode_Util

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_GetVersion
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSContentInfo_SetDontStream
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSSignerInfo_Verify
NSS_CMSType_RegisterContentType
NSS_CMSUtil_VerificationStatusToString
NSS_Get_NSSCMSGenericWrapperDataTemplate
NSS_Get_NSS_PointerToCMSGenericWrapperDataTemplate
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_CreateMSSMIMEEncKeyPrefs
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddCertOrChainAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderRenameCertNicknames
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DecryptionAllowed
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifyDetachedSignatureAtTime
SEC_PKCS7VerifySignature

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/softokn3.dll
.dll windows:5 windows x86 arch:x86

3061f4b6f9f373a5a18fd3b4bdc577eb

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:77:3d:98:b3:0b:7f:16:7a:ea:1a:5c:b7:c3:a3:7a:92:d1:12:32:df:e5:34:60:bb:b1:54:12:6c:9b:47:c1
Signer

Actual PE Digest

a0:77:3d:98:b3:0b:7f:16:7a:ea:1a:5c:b7:c3:a3:7a:92:d1:12:32:df:e5:34:60:bb:b1:54:12:6c:9b:47:c1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetTempPathA

vcruntime140

memset
_except_handler4_common
memcpy
strrchr
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_narrow_environment
_initialize_onexit_table
_seh_filter_dll
_execute_onexit_table
_configure_narrow_argv
_initterm
_initterm_e

nssutil3

NSSUTIL_ArgFetchValue
PORT_Alloc_Util
PORT_Realloc_Util
PORT_ZAlloc_Util
PORT_Free_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
SECITEM_ZfreeItem_Util
SECITEM_HashCompare
DER_SetUInteger
SECOID_Init
SECOID_Shutdown
UTIL_SetForkState
NSSUTIL_DoModuleDBFunction
SEC_QuickDERDecodeItem_Util
NSS_Get_SEC_OctetStringTemplate_Util
PORT_ZFree_Util
PORT_ArenaGrow_Util
_NSSUTIL_Access
_NSSUTIL_UTF8ToWide
DER_GetInteger_Util
SECITEM_ItemsAreEqual_Util
SECOID_DestroyAlgorithmID_Util
SECITEM_CompareItem_Util
_NSSUTIL_EvaluateConfigDir
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgGetLabel
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
PORT_Strdup_Util
SECITEM_FreeItem_Util
SECITEM_AllocItem_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1DecodeItem_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDByMechanism
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
DER_Encode_Util
_SGN_VerifyPKCS1DigestInfo
SECITEM_DupItem_Util
SECITEM_CopyItem_Util
NSS_SecureMemcmp
PORT_SetError_Util

sqlite3

sqlite3_close
sqlite3_exec
sqlite3_busy_timeout
sqlite3_mprintf
sqlite3_free
sqlite3_open_v2
sqlite3_bind_blob
sqlite3_file_control
sqlite3_reset
sqlite3_finalize
sqlite3_column_bytes
sqlite3_column_text
sqlite3_column_int
sqlite3_column_blob
sqlite3_step
sqlite3_bind_text
sqlite3_bind_int
sqlite3_prepare_v2

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

islower
isdigit
isupper

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-heap-l1-1-0

realloc
free
malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_wchmod

libnspr4

PR_DestroyMonitor
PR_NewMonitor
PR_Access
PR_Now
PR_GetCurrentThread
PR_MillisecondsToInterval
PR_IntervalNow
PR_LoadLibraryWithFlags
PR_smprintf
PR_EnterMonitor
PR_snprintf
PR_GetEnv
PR_Sleep
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_SecondsToInterval
PR_UnloadLibrary
PR_GetEnvSecure
PR_FindFunctionSymbol
PR_GetDirectorySeparator
PR_CallOnce
PR_smprintf_free
PR_SetError
PR_ExitMonitor
PR_GetLibraryFilePathname
PR_Free

libplc4

PL_strncasecmp
PL_strcasecmp

libplds4

PL_HashTableDestroy
PL_NewHashTable
PL_HashTableEnumerateEntries
PL_HashTableRemove
PL_HashTableLookup
PL_HashTableLookupConst
PL_CompareValues
PL_HashTableAdd

Exports

Exports

C_GetFunctionList
C_GetInterface
C_GetInterfaceList
FC_GetFunctionList
FC_GetInterface
FC_GetInterfaceList
NSC_GetFunctionList
NSC_GetInterface
NSC_GetInterfaceList
NSC_ModuleDBFunc

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/sqlite3.dll
.dll windows:5 windows x86 arch:x86

1b5dd29fa5d117a8d6dfd79204d5034c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

19:06:a8:72:cb:f0:4d:1f:6e:1d:af:0a:6c:24:87:fe:e5:a1:71:3c:5b:f6:36:76:50:4f:c8:5d:99:9d:5d:36
Signer

Actual PE Digest

19:06:a8:72:cb:f0:4d:1f:6e:1d:af:0a:6c:24:87:fe:e5:a1:71:3c:5b:f6:36:76:50:4f:c8:5d:99:9d:5d:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
AreFileApisANSI
ReadFile
HeapCreate
HeapFree
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
LocalFree
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject

vcruntime140

_except_handler4_common
memset
__std_type_info_destroy_list
strrchr
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_beginthreadex
_cexit
_endthreadex

api-ms-win-crt-heap-l1-1-0

_msize
malloc
realloc
free

api-ms-win-crt-string-l1-1-0

strncmp
strcspn

api-ms-win-crt-time-l1-1-0

_localtime64_s

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_load_extension
sqlite3_malloc
sqlite3_mprintf
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_realloc
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_step
sqlite3_thread_cleanup
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vmprintf
sqlite3_wal_checkpoint

Sections

.text
Size: 589KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/ssl3.dll
.dll windows:5 windows x86 arch:x86

0462c0ee42eb50a76dbfd1359bb45994

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

24:4b:50:60:66:ad:d7:13:00:2c:06:f8:2e:bf:f3:56:f4:da:98:9e:e5:4a:08:77:fc:03:bc:c4:43:4b:63:84
Signer

Actual PE Digest

24:4b:50:60:66:ad:d7:13:00:2c:06:f8:2e:bf:f3:56:f4:da:98:9e:e5:4a:08:77:fc:03:bc:c4:43:4b:63:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
CloseHandle

vcruntime140

memcpy
memmove
strstr
strchr
memchr
memset
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_cexit
_initterm
_execute_onexit_table
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_getpid
_initialize_onexit_table

nss3

PK11_GetCurrentWrapIndex
PK11_GetSlotID
PK11_GetModuleID
PK11_TokenExists
PK11_IsPresent
PK11_DoesMechanism
PK11_GetBestWrapMechanism
PK11_GetBestKeyLength
PK11_ReferenceSymKey
PK11_SymKeyFromHandle
PK11_GetWrapKey
PK11_SetWrapKey
PK11_GetMechanism
PK11_WrapSymKey
PK11_MoveSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_PubDerive
PK11_PubDeriveWithKDF
PK11_UnwrapSymKey
PK11_UnwrapSymKeyWithFlags
PK11_ExtractKeyValue
PK11_GetKeyData
PK11_GetSlotFromKey
PK11_DigestKey
PK11_VerifyKeyOK
PK11_FindObjectForCert
PK11_SignatureLen
PK11_GetSlotFromPrivateKey
PK11_SignWithMechanism
PK11_SignWithSymKey
PK11_VerifyWithMechanism
PK11_DestroyContext
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_DigestBegin
PK11_HashBuf
PK11_DigestOp
PK11_CipherOp
PK11_DigestFinal
PK11_SaveContextAlloc
PK11_GetSlotSeries
PK11_ContextGetFIPSStatus
SECMOD_LookupSlot
PK11_CloneContext
PK11_AEADOp
PK11_Encrypt
PK11_ImportDataKey
PK11_HPKE_ValidateParameters
PK11_HPKE_NewContext
PK11_HPKE_Deserialize
PK11_HPKE_GetEncapPubKey
PK11_HPKE_Open
PK11_HPKE_Seal
PK11_HPKE_Serialize
PK11_HPKE_SetupS
PK11_HPKE_SetupR
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_DecodeDERSubjectPublicKeyInfo
PK11_GetSymKeyHandle
PK11_SymKeysToSameSlot
PK11_HPKE_ExportContext
PK11_HPKE_ImportContext
PK11_Decrypt
CERT_DestroyCertificate
CERT_DupCertificate
CERT_GetDefaultCertDB
CERT_FreeDistNames
CERT_DupDistNames
SECKEY_BigIntegerBitLength
SECKEY_CopyPrivateKey
SECKEY_CopyPublicKey
SECKEY_DestroyPrivateKey
SECKEY_DestroyPublicKey
NSS_RegisterShutdown
NSS_OptionGet
PK11_PQG_ParamGenV2
PK11_PQG_VerifyParams
PK11_PQG_DestroyParams
PK11_PQG_DestroyVerify
PK11_GenerateRandom
NSS_VersionCheck
CERT_FindCertByName
CERT_ExtractPublicKey
CERT_GetSSLCACerts
CERT_CertChainFromCert
CERT_DupCertList
CERT_DestroyCertificateList
SECKEY_PublicKeyStrengthInBits
SECKEY_ExtractPublicKey
SECKEY_CacheStaticFlags
SECKEY_GetPrivateKeyType
PK11_RestoreContext
SECKEY_GetPublicKeyType
PK11_ReferenceSlot
PK11_FreeSlot
PK11_GetBestSlot
PK11_MapSignKeyType
PK11_CopyTokenPrivKeyToSessionPrivKey
NSS_Get_CERT_NameTemplate
CERT_NameToAscii
CERT_DestroyCertList
CERT_RemoveCertListNode
CERT_FilterCertListByUsage
CERT_FindUserCertsByUsage
CERT_FilterCertListByCANames
CERT_FilterCertListForUserCerts
CERT_FilterCertListByNickname
PK11_FindKeyByAnyCert
PK11_FindCertsFromNickname
CERT_DistNamesFromCertList
PK11_HPKE_DestroyContext
CERT_VerifyCertName
CERT_VerifyCert
PK11_NeedLogin
PK11_IsLoggedIn
HASH_ResultLenByOidTag
VFY_VerifyDigestDirect
SGN_Digest
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSigWithLen
SECKEY_CreateECPrivateKey
SECKEY_CreateDHPrivateKey
SECKEY_SignatureLen
SECKEY_UpdateCertPQG
NSS_Get_SECKEY_RSAPSSParamsTemplate
HASH_HashBuf
PK11_PubUnwrapSymKey
PK11_PubWrapSymKey
PK11_KeyGen
PK11_FreeSymKey
PK11_GetBestSlotMultiple
SECKEY_PublicKeyStrength
CERT_NewTempCertificate
CERT_CacheOCSPResponseFromSideChannel
CERT_AddCertToListTail
CERT_NewCertList

nssutil3

SECOID_FindOIDByTag_Util
SECOID_FindOID_Util
DER_DecodeTimeChoice_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_Realloc_Util
SECITEM_ZfreeItem_Util
SECOID_FindOIDByMechanism
SECITEM_MakeItem
NSS_SecureMemcmp
PORT_ArenaZAlloc_Util
PORT_DestroyCheapArena
PORT_InitCheapArena
SECITEM_DupItem_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
SECITEM_Hash
NSS_PutEnv_Util
SEC_QuickDERDecodeItem_Util
PORT_FreeArena_Util
PORT_NewArena_Util
SECOID_GetAlgorithmTag_Util
SECITEM_AllocArray
SECITEM_DupArray
SECITEM_CompareItem_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_LockWrite_Util
NSSRWLock_Destroy_Util
NSSRWLock_New_Util
NSS_IsPolicyLocked
NSS_GetAlgorithmPolicy
SECITEM_FreeItem_Util
SECITEM_CopyItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_AllocItem_Util
PORT_ArenaAlloc_Util
PORT_GetError_Util
PORT_Strdup_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockRead_Util
PORT_SetError_Util
PORT_ZFree_Util
PORT_Free_Util
PORT_ZAlloc_Util
PORT_Alloc_Util
SECITEM_FreeArray

api-ms-win-crt-stdio-l1-1-0

fopen
fputs
ftell
fflush
fwrite
fclose

libnspr4

PR_smprintf_free
PR_snprintf
PR_CloseFileMap
PR_MemUnmap
PR_MemMap
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_DestroyRWLock
PR_NewRWLock
PR_htonll
PR_CallOnceWithArg
PR_ConvertIPv4AddrToIPv6
PR_CallOnce
PR_GetEnvSecure
PR_PopIOLayer
PR_SetError
PR_GetSocketOption
PR_Close
PR_OpenAnonFileMap
PR_CreateIOLayerStub
PR_GetDefaultIOMethods
PR_GetIdentitiesLayer
PR_GetUniqueIdentity
PR_Now
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_DestroyMonitor
PR_NewMonitor
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ExitMonitor
PR_EnterMonitor
PR_MillisecondsToInterval
PR_IntervalNow
PR_RWLock_Rlock
PR_ExportFileMapAsString
PR_ImportFileMapFromString
PR_ExplodeTime
PR_Sleep
PR_Free
PR_GetMonitorEntryCount
PR_PushIOLayer
PR_GMTParameters
PR_FormatTime
PR_StringToNetAddr
PR_ErrorInstallTable
PR_ntohl
PR_GetError
PR_GetCurrentThread
PR_smprintf

libplc4

PL_strdup

Exports

Exports

DTLS_GetHandshakeTimeout
DTLS_ImportFD
NSSSSL_GetVersion
NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AlertReceivedCallback
SSL_AlertSentCallback
SSL_AuthCertificate
SSL_AuthCertificateComplete
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CertIsUsable
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ClientCertCallbackComplete
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigSecureServerWithCertChain
SSL_ConfigServerCert
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DHEGroupPrefSet
SSL_DataPending
SSL_EnableWeakDHEPrimeGroup
SSL_ExportEarlyKeyingMaterial
SSL_ExportKeyingMaterial
SSL_FilterClientCertListBySocket
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetExperimentalAPI
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNextProto
SSL_GetNumImplementedCiphers
SSL_GetPreliminaryChannelInfo
SSL_GetSRTPCipher
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NamedGroupConfig
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PeerCertificateChain
SSL_PeerSignedCertTimestamps
SSL_PeerStapledOCSPResponses
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_RecommendedCanFalseStart
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SendAdditionalKeyShares
SSL_SetCanFalseStartCallback
SSL_SetDowngradeCheckVersion
SSL_SetMaxServerCacheLocks
SSL_SetNextProtoCallback
SSL_SetNextProtoNego
SSL_SetPKCS11PinArg
SSL_SetSRTPCiphers
SSL_SetSessionTicketKeyPair
SSL_SetSignedCertTimestamps
SSL_SetSockPeerID
SSL_SetStapledOCSPResponses
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache
SSL_SignatureMaxCount
SSL_SignaturePrefGet
SSL_SignaturePrefSet
SSL_SignatureSchemePrefGet
SSL_SignatureSchemePrefSet
SSL_VersionRangeGet
SSL_VersionRangeGetDefault
SSL_VersionRangeGetSupported
SSL_VersionRangeSet
SSL_VersionRangeSetDefault

Sections

.text
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ncert/vcruntime140.dll
.dll windows:6 windows x86 arch:x86

6a84b7445ccacd5d29ac27de2745f356

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:fb:1b:61:8d:d4:5f:96:36:01:00:00:00:00:00:fb
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:73:6a:e8:e7:07:d6:94:a4:9a:f1:e5:8f:03:af:2a:11:d4:fa:85:b6:39:df:5d:1f:ef:6c:1b:90:c7:60:52
Signer

Actual PE Digest

ff:73:6a:e8:e7:07:d6:94:a4:9a:f1:e5:8f:03:af:2a:11:d4:fa:85:b6:39:df:5d:1f:ef:6c:1b:90:c7:60:52

Digest Algorithm

sha256

PE Digest Matches

true

d3:9b:49:12:18:52:3d:bf:97:29:f2:47:29:07:b4:a8:b9:76:c6:b9
Signer

Actual PE Digest

d3:9b:49:12:18:52:3d:bf:97:29:f2:47:29:07:b4:a8:b9:76:c6:b9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\agent\_work\3\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

abort
terminate

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-convert-l1-1-0

atol

kernel32

DeleteCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
FreeLibrary
RtlUnwind
VirtualQuery
EncodePointer
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree

Exports

Exports

_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nosApsData.npb
nos_launcher.exe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb
Signer

Actual PE Digest

1c:9e:d0:c4:a9:88:85:62:7e:f8:08:ff:8c:34:14:22:b6:5b:2b:7f:dd:60:cf:a5:25:ff:aa:d7:6c:ea:82:cb

Digest Algorithm

sha256

PE Digest Matches

true

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23
Signer

Actual PE Digest

8a:6b:38:e1:eb:99:ce:89:fe:21:b0:67:b8:70:df:fd:83:ec:dc:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 772KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wdnyxedj
Size: 924KB - Virtual size: 924KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qsgkyqdu
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nos_param.dat
nosapp.dll
.dll windows:4 windows x86 arch:x86

6dff77951608ec4f864ddb6ef6ab8739

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:02:18:4a:79:fc:4e:57:6d:6c:d0:5c:34:95:e9:19:a2:75:80:40:fb:10:d0:84:b1:6b:43:b6:21:af:79:cb
Signer

Actual PE Digest

f0:02:18:4a:79:fc:4e:57:6d:6c:d0:5c:34:95:e9:19:a2:75:80:40:fb:10:d0:84:b1:6b:43:b6:21:af:79:cb

Digest Algorithm

sha256

PE Digest Matches

true

7b:98:e1:9a:12:a6:32:c3:57:a7:48:46:b6:93:21:66:76:bc:40:44
Signer

Actual PE Digest

7b:98:e1:9a:12:a6:32:c3:57:a7:48:46:b6:93:21:66:76:bc:40:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\nossdk\nosapp\build\bin\release\nosapp.pdb

Imports

kernel32

IsBadReadPtr
GetLastError
GetProcessHeap
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleW
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
LocalAlloc
CreateDirectoryW
GetModuleHandleA
TerminateProcess
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentProcess
ReadFile
CreateProcessW
SetLastError
GetUserDefaultUILanguage
EnumUILanguagesW
FindClose
FindFirstFileW
CreateFileW
WriteFile
SetFileAttributesW
DeleteFileW
WideCharToMultiByte
OutputDebugStringW
FormatMessageW
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetSystemInfo
CreateEventA
GetSystemTimeAsFileTime
ResetEvent
CreateMutexW
OpenMutexW
ReleaseMutex
GetFileSize
SetFilePointer
MoveFileW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitThread
GetCurrentThreadId
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetFileAttributesW
HeapReAlloc
RaiseException
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetConsoleCP
GetConsoleMode
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GetSystemTime
GlobalMemoryStatusEx
QueryPerformanceFrequency
WaitForSingleObject
SetEvent
CreateEventW
DeviceIoControl
Sleep
CreateFileA
GetTickCount
CloseHandle
TerminateThread
FreeLibrary
GetProcAddress
MultiByteToWideChar
LoadLibraryW

user32

FindWindowW
GetCursorPos
IsWindow
PostMessageW
MessageBoxW
GetSystemMetrics

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

iphlpapi

GetBestRoute
GetAdaptersInfo
GetAdaptersAddresses

ws2_32

inet_addr
inet_ntoa

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

userenv

DestroyEnvironmentBlock

crypt32

CryptMsgClose
CertGetNameStringW
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust

wininet

HttpOpenRequestW
HttpQueryInfoW
FtpOpenFileW
HttpSendRequestW
InternetReadFile
InternetQueryDataAvailable
InternetConnectW
InternetCloseHandle
FtpGetFileSize
InternetSetOptionW
InternetOpenW

advapi32

DuplicateTokenEx
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatus
StartServiceW
GetTokenInformation
RegOpenKeyExW
SetTokenInformation
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
GetKernelObjectSecurity
GetSecurityDescriptorDacl
GetUserNameW
ConvertSidToStringSidW
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
CreateProcessAsUserW
SetKernelObjectSecurity
GetSidSubAuthorityCount
BuildExplicitAccessWithNameW
SetEntriesInAclW
MakeAbsoluteSD
GetSidSubAuthority
SetSecurityDescriptorDacl

ole32

CoTaskMemFree
CoCreateGuid

Exports

Exports

?getNpkWindowEditText@@YAKPAUHWND__@@PA_WH1H@Z
?getNpkWindowText@@YAKPAUHWND__@@PA_WH@Z
finalizeSdk
finalizeSdkEx
getDataFdsA
getDataFdsExA
getDataFdsExW
getDataFdsItemA
getDataFdsItemW
getDataFdsNoCodeA
getDataFdsNoCodeW
getDataFdsW
getFdsStatus
getMacAddressA
getMacAddressW
getNosStatus
getNpkSecOption
getNpkStatus
getNpkWindowEditTextA
getNpkWindowEditTextW
getNpkWindowTextA
getNpkWindowTextW
getNpnStatus
getProcProtectStatus
initializeSdkA
initializeSdkASyncExA
initializeSdkASyncExW
initializeSdkExA
initializeSdkExW
initializeSdkW
isVerified
pauseProcProtect
refreshFds
regNosSDKStatusCallback
registerNpkWindowsCallbackMsg
registerNpkWindowsMsg
registerNpkWindowsMsgParent
resumeProcProtect
setAllowPathA
setAllowPathW
setCustomDataFdsA
setCustomDataFdsW
setFdsTimeoutOption
setNosInstallOption
setNosInstallOptionExA
setNosInstallOptionExW
setNosLauncherA
setNosLauncherW
setNpkSecOption
setProtectPathA
setProtectPathW
setupNos
startFds
startFdsEx
startNos
startNpk
startNpkEx
startNpkSecurity
startNpn
startNpnEx
startProcProtect
startProcProtectEx
startSecure
startSecureEx
stopFds
stopNpk
stopNpkSecurity
stopNpn
stopProcProtect
stopSecure
unregisterNpkWindowsMsg
unregisterNpkWindowsMsgParent

Sections

.text
Size: 344KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nosapp64.dll
.dll windows:4 windows x64 arch:x64

b98af9707f556e2bab5a4b316822e7c4

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:31:40:6d:72:54:d9:92:6d:6f:15:30:3f:af:73:24:9b:85:f4:d4:f7:55:50:7d:2b:90:0d:ea:d9:99:18:39
Signer

Actual PE Digest

2e:31:40:6d:72:54:d9:92:6d:6f:15:30:3f:af:73:24:9b:85:f4:d4:f7:55:50:7d:2b:90:0d:ea:d9:99:18:39

Digest Algorithm

sha256

PE Digest Matches

true

74:69:35:7c:90:b0:b5:58:7d:6d:fb:3a:18:24:d3:a5:28:22:6c:ff
Signer

Actual PE Digest

74:69:35:7c:90:b0:b5:58:7d:6d:fb:3a:18:24:d3:a5:28:22:6c:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\nossdk\nosapp\build\x64\release\nosapp64.pdb

Imports

kernel32

IsBadReadPtr
GetSystemTime
GlobalMemoryStatusEx
QueryPerformanceFrequency
ProcessIdToSessionId
GetCurrentProcess
ReadFile
CreateToolhelp32Snapshot
Process32FirstW
GetModuleHandleW
LocalAlloc
Process32NextW
GetModuleHandleA
OpenProcess
GetLastError
TerminateProcess
LocalFree
CreateProcessW
SetLastError
GetModuleFileNameW
VirtualQuery
CreateDirectoryW
GetProcessHeap
HeapFree
HeapAlloc
GetUserDefaultUILanguage
EnumUILanguagesW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
SetFileAttributesW
DeleteFileW
FindClose
FindFirstFileW
WideCharToMultiByte
MultiByteToWideChar
CreateMutexW
OpenMutexW
ReleaseMutex
CreateEventA
GetSystemTimeAsFileTime
GetFileSize
ResetEvent
OutputDebugStringW
FormatMessageW
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetSystemInfo
GetSystemWow64DirectoryW
SetFilePointer
MoveFileW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
ExitThread
GetCurrentThreadId
CreateThread
FlsSetValue
GetCommandLineA
GetVersionExA
GetFileAttributesW
HeapReAlloc
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
FlsGetValue
TlsAlloc
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSize
ExitProcess
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
LoadLibraryA
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
TlsGetValue
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
Sleep
GetTickCount
TerminateThread
WaitForSingleObject
DeviceIoControl
CreateFileA
CloseHandle
SetEvent
CreateEventW
GetCurrentProcessId
FreeLibrary
GetProcAddress
WriteFile
LoadLibraryW

user32

IsWindow
PostMessageW
FindWindowW
GetCursorPos
MessageBoxW
GetSystemMetrics

shell32

ShellExecuteExW
SHGetFolderPathW
ShellExecuteW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathIsDirectoryW
PathRemoveBackslashW
PathFileExistsW

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetBestRoute

userenv

DestroyEnvironmentBlock

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

ws2_32

inet_ntoa
inet_addr

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

wininet

InternetReadFile
FtpOpenFileW
HttpQueryInfoW
HttpOpenRequestW
InternetQueryDataAvailable
InternetConnectW
InternetOpenW
InternetCloseHandle
HttpSendRequestW
FtpGetFileSize
InternetSetOptionW

advapi32

SetTokenInformation
DuplicateTokenEx
RegCloseKey
GetKernelObjectSecurity
LookupPrivilegeValueW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetUserNameW
BuildExplicitAccessWithNameW
SetEntriesInAclW
MakeAbsoluteSD
SetSecurityDescriptorDacl
OpenProcessToken
SetKernelObjectSecurity
GetSidSubAuthority
RegOpenKeyExW
GetSidSubAuthorityCount
CreateProcessAsUserW
GetTokenInformation
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountSidW
GetSidIdentifierAuthority
IsValidSid
ConvertSidToStringSidW
StartServiceW
QueryServiceStatus
QueryServiceConfigW
RegQueryValueExW
InitializeSecurityDescriptor
OpenServiceW
OpenSCManagerW
CloseServiceHandle

ole32

CoTaskMemFree
CoCreateGuid

Exports

Exports

?getNpkWindowEditText@@YAKPEAUHWND__@@PEA_WH1H@Z
?getNpkWindowText@@YAKPEAUHWND__@@PEA_WH@Z
finalizeSdk
finalizeSdkEx
fn_getVersion
getClientEnCryptData
getClientEnCryptDataLength
getDataFdsA
getDataFdsExA
getDataFdsExW
getDataFdsItemA
getDataFdsItemW
getDataFdsNoCodeA
getDataFdsNoCodeW
getDataFdsW
getE2EEnCryptLength
getEnCryptData
getFdsStatus
getMacAddressA
getMacAddressW
getNosStatus
getNpkSecOption
getNpkStatus
getNpkWindowEditTextA
getNpkWindowEditTextW
getNpkWindowTextA
getNpkWindowTextW
getNpnStatus
getProcProtectStatus
getSdkVersion
initializeNosSdkE2E
initializeSdkA
initializeSdkASyncExA
initializeSdkASyncExW
initializeSdkExA
initializeSdkExW
initializeSdkW
isVerified
pauseProcProtect
refreshFds
regNosSDKStatusCallback
registerCryptE2EHwnd
registerNpkWindowsCallbackMsg
registerNpkWindowsMsg
registerNpkWindowsMsgParent
resumeProcProtect
setAllowPathA
setAllowPathW
setCustomDataFdsA
setCustomDataFdsW
setFdsTimeoutOption
setNosInstallOption
setNosInstallOptionExA
setNosInstallOptionExW
setNosLauncherA
setNosLauncherW
setNpkSecOption
setProtectPathA
setProtectPathW
setupNos
startFds
startFdsEx
startNos
startNpk
startNpkEx
startNpkSecurity
startNpn
startNpnEx
startProcProtect
startProcProtectEx
startSecure
startSecureEx
stopFds
stopNpk
stopNpkSecurity
stopNpn
stopProcProtect
stopSecure
unInitializeNosSdkE2E
unRegisterE2EHwnd
unregisterNpkWindowsMsg
unregisterNpkWindowsMsgParent

Sections

.text
Size: 573KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nosscanner.npe
.exe windows:4 windows x86 arch:x86

9df2da177b256740a2f1414d07172b17

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/11/2017, 00:00

Not After

05/11/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2017, 00:00

Not After

05/11/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

40:6b:d5:07:54:aa:a4:8c:66:49:e1:29:f5:22:2e:24:77:45:7e:7a:c8:18:d7:d6:d5:3e:af:96:30:85:45:01
Signer

Actual PE Digest

40:6b:d5:07:54:aa:a4:8c:66:49:e1:29:f5:22:2e:24:77:45:7e:7a:c8:18:d7:d6:d5:3e:af:96:30:85:45:01

Digest Algorithm

sha256

PE Digest Matches

true

ac:28:27:fb:bc:41:02:fb:ed:0d:96:91:61:93:16:58:d2:7d:e1:75
Signer

Actual PE Digest

ac:28:27:fb:bc:41:02:fb:ed:0d:96:91:61:93:16:58:d2:7d:e1:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_build\nProtectZ\product\npn60\nosscanner\build\bin\release\nosscanner.pdb

Imports

shlwapi

PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathFindFileNameW
StrRetToStrW
PathRemoveBackslashW
PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW

psapi

GetModuleBaseNameW

kernel32

VirtualAlloc
RtlUnwind
ExitThread
CreateThread
ExitProcess
RaiseException
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
VirtualProtect
LCMapStringA
LCMapStringW
SetStdHandle
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
CreateFileA
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
CreateMutexA
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetTickCount
GetFileTime
FreeLibrary
CreateMutexW
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
SetErrorMode
SystemTimeToFileTime
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
FlushFileBuffers
GetThreadLocale
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
lstrlenA
InterlockedDecrement
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
MulDiv
FreeResource
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
LoadLibraryExW
CompareStringA
lstrcmpW
GlobalAddAtomW
GetCurrentThreadId
ResumeThread
InterlockedExchange
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
lstrlenW
lstrcpynW
FindNextFileW
GetWindowsDirectoryW
EnumUILanguagesW
GetLocaleInfoW
TerminateProcess
GetCurrentProcessId
ProcessIdToSessionId
CreateProcessW
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LocalAlloc
OpenMutexW
GetSystemInfo
GetModuleHandleW
GetCurrentProcess
GetModuleHandleA
VerifyVersionInfoW
VerSetConditionMask
GetVersion
ReleaseMutex
ResetEvent
SetEvent
WaitForSingleObject
CreateEventW
HeapFree
GetProcessHeap
HeapAlloc
CreateEventA
GetSystemTimeAsFileTime
GetUserDefaultUILanguage
OutputDebugStringW
VirtualQuery
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
CreateDirectoryW
LocalFree
FormatMessageW
UnlockFile
LockFile
GetLocalTime
Sleep
GetSystemDirectoryW
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
DeleteFileW
SetFilePointer
CreateFileW
WriteFile
ReadFile
GetFileSize
SetLastError
GetDriveTypeW
FindResourceW
LoadResource
LockResource
SizeofResource
IsValidCodePage

user32

PostThreadMessageW
RegisterClipboardFormatW
UnregisterClassW
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
GetSysColorBrush
CharUpperW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
UnregisterClassA
LoadIconW
ClientToScreen
GetClientRect
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuItemID
GetMenuItemCount
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
EndDialog
GetLastActivePopup
IsWindowEnabled
EndPaint
BeginPaint
GetWindowDC
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
PeekMessageW
ValidateRect
TabbedTextOutW
SetRect
PtInRect
EnableWindow
SendMessageW
PostMessageW
GetDesktopWindow
LoadBitmapW
InvalidateRect
GetSystemMetrics
GetParent
IsWindow
ShowWindow
MessageBoxW
IsWindowVisible
GetWindowTextLengthW
GetWindow
GetWindowLongW
GetWindowThreadProcessId
GetDC
ReleaseDC
SystemParametersInfoW
GetCursorPos
ScreenToClient
TrackMouseEvent
DestroyWindow
SetFocus
OffsetRect
SetWindowPos
MoveWindow
SetWindowTextW
GetWindowRect
WindowFromPoint
InflateRect
CopyRect
GetSubMenu
GetActiveWindow
GetNextDlgTabItem
GrayStringW
DestroyMenu
DrawTextExW
FillRect
GetSysColor
SetCursor
DestroyCursor
CopyIcon
LoadCursorW
SetWindowLongW
DrawTextW
RedrawWindow

gdi32

GetTextColor
GetBkColor
CreateRectRgnIndirect
GetDeviceCaps
ExtSelectClipRgn
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
ScaleWindowExtEx
DeleteObject
CreateSolidBrush
CreateCompatibleDC
BitBlt
GetObjectW
GetStockObject
Rectangle
CreateFontIndirectW
StretchBlt
CreateCompatibleBitmap
GetTextExtentPoint32W
SetTextColor
GetCurrentObject
CreatePen
BeginPath
SetPixel
RoundRect
GetPixel
EndPath
TextOutW
GetTextMetricsW
SetBkMode
SetBkColor
MoveToEx
LineTo
SelectObject
DeleteDC
SetTextJustification
CreateBitmap
Escape
GetMapMode
PtVisible
GetWindowExtEx
RectVisible
GetViewportExtEx
ExtTextOutW
GetRgnBox
SaveDC
RestoreDC
SetMapMode
GetClipBox
SetWindowExtEx

msimg32

GradientFill
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

ConvertStringSidToSidW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetUserNameW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetLengthSid
RegCreateKeyExW
RegEnumKeyW
RegQueryValueW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
CreateProcessAsUserW
SetKernelObjectSecurity
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
GetKernelObjectSecurity
AdjustTokenPrivileges
LookupPrivilegeValueW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
DuplicateTokenEx
GetSidSubAuthority
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegDeleteKeyW
RegSetValueExW

shell32

SHGetFileInfoW
SHGetDesktopFolder
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW

comctl32

_TrackMouseEvent
InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CoRevokeClassObject
OleIsCurrentClipboard
CoRegisterMessageFilter
OleFlushClipboard

oleaut32

SysAllocString
VariantCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
SafeArrayDestroy

gdiplus

GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipGetImageHeight
GdipCloneBitmapAreaI
GdipAlloc
GdipGetImageGraphicsContext
GdipFree
GdipDrawImageRectI
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipCreateFromHDC
GdipCloneBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateHBITMAPFromBitmap
GdipDrawLineI
GdipDrawRectangleI
GdipCreateLineBrushFromRectI
GdipSetPenColor
GdipSetLineColors
GdiplusStartup
GdipFillPolygonI
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipCreateImageAttributes
GdipGetDC
GdipDisposeImageAttributes
GdipReleaseDC
GdipCloneImage
GdipAddPathLine
ord1
GdipClosePathFigure
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipDisposeImage
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipFillRectangleI
GdipDeleteGraphics
GdipDeleteBrush

mpr

WNetGetConnectionW

wintrust

WinVerifyTrust

netapi32

NetGetJoinInformation
NetLocalGroupGetMembers
NetApiBufferFree

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgGetParam

Sections

.text
Size: 676KB - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 285KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nossdk.npd
.dll windows:4 windows x86 arch:x86

9e5193d83ed6fe9176fcd6a62b9781d9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d8:1f:b6:ae:d0:e1:7c:88:e2:a5:89:09:eb:72:69
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/10/2021, 00:00

Not After

10/10/2022, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:ef:2e:25:ef:62:13:88:b7:4e:a3:0b:f3:47:0f:de:6d:25:f5:46:e8:be:d8:f4:b4:90:26:08:77:ff:0d:5c
Signer

Actual PE Digest

91:ef:2e:25:ef:62:13:88:b7:4e:a3:0b:f3:47:0f:de:6d:25:f5:46:e8:be:d8:f4:b4:90:26:08:77:ff:0d:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\nossdk\nossdk\build\bin\release\nossdk.pdb

Imports

kernel32

SetLastError
LocalFree
GetOverlappedResult
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
GetModuleFileNameW
CreateFileW
CreateNamedPipeW
GetCurrentThreadId
TerminateThread
ResetEvent
GetCurrentProcessId
SetEvent
CreateEventW
GetModuleHandleW
lstrcmpiW
GetSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
DeviceIoControl
GetModuleHandleA
FlushFileBuffers
GetTickCount
Sleep
GetLastError
GetExitCodeThread
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
FindFirstFileW
FindClose
MoveFileW
GetFileAttributesW
SetFileAttributesW
FormatMessageW
SetFilePointer
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
ReleaseMutex
GetUserDefaultUILanguage
GetLocalTime
VirtualQuery
WaitForSingleObject
CreateMutexW
OpenMutexW
GetSystemTimeAsFileTime
CreateEventA
GetVersionExW
GetCurrentProcess
GetSystemWow64DirectoryW
VerSetConditionMask
VerifyVersionInfoW
LocalAlloc
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocaleInfoW
EnumUILanguagesW
GetUserDefaultLCID
lstrcmpiA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoA
LoadLibraryA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetSystemTime
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
OutputDebugStringW
InitializeCriticalSection

user32

MessageBoxW
FindWindowW
GetCursorPos
GetClassNameW
CharUpperW
GetSystemMetrics

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
SetSecurityInfo
OpenSCManagerW
GetUserNameW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
QueryServiceConfigW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceStatus
StartServiceW
OpenServiceW
CloseServiceHandle
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

psapi

GetModuleBaseNameW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wintrust

WinVerifyTrust

netapi32

NetLocalGroupGetMembers
NetGetJoinInformation
NetApiBufferFree

crypt32

CertCloseStore
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 468KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nossdk64.npd
.dll windows:4 windows x64 arch:x64

430abaac6975de185647fb1ca658b766

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d8:1f:b6:ae:d0:e1:7c:88:e2:a5:89:09:eb:72:69
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/10/2021, 00:00

Not After

10/10/2022, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:0a:bb:2f:7c:af:bd:60:d6:fd:1a:32:f7:8a:83:41:64:31:63:e9:5f:df:f9:6e:88:c7:19:26:36:c7:3e:32
Signer

Actual PE Digest

2b:0a:bb:2f:7c:af:bd:60:d6:fd:1a:32:f7:8a:83:41:64:31:63:e9:5f:df:f9:6e:88:c7:19:26:36:c7:3e:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\nossdk\nossdk\build\x64\release\nossdk64.pdb

Imports

kernel32

SetLastError
LocalFree
GetOverlappedResult
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
GetModuleFileNameW
CreateFileW
CreateNamedPipeW
GetCurrentThreadId
TerminateThread
ResetEvent
GetCurrentProcessId
SetEvent
CreateEventW
GetModuleHandleW
lstrcmpiW
GetSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
DeviceIoControl
GetModuleHandleA
FlushFileBuffers
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
FindFirstFileW
FindClose
MoveFileW
GetFileAttributesW
SetFileAttributesW
SetFilePointer
FormatMessageW
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
ReleaseMutex
GetUserDefaultUILanguage
GetLocalTime
VirtualQuery
OutputDebugStringW
InitializeCriticalSection
OpenMutexW
CreateEventA
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcess
GetSystemWow64DirectoryW
LocalAlloc
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
ProcessIdToSessionId
GetLocaleInfoW
EnumUILanguagesW
GetUserDefaultLCID
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpiA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
RtlVirtualUnwind
FlsGetValue
TlsAlloc
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSize
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
TlsGetValue
CreateMutexA
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetSystemTime
GetTickCount
Sleep
GetLastError
GetExitCodeThread
WaitForSingleObject
FreeLibrary
GetProcAddress
CreateMutexW
LoadLibraryW

user32

MessageBoxW
GetCursorPos
CharUpperW
GetSystemMetrics

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
SetSecurityInfo
OpenSCManagerW
GetUserNameW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSidSubAuthorityCount
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
QueryServiceConfigW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
QueryServiceStatus
StartServiceW
OpenServiceW
CloseServiceHandle

shell32

SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoCreateGuid

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW

psapi

GetModuleBaseNameW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

netapi32

NetLocalGroupGetMembers
NetGetJoinInformation
NetApiBufferFree

crypt32

CertCloseStore
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nosstarter.npe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

15:c5:79:db:0b:10:30:6a:2d:a0:ad:f5:97:75:f3:8d:52:bc:6d:29:5f:da:57:e2:aa:2d:0d:b9:8f:28:78:f0
Signer

Actual PE Digest

15:c5:79:db:0b:10:30:6a:2d:a0:ad:f5:97:75:f3:8d:52:bc:6d:29:5f:da:57:e2:aa:2d:0d:b9:8f:28:78:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 2.3MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vmajkiaz
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kqvhumdv
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nossvc.exe
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

48:af:32:ae:ed:43:8c:8f:df:58:2b:43:0b:5a:99:f5:08:77:31:cc:8b:d0:88:e9:33:a2:e4:48:94:87:93:a5
Signer

Actual PE Digest

48:af:32:ae:ed:43:8c:8f:df:58:2b:43:0b:5a:99:f5:08:77:31:cc:8b:d0:88:e9:33:a2:e4:48:94:87:93:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 248KB - Virtual size: 756KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vtfywqav
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tqxkcixu
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nosuseractor.npe
.exe windows:4 windows x86 arch:x86

2f37cf30ccf2ddb3a84279aba2fc868a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d8:1f:b6:ae:d0:e1:7c:88:e2:a5:89:09:eb:72:69
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/10/2021, 00:00

Not After

10/10/2022, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:9e:6f:d9:d4:f5:64:2d:55:fd:b0:fa:31:9f:63:cb:fa:b1:a5:29:52:fb:1a:fe:23:49:6e:ad:fd:d0:c9:03
Signer

Actual PE Digest

c6:9e:6f:d9:d4:f5:64:2d:55:fd:b0:fa:31:9f:63:cb:fa:b1:a5:29:52:fb:1a:fe:23:49:6e:ad:fd:d0:c9:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npeuseractor60\build\bin\release\nosuseractor.pdb

Imports

psapi

GetModuleBaseNameW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathIsDirectoryW
PathFileExistsW
PathRemoveBackslashW

kernel32

lstrlenA
SystemTimeToFileTime
SetErrorMode
GetFileTime
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
HeapReAlloc
RaiseException
RtlUnwind
ExitProcess
HeapSize
VirtualProtect
VirtualAlloc
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
SetEndOfFile
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetFullPathNameW
WriteConsoleW
SetEnvironmentVariableA
CreateFileA
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
WritePrivateProfileStringW
GlobalFlags
InterlockedDecrement
GlobalFindAtomW
CompareStringW
GetVersionExA
lstrlenW
FreeResource
GlobalAddAtomW
ResumeThread
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
CompareStringA
InterlockedExchange
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetOverlappedResult
WaitNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
CreateNamedPipeW
GetTickCount
LoadLibraryA
GetSystemWow64DirectoryW
GetSystemInfo
GetVersionExW
VerifyVersionInfoW
DuplicateHandle
GetVolumeInformationW
GetConsoleOutputCP
CreateMutexA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
VerSetConditionMask
GetVersion
ReleaseMutex
OpenMutexW
CreateMutexW
OutputDebugStringW
ResetEvent
SetEvent
CreateEventW
GetSystemTimeAsFileTime
SetThreadPriority
TerminateThread
CreateEventA
GetProcessHeap
HeapAlloc
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
FormatMessageW
UnlockFile
LockFile
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
MoveFileW
SetFilePointer
GetFileSize
SetFileAttributesW
WriteFile
LockResource
SizeofResource
LoadResource
FindResourceW
FindFirstFileW
FindClose
lstrcmpW
DeleteFileW
lstrcmpiA
SetLastError
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetSystemTime
GetLocaleInfoW
GetUserDefaultUILanguage
GetUserDefaultLCID
EnumUILanguagesW
LocalFree
CreateToolhelp32Snapshot
LocalAlloc
ReadFile
ProcessIdToSessionId
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
GetModuleHandleA
CreateDirectoryW
VirtualQuery
WaitForSingleObject
GetLastError
GlobalFree
Sleep
LoadLibraryW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetLocalTime
FreeLibrary
GetModuleFileNameW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
GetStartupInfoA

user32

DestroyMenu
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
CharUpperW
ReleaseCapture
SetCapture
LoadCursorW
GetSysColorBrush
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
UpdateWindow
GetMenu
CreateWindowExW
GetClassInfoExW
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
UnregisterClassW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetMenuItemID
GetMenuItemCount
GetSubMenu
RegisterClipboardFormatW
PostThreadMessageW
SetCursor
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetLastActivePopup
IsWindowEnabled
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
PostQuitMessage
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowLongW
GetWindow
IsWindowVisible
GetWindowThreadProcessId
ShowWindow
IsWindow
DrawIcon
GetClientRect
EnableWindow
GetSystemMetrics
SendMessageW
IsIconic
PostMessageW
FindWindowW
MessageBoxW
RegisterClassW
LoadIconW
GetClassInfoW
OffsetRect
SetForegroundWindow
UnregisterClassA

gdi32

GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect
GetDeviceCaps
GetStockObject
CreateBitmap
DeleteDC
ExtSelectClipRgn
DeleteObject
GetObjectW
GetViewportExtEx
GetWindowExtEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegQueryValueW
RegEnumKeyW
SetSecurityDescriptorSacl
ConvertSidToStringSidW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
RegOpenKeyW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
GetSidSubAuthority
SetSecurityDescriptorDacl
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetSidSubAuthorityCount

shell32

SHGetFolderPathW

comctl32

InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoGetClassObject
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateGuid
CoTaskMemFree
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

VariantInit
SysFreeString
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy

gdiplus

GdiplusShutdown
GdiplusStartup

wininet

InternetQueryOptionW
InternetSetOptionW

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

crypt32

CryptMsgOpenToDecode
CertFreeCertificateContext
CryptMsgUpdate
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore
CertOpenStore
CertGetNameStringW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WinVerifyTrust

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 532KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
npPb.dll
.dll windows:4 windows x86 arch:x86

00db911b28a8cd6b64fe48e8520f85bb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:56:bb:2b:33:e3:9a:c8:ec:5e:c4:5e:73:b0:3c:2d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

24/06/2015, 00:00

Not After

30/06/2016, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f
Signer

Actual PE Digest

d3:63:6a:a6:ae:0c:6b:e8:63:3e:b3:81:b1:2a:93:39:63:43:b0:93:43:6a:40:af:01:ea:4d:a2:fa:ec:23:0f

Digest Algorithm

sha256

PE Digest Matches

true

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc
Signer

Actual PE Digest

73:34:90:24:19:64:af:a4:0c:27:b5:da:f9:3b:c9:20:7b:99:66:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nppb\release\nppb.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
WriteFile
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npcf_win_32u.dll
.dll windows:5 windows x86 arch:x86

208abebe9e49ddc3d981d2f38dcadd87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd
Signer

Actual PE Digest

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd

Digest Algorithm

sha256

PE Digest Matches

true

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e
Signer

Actual PE Digest

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\INCA\Project\SVN\DevGroup\dev-crt\nProtect_Crypto_재인증_20180912\05.암호모듈_소스\Windows\dll\bin\Release\np_cu_f.pdb

Imports

kernel32

FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
GetModuleHandleA
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
GetSystemTime
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingA
GetCurrentProcess
TerminateThread
Sleep
CreateThread
IsProcessorFeaturePresent
GetStringTypeW
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapReAlloc
LCMapStringW

user32

FindWindowA
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npeUpdate.xml
npealert.npd
.dll windows:4 windows x86 arch:x86

11e80d783924802e6cd9440934cb980c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:6d:ea:94:71:02:5d:9f:cf:e9:bd:65:d5:25:14:ba:59:63:ef:24:a9:d5:1e:4d:09:16:b1:03:eb:46:41:20
Signer

Actual PE Digest

68:6d:ea:94:71:02:5d:9f:cf:e9:bd:65:d5:25:14:ba:59:63:ef:24:a9:d5:1e:4d:09:16:b1:03:eb:46:41:20

Digest Algorithm

sha256

PE Digest Matches

true

bb:54:12:1d:33:9d:68:16:1f:73:76:4d:d4:26:20:71:bc:37:ac:9b
Signer

Actual PE Digest

bb:54:12:1d:33:9d:68:16:1f:73:76:4d:d4:26:20:71:bc:37:ac:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npealert\build\bin\release\npealert.pdb

Imports

psapi

GetModuleBaseNameW

shlwapi

PathFileExistsW
PathFindFileNameW
PathFindExtensionW
PathIsDirectoryW
PathRemoveBackslashW

kernel32

SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
VirtualAlloc
RtlUnwind
ExitThread
CreateThread
ExitProcess
RaiseException
HeapSize
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
UnhandledExceptionFilter
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringW
FlushFileBuffers
GetThreadLocale
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
MulDiv
FreeResource
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
InterlockedDecrement
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
LoadLibraryExW
lstrcmpW
GlobalAddAtomW
SuspendThread
SetThreadPriority
GetWindowsDirectoryW
lstrcpynW
lstrlenW
GlobalAlloc
InterlockedExchange
GlobalUnlock
GlobalFree
GlobalLock
IsBadReadPtr
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo
VerifyVersionInfoW
VerSetConditionMask
GetVersion
WriteFile
CreateFileW
ReleaseMutex
OpenMutexW
CreateMutexW
MoveFileW
DeleteFileW
GetFileSize
SetFilePointer
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FormatMessageW
OutputDebugStringW
MultiByteToWideChar
SetLastError
OpenProcess
CreateProcessW
Process32NextW
Sleep
LocalFree
Process32FirstW
CreateToolhelp32Snapshot
FreeLibrary
LoadLibraryW
LocalAlloc
GetDriveTypeW
ReadFile
GetCurrentProcess
GetCurrentProcessId
ProcessIdToSessionId
TerminateProcess
GetTimeFormatW
GetDateFormatW
CreateDirectoryW
GetModuleFileNameW
EnumUILanguagesW
GetLocaleInfoW
GetUserDefaultUILanguage
GetProcAddress
GetModuleHandleW
GetUserDefaultLCID
GetModuleHandleA
GetLocalTime
MapViewOfFile
CreateFileMappingW
GetLastError
UnmapViewOfFile
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
SizeofResource
CloseHandle
CreateEventW
TerminateThread
WaitForSingleObject
ResumeThread
SetEvent
HeapCreate

user32

GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
IsDialogMessageW
CreateDialogIndirectParamW
EndDialog
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextW
SetActiveWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
GetScrollRange
SetScrollPos
GetScrollPos
GetMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
IsWindowEnabled
UnhookWindowsHookEx
PostQuitMessage
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetKeyState
PeekMessageW
SetMenuItemBitmaps
DestroyWindow
GetNextDlgTabItem
DestroyMenu
GrayStringW
DrawTextExW
TabbedTextOutW
GetSubMenu
GetActiveWindow
DefWindowProcW
GetClassInfoW
WindowFromPoint
InflateRect
SetWindowTextW
MoveWindow
ShowWindow
TrackMouseEvent
DrawFocusRect
GetFocus
InvalidateRect
ReleaseDC
ScreenToClient
FillRect
SetCursor
GetSysColor
GetCursorPos
DestroyCursor
CopyIcon
SetWindowLongW
BeginPaint
EndPaint
LoadCursorW
CopyRect
UnregisterClassW
GetSysColorBrush
GetScrollInfo
GetDC
GetWindowLongW
GetWindow
GetWindowTextLengthW
DestroyIcon
SystemParametersInfoW
IsWindow
DrawTextW
FindWindowW
PtInRect
ClientToScreen
GetForegroundWindow
GetWindowThreadProcessId
GetSystemMetrics
RedrawWindow
GetDesktopWindow
GetWindowRect
IsWindowVisible
PostMessageW
LoadIconW
SetFocus
BringWindowToTop
SetForegroundWindow
SetWindowPos
AttachThreadInput
SetRect
EnableWindow
SendMessageW
GetParent
GetClientRect
UpdateWindow
PostThreadMessageW
MessageBoxW
ValidateRect
GetLastActivePopup
UnregisterClassA

gdi32

SaveDC
GetClipBox
Escape
CreateBitmap
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetMapMode
Rectangle
GetTextColor
StretchBlt
PtVisible
RectVisible
RestoreDC
ExtTextOutW
SelectObject
GetObjectW
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetStockObject
DeleteObject
DeleteDC
SetBkColor
TextOutW
CreatePen
MoveToEx
LineTo
CreateSolidBrush
GetTextExtentPoint32W
GetCurrentObject
SetTextJustification
GetTextMetricsW
SetTextColor
SetBkMode
BeginPath
RoundRect
SetPixel
EndPath
GetPixel

msimg32

TransparentBlt
GradientFill

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

LookupAccountSidW
CreateProcessAsUserW
RegEnumKeyW
RegQueryValueW
RegCreateKeyExW
ConvertSidToStringSidW
RegOpenKeyW
RegDeleteKeyW
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
GetSidIdentifierAuthority
SetNamedSecurityInfoW
ImpersonateLoggedOnUser
GetSidSubAuthorityCount
GetSidSubAuthority
SetKernelObjectSecurity
SetSecurityDescriptorDacl
MakeAbsoluteSD
SetEntriesInAclW
BuildExplicitAccessWithNameW
AdjustTokenPrivileges
GetUserNameW
LookupPrivilegeValueW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
RegCloseKey
RegSetValueExW
GetLengthSid
SetTokenInformation
ConvertStringSidToSidW
RegOpenKeyExW
DuplicateTokenEx
GetTokenInformation
RevertToSelf
OpenProcessToken

shell32

SHAppBarMessage
ExtractIconW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

comctl32

_TrackMouseEvent
ImageList_GetIconSize

ole32

CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdipCreateSolidFill
GdipDeleteBrush
GdipAlloc
GdipCloneBrush
GdipFree
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDrawLine
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFillRectangleI
GdipGetDC
GdipReleaseDC
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateBitmapFromHICON
GdipDeleteFont
GdipCloneFont
GdipSetSmoothingMode
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipCloneBitmapAreaI
ord1
GdipClosePathFigure
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipFillPath
GdipAddPathLine
GdipSetTextRenderingHint
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipDrawImageRectRectI
GdipFillPolygonI
GdipDrawRectangleI
GdipCreateLineBrushFromRectI
GdipSetPenColor
GdipSetLineColors
GdipCreateFromHDC
GdipCreateBitmapFromFile
GdipCreateFont

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wintrust

WinVerifyTrust

Exports

Exports

AddType1Alert
CreateType1Alert
Type1Alert
Type2Alert
_DestoryType1Alert@4
addNpeAlert
createNpeAlert
createNpeBasicAlert
createNpePopupAlert
loadNpeAlertPolicy
unloadNpeAlertPolicy

Sections

.text
Size: 540KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npebsc20.npd
.dll windows:4 windows x86 arch:x86

9a41e2b6afcdec514e92626e53e1fed7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6e:52:db:b1:91:f4:4e:1b:b9:18:99:a3:42:72:e0:58
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/11/2017, 00:00

Not After

05/11/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:60:8a:5f:d7:df:ba:ac:92:ba:2e:d3:fa:d6:36:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/11/2017, 00:00

Not After

05/11/2018, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ff:94:53:29:01:04:df:9d:7f:c3:45:4c:82:14:eb:23:81:24:90:7a:31:ee:2f:9c:ef:36:4a:73:b7:51:06:cb
Signer

Actual PE Digest

ff:94:53:29:01:04:df:9d:7f:c3:45:4c:82:14:eb:23:81:24:90:7a:31:ee:2f:9c:ef:36:4a:73:b7:51:06:cb

Digest Algorithm

sha256

PE Digest Matches

true

2d:c8:c7:75:10:b1:b2:46:c9:13:e8:22:04:84:4f:e9:7d:96:08:25
Signer

Actual PE Digest

2d:c8:c7:75:10:b1:b2:46:c9:13:e8:22:04:84:4f:e9:7d:96:08:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_build\nProtectZ\product\npn60\npEngine\npebsc20\build\bin\release\npebsc20.pdb

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
FindFirstFileW
FindClose
MoveFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
WriteFile
ReadFile
SetFilePointer
FormatMessageW
LocalFree
Sleep
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
ReleaseMutex
OutputDebugStringW
GetUserDefaultUILanguage
GetLocalTime
HeapFree
HeapAlloc
GetProcessHeap
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
GetSystemInfo
GetSystemWow64DirectoryW
GetModuleFileNameW
GetFileSize
SetEvent
CreateMutexW
OpenMutexW
LocalAlloc
SetLastError
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetCurrentProcessId
GetDateFormatW
GetTimeFormatW
EnumUILanguagesW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateEventA
CreateMutexA
CloseHandle
GetModuleHandleA
FreeLibrary
GetProcAddress
GetLastError
CreateToolhelp32Snapshot
LoadLibraryW

user32

MessageBoxW
UnregisterClassA
IsWindow
GetSystemMetrics

shlwapi

PathRemoveBackslashW
PathFileExistsW
PathIsDirectoryW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

wintrust

WinVerifyTrust

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

advapi32

RegQueryValueExW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
LookupPrivilegeValueW
GetSidSubAuthorityCount
AdjustTokenPrivileges
OpenProcessToken
ConvertSidToStringSidW
GetUserNameW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSidSubAuthority
GetTokenInformation
RegCloseKey

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sections

.text
Size: 312KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npefsav.npd
.dll windows:4 windows x86 arch:x86

6aca9166f5ad2ab9e8b5487dad6c299c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e2:a1:8b:d1:19:fd:8a:c1:c9:30:bf:6a:e7:ad:c0:69:af:e4:51:ae:18:ba:6e:ae:be:67:96:19:2a:e2:17:68
Signer

Actual PE Digest

e2:a1:8b:d1:19:fd:8a:c1:c9:30:bf:6a:e7:ad:c0:69:af:e4:51:ae:18:ba:6e:ae:be:67:96:19:2a:e2:17:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npEngine\npefsav\build\bin\release\npefsav.pdb

Imports

kernel32

FileTimeToSystemTime
TerminateProcess
WaitForSingleObject
ProcessIdToSessionId
GetCurrentProcess
GetModuleHandleW
ReadFile
LocalAlloc
Module32FirstW
Module32NextW
Sleep
LocalFree
OpenProcess
GetModuleFileNameW
VirtualQuery
CreateDirectoryW
GetProcessHeap
HeapFree
HeapAlloc
GetUserDefaultUILanguage
EnumUILanguagesW
CreateFileW
WriteFile
SetFileAttributesW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
SetLastError
lstrcmpiA
MultiByteToWideChar
GetLocalTime
FileTimeToLocalFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
FormatMessageW
WideCharToMultiByte
SetFilePointer
GetFileSize
MoveFileW
ReleaseMutex
CreateMutexW
OpenMutexW
GetSystemTimeAsFileTime
CreateEventA
CreateEventW
SetEvent
ResetEvent
VerSetConditionMask
GetFileAttributesExW
GetVersionExW
GetSystemInfo
GetSystemWow64DirectoryW
GetFileAttributesW
IsBadReadPtr
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
ResumeThread
GetTickCount
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapReAlloc
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ExitProcess
ExitThread
CreateThread
HeapSize
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLastError
VerifyVersionInfoW
CopyFileW
GetModuleHandleA
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId

user32

GetSystemMetrics
MessageBoxW
IsWindow

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime

psapi

GetDeviceDriverBaseNameW
EnumDeviceDrivers
GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathFileExistsW
PathIsDirectoryW
PathRemoveBackslashW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore
CertOpenStore
CryptMsgOpenToDecode
CertFreeCertificateContext
CryptMsgUpdate

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetGetJoinInformation

wintrust

WinVerifyTrust

advapi32

GetSidSubAuthorityCount
OpenProcessToken
GetSidSubAuthority
RegOpenKeyExW
RegEnumKeyExW
ConvertSidToStringSidW
RegQueryInfoKeyW
RegQueryValueExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetTokenInformation
RegCloseKey
GetUserNameW
LookupPrivilegeValueW
QueryServiceStatus
SetSecurityDescriptorDacl
AdjustTokenPrivileges

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Exports

Exports

fn_getVersion

Sections

.text
Size: 480KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npefuncmgr.npd
.dll windows:4 windows x86 arch:x86

3b65111678646fe0af257aa2b29289f0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:78:ad:f4:0a:04:ae:b8:b3:22:45:e2:24:22:c6:53:14:fb:02:7d:cf:92:7b:4b:09:64:48:b7:34:c2:2a:e7
Signer

Actual PE Digest

8a:78:ad:f4:0a:04:ae:b8:b3:22:45:e2:24:22:c6:53:14:fb:02:7d:cf:92:7b:4b:09:64:48:b7:34:c2:2a:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npefuncmgr\build\bin\release\npefuncmgr.pdb

Imports

psapi

GetModuleBaseNameW
GetModuleFileNameExW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathFileExistsW
PathIsDirectoryW

kernel32

GetFileAttributesW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapReAlloc
RtlUnwind
ExitProcess
ExitThread
CreateThread
HeapSize
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
GetLastError
GetProcAddress
FreeLibrary
GetTickCount
Sleep
OutputDebugStringW
CopyFileW
MoveFileW
GetPrivateProfileStringW
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
LocalFree
Process32FirstW
CreateProcessW
Process32NextW
OpenProcess
TerminateProcess
WaitForSingleObject
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentProcess
CreatePipe
ReadFile
FlushFileBuffers
GetThreadLocale
GetStringTypeExW
LocalAlloc
GetModuleFileNameW
VirtualQuery
CreateDirectoryW
SystemTimeToFileTime
InterlockedCompareExchange
CreateMutexA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
IsBadReadPtr
GlobalFindAtomW
GetVersionExA
InterlockedIncrement
CompareStringW
GlobalFlags
WritePrivateProfileStringW
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFree
GlobalUnlock
lstrlenW
GlobalAddAtomW
ResumeThread
InterlockedDecrement
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
CompareStringA
GlobalLock
GlobalAlloc
RaiseException
InterlockedExchange
LoadLibraryA
GetSystemWow64DirectoryW
GetSystemInfo
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetVersion
ResetEvent
SetEvent
CreateEventW
CreateEventA
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
ReleaseMutex
OpenMutexW
CreateMutexW
GetFileSize
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocalTime
FormatMessageW
MultiByteToWideChar
SetLastError
lstrcmpiA
WriteFile
CreateFileW
FindFirstFileW
FindClose
DeleteFileW
lstrcmpW
SetFileAttributesW
GetUserDefaultLCID
EnumUILanguagesW
GetLocaleInfoW
GetUserDefaultUILanguage
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
CreateFileA

user32

LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
LoadStringW
UnregisterClassA
RemovePropW
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetDlgCtrlID
PtInRect
SetWindowTextW
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetSysColorBrush
LoadCursorW
DestroyMenu
UnregisterClassW
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetLastActivePopup
EnableWindow
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
UnhookWindowsHookEx
PostQuitMessage
GetSystemMetrics
GetWindowThreadProcessId
GetWindowLongW
MessageBoxW
FindWindowW
SetRectEmpty
SendInput
SetForegroundWindow
GetForegroundWindow
PostMessageW
IsWindowEnabled
SendMessageW
GetClientRect
UpdateWindow
MoveWindow
GetWindowRect
ShowWindow
ScreenToClient
GetWindowTextW
IsIconic
EnumChildWindows
GetClassNameW
GetWindow
IsWindow
EnumWindows
SendMessageTimeoutW
RegisterWindowMessageW
IsWindowVisible
FindWindowExW

gdi32

GetStockObject
DeleteDC
CreateBitmap
GetDeviceCaps
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

InitializeSecurityDescriptor
LookupPrivilegeValueW
GetUserNameW
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
RegQueryValueW
RegEnumKeyW
ConvertSidToStringSidW
RegOpenKeyW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
RegCloseKey
RegSetValueExW
OpenProcessToken

shell32

SHGetFolderPathW

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
VariantInit
VariantClear
VariantChangeType

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertOpenStore
CertGetNameStringW
CryptMsgGetParam
CryptQueryObject
CryptStringToBinaryA
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

wintrust

WinVerifyTrust

iphlpapi

GetAdaptersInfo

Exports

Exports

fn_getVersion

Sections

.text
Size: 604KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npefw.npd
.dll windows:4 windows x86 arch:x86

58d9f8f6e98d4ba92e9bc6a479cf1673

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:7d:14:36:5e:04:86:f9:67:ef:81:f3:0c:20:7d:74:3e:0a:d5:ef:a2:62:67:a5:0e:6c:b2:c1:e4:3d:20:f9
Signer

Actual PE Digest

9b:7d:14:36:5e:04:86:f9:67:ef:81:f3:0c:20:7d:74:3e:0a:d5:ef:a2:62:67:a5:0e:6c:b2:c1:e4:3d:20:f9

Digest Algorithm

sha256

PE Digest Matches

true

79:1f:da:c5:c2:04:73:3f:db:71:cb:41:e1:98:1c:84:34:18:7f:04
Signer

Actual PE Digest

79:1f:da:c5:c2:04:73:3f:db:71:cb:41:e1:98:1c:84:34:18:7f:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npEngine\npefw\build\bin\release\npefw.pdb

Imports

kernel32

CloseHandle
CopyFileW
GetModuleHandleA
GetModuleHandleW
HeapFree
GetProcessHeap
GetSystemDirectoryW
FreeLibrary
GetCurrentProcessId
CreateFileW
GetFileSize
ReadFile
WriteFile
SetFilePointer
SetLastError
DeleteFileW
MoveFileW
FindFirstFileW
FindClose
GetFileAttributesW
SetFileAttributesW
MultiByteToWideChar
FormatMessageW
LocalFree
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
WaitForSingleObject
SetEvent
ResetEvent
CreateEventA
HeapAlloc
GetSystemTimeAsFileTime
GetUserDefaultUILanguage
GetLocalTime
VirtualQuery
ReleaseMutex
CreateMutexW
OutputDebugStringW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcess
GetSystemInfo
GetSystemWow64DirectoryW
GetModuleFileNameW
LocalAlloc
GetSystemDirectoryA
LoadLibraryA
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetDateFormatW
GetTimeFormatW
FileTimeToLocalFileTime
FileTimeToSystemTime
EnumUILanguagesW
GetFileAttributesExW
FindNextFileW
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetVersionExA
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
ResumeThread
GetTickCount
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo
LCMapStringA
LCMapStringW
ExitProcess
ExitThread
CreateThread
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetProcAddress
LoadLibraryW
GetLastError
WideCharToMultiByte
OpenMutexW
Sleep

user32

MessageBoxW
SendMessageW
IsWindow
IsWindowVisible
UnregisterClassA
GetSystemMetrics

shlwapi

PathRemoveBackslashW
PathIsDirectoryW
PathFileExistsW
StrToIntW

psapi

GetDeviceDriverBaseNameW
GetModuleFileNameExW
GetModuleBaseNameW
EnumDeviceDrivers

ws2_32

inet_ntoa
htonl
getservbyname
ntohs
WSAGetLastError
gethostbyname
inet_addr
WSASetLastError
WSACleanup
gethostbyaddr
getservbyport
htons
WSAStartup

wintrust

WinVerifyTrust

netapi32

NetApiBufferFree
NetGetJoinInformation
NetLocalGroupGetMembers

crypt32

CryptMsgGetParam
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
AdjustTokenPrivileges
LookupPrivilegeValueW
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
GetUserNameW
OpenSCManagerW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Sections

.text
Size: 508KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npertd.npd
.dll windows:4 windows x86 arch:x86

5c6b728892517dfc2c19a9c1b8e48848

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:21:1c:ec:5e:fc:2f:b7:f7:b9:d1:35:a1:d0:50:65:9a:ac:88:c1:8a:c8:c0:b8:6b:f0:8f:b6:bc:39:8b:48
Signer

Actual PE Digest

23:21:1c:ec:5e:fc:2f:b7:f7:b9:d1:35:a1:d0:50:65:9a:ac:88:c1:8a:c8:c0:b8:6b:f0:8f:b6:bc:39:8b:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npEngine\npertd\build\bin\release\npertd.pdb

Imports

kernel32

FindFirstFileW
GetLongPathNameW
LeaveCriticalSection
GetModuleHandleW
EnterCriticalSection
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetFileAttributesW
DeleteFileW
LocalFree
GetWindowsDirectoryW
ExpandEnvironmentStringsW
lstrlenW
CreateFileW
WriteFile
GetVolumeInformationW
GetModuleHandleA
LocalAlloc
Sleep
DeleteCriticalSection
OpenProcess
GetTickCount
GetDriveTypeW
CloseHandle
InitializeCriticalSection
Process32NextW
Process32FirstW
GetCurrentProcessId
FlushFileBuffers
ReadFile
SetLastError
CreateEventW
SetEvent
ResetEvent
WaitForSingleObject
GetFileSize
SetFilePointer
MoveFileW
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesW
FormatMessageW
CreateDirectoryW
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
VirtualQuery
OutputDebugStringW
HeapFree
SetThreadPriority
GetSystemTimeAsFileTime
CreateEventA
HeapAlloc
GetProcessHeap
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetCurrentProcess
GetSystemInfo
GetSystemWow64DirectoryW
GetModuleFileNameW
ReleaseMutex
CreateMutexW
OpenMutexW
Module32FirstW
Module32NextW
ProcessIdToSessionId
TerminateProcess
GetShortPathNameW
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
GetDateFormatW
GetTimeFormatW
EnumUILanguagesW
lstrcmpiA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetVersionExA
TlsAlloc
TlsFree
TlsGetValue
CreateMutexA
TlsSetValue
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
ExitProcess
ExitThread
CreateThread
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetLocalTime
FindClose

user32

MessageBoxW
UnregisterClassA
IsWindow
GetSystemMetrics

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetSecurityInfo
GetUserNameW
ConvertSidToStringSidW
GetTokenInformation
GetSidSubAuthority
IsValidSid
GetSidIdentifierAuthority
LookupAccountSidW
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW

shlwapi

PathIsDirectoryW
PathRemoveBackslashW
PathFileExistsW

psapi

EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW

wintrust

WinVerifyTrust

netapi32

NetLocalGroupGetMembers
NetApiBufferFree
NetGetJoinInformation

crypt32

CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree

Exports

Exports

fn_getVersion

Sections

.text
Size: 452KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npesm.npd
.dll windows:4 windows x86 arch:x86

409d13484df75e3503e02b804d654b6a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:df:06:1d:73:11:2e:55:d3:4c:e6:aa:97:11:e9:d2
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/10/2019, 00:00

Not After

08/10/2020, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,OU=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:e1:3d:72:3e:10:fc:91:48:80:e7:d9:1a:4a:88:ac
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2019, 00:00

Not After

27/10/2020, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b3:0e:f2:86:03:0e:fe:b3:34:e5:c3:ec:8e:98:4d:4b:31:b0:29:5f:3d:9f:f8:78:e9:59:dd:5e:6b:d6:1a:5c
Signer

Actual PE Digest

b3:0e:f2:86:03:0e:fe:b3:34:e5:c3:ec:8e:98:4d:4b:31:b0:29:5f:3d:9f:f8:78:e9:59:dd:5e:6b:d6:1a:5c

Digest Algorithm

sha256

PE Digest Matches

true

07:25:29:8e:8d:56:65:70:d7:47:23:67:c5:20:dc:84:6e:a9:2b:8a
Signer

Actual PE Digest

07:25:29:8e:8d:56:65:70:d7:47:23:67:c5:20:dc:84:6e:a9:2b:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_work\nprotectz\product\npn60\npesm\build\bin\release\npesm.pdb

Imports

kernel32

LeaveCriticalSection
GetSystemTimeAsFileTime
InterlockedDecrement
EnterCriticalSection
GetFileAttributesW
CreateMutexW
GetCurrentProcess
CreateProcessA
FindNextFileW
TerminateProcess
FindClose
GetFileAttributesExW
FindFirstFileW
QueryPerformanceCounter
InitializeCriticalSection
DeleteCriticalSection
TlsSetValue
SetLastError
GetCurrentThreadId
DuplicateHandle
ReleaseMutex
SetHandleInformation
TlsGetValue
WideCharToMultiByte
TlsAlloc
MultiByteToWideChar
CreateEventW
WaitForSingleObject
SetThreadPriority
CloseHandle
GetCurrentDirectoryA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindFirstFileA
GetCurrentThread
InterlockedIncrement
TlsFree
GetLastError
DeleteFileW
Sleep
SetEvent
GetVersion
CreateDirectoryW
GetFullPathNameA
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcAddress
GetModuleHandleA
WriteFile
GetFileType
GetStdHandle
FlushConsoleInputBuffer
GetTickCount
GetCurrentProcessId
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
SystemTimeToFileTime
GetSystemTime
DeleteFileA
MoveFileA
SetStdHandle
SetFilePointer
GetTimeFormatA
GetDateFormatA
HeapFree
HeapReAlloc
HeapAlloc
ExitThread
CreateThread
ReadFile
CreatePipe
RemoveDirectoryA
ResumeThread
GetCommandLineA
GetVersionExA
GetProcessHeap
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameA
IsDebuggerPresent
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
LCMapStringA
LCMapStringW
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetConsoleCP
FlushFileBuffers
RtlUnwind
GetFileAttributesA
GetExitCodeProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

ws2_32

select
shutdown
ioctlsocket
accept
listen
send
WSAGetLastError
inet_ntoa
__WSAFDIsSet
closesocket
htons
WSAStartup
setsockopt
WSACleanup
ntohs
WSASetLastError
recv
bind
ntohl
htonl
socket
getsockname

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

Sections

.text
Size: 768KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npeurlmon.npd
.dll windows:4 windows x86 arch:x86

577f75a2edfe7be439c5bca118cc7eb4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

22:88:b9:05:fa:1c:80:cf:63:85:5f:e6:a1:48:69:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/11/2018, 00:00

Not After

03/11/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:61:6a:95:26:74:6e:07:95:ff:51:06:31:81:fd:00
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/11/2018, 00:00

Not After

03/11/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

58:97:8f:3f:9f:56:b9:84:39:18:22:e0:eb:a4:19:10:90:59:7b:a3:28:f2:f6:89:19:aa:a0:48:5f:e5:ed:af
Signer

Actual PE Digest

58:97:8f:3f:9f:56:b9:84:39:18:22:e0:eb:a4:19:10:90:59:7b:a3:28:f2:f6:89:19:aa:a0:48:5f:e5:ed:af

Digest Algorithm

sha256

PE Digest Matches

true

e0:89:68:b8:36:f9:c7:b9:ef:ab:1d:fb:0d:d2:74:5a:dc:7e:db:9a
Signer

Actual PE Digest

e0:89:68:b8:36:f9:c7:b9:ef:ab:1d:fb:0d:d2:74:5a:dc:7e:db:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npeurlmon\npeurlmon\build\bin\release\npeurlmon.pdb

Imports

kernel32

HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
CreateMutexA
InterlockedCompareExchange
GetFileAttributesExW
EnumUILanguagesW
ProcessIdToSessionId
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VerifyVersionInfoW
VerSetConditionMask
GetUserDefaultUILanguage
GetLocalTime
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
CreateDirectoryW
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
Sleep
ExitProcess
HeapSize
HeapReAlloc
CreateThread
ExitThread
RtlUnwind
RaiseException
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileAttributesW
SetFileAttributesW
FileTimeToLocalFileTime
CreateFileW
FindFirstFileW
FindClose
GetCurrentProcess
GetFileSize
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetStringTypeExW
DeleteFileW
MoveFileW
InterlockedExchange
GetModuleHandleA
GlobalFlags
SystemTimeToFileTime
FileTimeToSystemTime
GetThreadLocale
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
GetVersion
InterlockedIncrement
MultiByteToWideChar
ResumeThread
FormatMessageW
FreeLibrary
InterlockedDecrement
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
lstrlenW
WideCharToMultiByte
GetCurrentProcessId
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource
SetLastError
CreateEventA
ResetEvent
CreateEventW
WaitForSingleObject
CreateMutexW
OpenMutexW
ReleaseMutex
OutputDebugStringW
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
CloseHandle
HeapAlloc
SetEvent
GetModuleHandleW
GetLastError
GetProcAddress
GetCurrentThreadId

user32

GetClientRect
GetMenu
PostMessageW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
SetForegroundWindow
CopyRect
PtInRect
GetForegroundWindow
GetDlgCtrlID
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetPropW
SetPropW
GetClassLongW
GetCapture
WinHelpW
SetWindowTextW
ClientToScreen
DestroyMenu
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
MapWindowPoints
GetMessagePos
GetMessageTime
GetTopWindow
GetDlgItem
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
RemovePropW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
GetKeyState
PeekMessageW
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageW
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
GetWindow
DestroyWindow
DefWindowProcW
PostQuitMessage
CreateWindowExW
RegisterClassW
LoadIconW
DispatchMessageW
LoadCursorW
GetParent
SendMessageTimeoutW
RegisterWindowMessageW
FindWindowExW
IsIconic
EnumWindows
EnumChildWindows
UnregisterClassA
LoadStringW
GetWindowTextW
GetClassNameW
IsWindowVisible
IsWindow

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetStockObject
GetDeviceCaps
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
ExtTextOutW
SaveDC
RestoreDC
SetMapMode

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

SetSecurityDescriptorDacl
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority
GetUserNameW
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
LookupAccountSidW
GetSidIdentifierAuthority
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsValidSid
InitializeSecurityDescriptor

shell32

SHGetFolderPathW

ole32

CoTaskMemFree
CoUninitialize
CoInitialize

oleaut32

VariantChangeType
VariantInit
SysFreeString
VariantClear

shlwapi

PathIsDirectoryW
PathFileExistsW

psapi

GetModuleBaseNameW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleChildren
AccessibleObjectFromWindow

Exports

Exports

addClient
addExceptHwnd
delExceptHwnd
deleteClient
getBrowserUrl
ignoreClient
isClientListEmpty
isExistClient
isMonitoring
npInitAPSCallback
npInitDomainCallback
npInitUrlMonitor
npStartSingleUrlMonitor
npStartUrlMonitor
npStopUrlMonitor
setBrowserType

Sections

.text
Size: 440KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/INICRYPTOSDK.dll
.dll windows:4 windows x86 arch:x86

2702bc403da1fe9704553a4d4c0969fd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/11/2015, 00:00

Not After

08/11/2016, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/11/2015, 00:00

Not After

08/11/2016, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:c3:03:2a:76:58:b7:b8:f2:61:7d:18:32:aa:07:a5:34:7d:90:c7:b3:14:e8:5b:45:2b:8f:31:7c:69:8a:35
Signer

Actual PE Digest

44:c3:03:2a:76:58:b7:b8:f2:61:7d:18:32:aa:07:a5:34:7d:90:c7:b3:14:e8:5b:45:2b:8f:31:7c:69:8a:35

Digest Algorithm

sha256

PE Digest Matches

true

f0:ee:30:1a:13:ae:0a:9e:ce:97:1c:6c:38:23:0c:8a:0e:9c:07:1b
Signer

Actual PE Digest

f0:ee:30:1a:13:ae:0a:9e:ce:97:1c:6c:38:23:0c:8a:0e:9c:07:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord2764
ord4465
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord600
ord826
ord269
ord3259
ord3147
ord2982
ord3953
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1168
ord1575
ord1577
ord1176
ord1116
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord538
ord858
ord860
ord537
ord540
ord2915
ord5572
ord535
ord800

msvcrt

signal
??2@YAPAXI@Z
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
fputs
memmove
fgets
fseek
ftell
_setmode
fflush
fwrite
_errno
sscanf
getenv
time
_ftol
strtoul
_fileno
strncmp
fprintf
memchr
printf
realloc
_isctype
__mb_cur_max
_pctype
tolower
_iob
vfprintf
_vsnprintf
wcsstr
abort
sprintf
strncpy
memcmp
fopen
fread
fclose
strcpy
free
malloc
memset
memcpy
strcmp
strstr
strchr
strlen
__CxxFrameHandler
qsort
_getch

kernel32

GetStdHandle
LocalFree
GetCurrentProcessId
FlushConsoleInputBuffer
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
CloseHandle
QueryPerformanceCounter
GlobalMemoryStatus
GetFileType
GetVersion
LocalAlloc
GetCurrentThreadId
GetLastError

user32

GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

Exports

Exports

DecEncKey
EncData
EncKeyWithPubkey
EncRandKey
GetKey
GetRandData
freeData

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noska.sys
.sys windows:6 windows x86 arch:x86

848f63553a9a79bfa946f6e3fd4cc6d8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxa\npkakl\npkfxa\objfre\i386\noska.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
ZwQuerySystemInformation
RtlUpcaseUnicodeStringToOemString
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
MmIsAddressValid
ObQueryNameString
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlFreeOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcp.dll
.dll windows:4 windows x86 arch:x86

a50eef10aed4f1c128a3053b253ec3f9

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:ca:6c:09:79:8f:de:64:97:9d:c6:7d:0b:78:4f:d0:cf:8a:7f:81:1f:38:fd:4e:6c:5c:90:73:7e:71:dd:d9
Signer

Actual PE Digest

71:ca:6c:09:79:8f:de:64:97:9d:c6:7d:0b:78:4f:d0:cf:8a:7f:81:1f:38:fd:4e:6c:5c:90:73:7e:71:dd:d9

Digest Algorithm

sha256

PE Digest Matches

true

3e:d5:b4:ed:7f:34:e4:72:48:f7:cf:05:60:b6:ac:66:24:3d:6f:82
Signer

Actual PE Digest

3e:d5:b4:ed:7f:34:e4:72:48:f7:cf:05:60:b6:ac:66:24:3d:6f:82

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\source\nosk\dll\noskcp\release\noskcp.pdb

Imports

kernel32

WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
WriteFile
CreateFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
GetCurrentThreadId
GetProcAddress
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
Sleep
LoadLibraryA
FlushConsoleInputBuffer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
GetStringTypeA
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetConsoleCP
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CloseHandle
FreeLibrary

advapi32

RegisterEventSourceA
DeregisterEventSource
ReportEventA

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA

Sections

.text
Size: 488KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcv.dll
.dll windows:4 windows x86 arch:x86

55e7f58250c447b99a1a9cfd4f0ae289

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

66:4f:30:cd:ac:47:d6:76:2d:ba:ea:d8:97:cb:ed:f1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/11/2015, 00:00

Not After

08/11/2016, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:e7:d8:76:b1:3f:92:2a:db:a4:ef:ad:d8:6d:07:56
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

09/11/2015, 00:00

Not After

08/11/2016, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,OU=IT Team,O=INCA INTERNET CO.\, LTD.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:28:a4:d7:d1:55:55:7e:d9:cd:14:a0:a9:ca:11:97:1a:e2:de:62:09:aa:7b:89:27:95:c6:f6:22:38:a9:d1
Signer

Actual PE Digest

0d:28:a4:d7:d1:55:55:7e:d9:cd:14:a0:a9:ca:11:97:1a:e2:de:62:09:aa:7b:89:27:95:c6:f6:22:38:a9:d1

Digest Algorithm

sha256

PE Digest Matches

true

45:9b:0a:b4:8d:7a:f2:8c:75:98:6c:d0:37:48:25:c2:d6:43:61:0b
Signer

Actual PE Digest

45:9b:0a:b4:8d:7a:f2:8c:75:98:6c:d0:37:48:25:c2:d6:43:61:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\source\nosk\dll\noskcv\release\noskcv.pdb

Imports

kernel32

DeleteCriticalSection
CreateEventW
SetEvent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetTickCount
GetCurrentProcessId
WriteFile
InitializeCriticalSection
ConnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
GetOverlappedResult
LocalFree
SetLastError
CreateNamedPipeW
CreateFileW
FlushFileBuffers
SetThreadPriority
Sleep
GetLastError
TerminateThread
CreateThread
ReadFile
WaitForSingleObject
CreateFileA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapSize
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl

ole32

CoInitialize
CoCreateGuid

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskcv64.dll
.dll windows:4 windows x64 arch:x64

99e1a801ef9b18f828cc824550c160a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:e3:8d:d6:5f:06:e9:a6:a9:45:27:a5:fc:10:62:de:5f:00:6a:3c:e3:b2:35:ba:b8:30:0d:86:fa:37:98:fa
Signer

Actual PE Digest

9d:e3:8d:d6:5f:06:e9:a6:a9:45:27:a5:fc:10:62:de:5f:00:6a:3c:e3:b2:35:ba:b8:30:0d:86:fa:37:98:fa

Digest Algorithm

sha256

PE Digest Matches

true

c2:a5:b8:91:ef:5a:68:cd:be:6c:83:74:16:ac:4b:09:1a:ea:1b:51
Signer

Actual PE Digest

c2:a5:b8:91:ef:5a:68:cd:be:6c:83:74:16:ac:4b:09:1a:ea:1b:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskcv\release\noskcv64.pdb

Imports

kernel32

CloseHandle
EnterCriticalSection
LeaveCriticalSection
ResetEvent
WaitForSingleObject
CreateThread
TerminateThread
GetTickCount
GetCurrentProcessId
SetLastError
SetEvent
CreateFileW
FlushFileBuffers
WriteFile
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
WaitNamedPipeW
GetOverlappedResult
LocalFree
SetThreadPriority
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
Sleep
CreateNamedPipeW
GetLastError
CreateFileA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
GetProcAddress
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoInitialize
CoCreateGuid

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noske64.exe
.exe windows:4 windows x64 arch:x64

443ae3aa1f09f934b0efcb42cbe748aa

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:81:0d:7a:99:72:26:ea:f4:0b:9b:a1:0e:ed:79:b5:89:f5:35:81:ef:12:89:27:66:bf:b7:77:54:0a:06:17
Signer

Actual PE Digest

63:81:0d:7a:99:72:26:ea:f4:0b:9b:a1:0e:ed:79:b5:89:f5:35:81:ef:12:89:27:66:bf:b7:77:54:0a:06:17

Digest Algorithm

sha256

PE Digest Matches

true

f1:b4:ea:85:ed:5c:68:52:32:a8:64:e3:fb:01:c5:2b:e6:06:b5:1f
Signer

Actual PE Digest

f1:b4:ea:85:ed:5c:68:52:32:a8:64:e3:fb:01:c5:2b:e6:06:b5:1f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Build\Source\NOSK\exe\noske64\release\noske64.pdb

Imports

kernel32

LeaveCriticalSection
GetFileAttributesW
FindClose
FindFirstFileW
SetFilePointer
CreateFileW
WriteFile
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
IsBadReadPtr
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
CloseHandle
GetLastError
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ReadFile
GetModuleHandleA
CreateFileA
SetStdHandle
InitializeCriticalSection
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
GetCurrentProcessId
GetSystemTime
QueryPerformanceCounter
GetTickCount
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
GetStringTypeA
GetStringTypeW
RtlVirtualUnwind
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
FlushFileBuffers
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetSystemTimeAsFileTime
GetLocaleInfoA
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
PathAppendW

user32

GetSystemMetrics
GetCursorPos

Sections

.text
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
npk/noskes.dll
.dll windows:4 windows x86 arch:x86

30e092b2d40c39eafcc96e902228e651

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fc:47:a3:c0:af:dd:40:cb:f5:f1:5a:75:ba:85:0d:7d:db:35:d0:67:ad:76:de:f5:52:12:6e:3c:c7:6a:a0:cb
Signer

Actual PE Digest

fc:47:a3:c0:af:dd:40:cb:f5:f1:5a:75:ba:85:0d:7d:db:35:d0:67:ad:76:de:f5:52:12:6e:3c:c7:6a:a0:cb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskes\release\noskes.pdb

Imports

kernel32

SetLastError
MultiByteToWideChar
CreateProcessW
WaitForSingleObject
GetFileAttributesW
FindClose
FindFirstFileW
DeleteCriticalSection
SetFilePointer
WideCharToMultiByte
IsBadReadPtr
CreateFileA
CloseHandle
Sleep
SetEvent
GetLastError
LocalFree
ReadFile
GetCurrentProcess
LocalAlloc
CreateFileW
WaitForMultipleObjects
FreeLibrary
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
CreateEventW
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
WriteFile
DeviceIoControl
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetProcessHeap
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
GetCurrentProcessId
GetSystemTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleA
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA

user32

GetKeyboardLayout
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
PathAppendW

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

Sections

.text
Size: 352KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskes.npx
npk/noskes64.dll
.dll windows:4 windows x64 arch:x64

94a3c10f8d3a7023ac14ed7899f67f05

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

eb:4d:46:73:79:42:01:1e:30:42:6e:a7:4c:19:ee:03:ed:a0:56:6c:22:36:fe:28:31:8f:1b:8e:f8:84:0d:2a
Signer

Actual PE Digest

eb:4d:46:73:79:42:01:1e:30:42:6e:a7:4c:19:ee:03:ed:a0:56:6c:22:36:fe:28:31:8f:1b:8e:f8:84:0d:2a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskes\release\noskes64.pdb

Imports

kernel32

SetEvent
SetLastError
CreateProcessW
WaitForSingleObject
DeviceIoControl
MultiByteToWideChar
GetFileAttributesW
FindClose
FindFirstFileW
LocalFree
SetFilePointer
WideCharToMultiByte
IsBadReadPtr
CreateFileA
ReadFile
LocalAlloc
DeleteCriticalSection
WaitForMultipleObjects
CloseHandle
Sleep
GetLastError
GetCurrentProcess
CreateEventW
CreateFileW
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryW
LeaveCriticalSection
GetSystemDirectoryW
GetProcAddress
EnterCriticalSection
GetModuleHandleW
WriteFile
GetModuleFileNameW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetProcessHeap
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
GetCurrentProcessId
GetSystemTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
HeapFree
HeapAlloc
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
ExitProcess
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
RtlVirtualUnwind
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetSystemTimeAsFileTime
GetLocaleInfoA

user32

GetKeyboardLayout
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
PathAppendW

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

Sections

.text
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskfx.dll
.dll windows:4 windows x86 arch:x86

d886b30a846e37b29a17f788bc705a69

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4f:ee:22:58:f3:a3:0f:83:51:3e:8d:9f:78:d1:42:2e:a7:c8:20:74:e5:cc:85:97:9a:ff:92:86:17:7f:87:dc
Signer

Actual PE Digest

4f:ee:22:58:f3:a3:0f:83:51:3e:8d:9f:78:d1:42:2e:a7:c8:20:74:e5:cc:85:97:9a:ff:92:86:17:7f:87:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskfx\release\noskfx.pdb

Imports

kernel32

GetVersionExW
SetLastError
CreateThread
GetExitCodeThread
TerminateThread
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
GetBinaryTypeW
LocalAlloc
OpenProcess
DuplicateHandle
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
CreateFileW
DeviceIoControl
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
CloseHandle
InitializeCriticalSection
LocalFree
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
FatalAppExitA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
TlsFree
Process32FirstW
CreateToolhelp32Snapshot
DeleteCriticalSection
CreateEventW
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObject
GetCurrentProcess
GetLastError
CreateMutexW
GetTickCount
Sleep
SetEvent
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
RaiseException
GetCommandLineA
GetSystemInfo
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
InterlockedExchange
Process32NextW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
LoadLibraryA
QueryPerformanceCounter
GetSystemTime
GetCurrentProcessId
EnterCriticalSection
GetModuleHandleA
GetStringTypeA
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetVersionExA

user32

MapVirtualKeyW
GetClassNameW
GetAsyncKeyState
GetWindowThreadProcessId
FindWindowA
GetKeyboardLayout
GetSystemMetrics
GetKeyboardLayoutNameW
GetPropW
GetWindowLongW
EnumChildWindows
ShowWindow
CreateDialogParamW
EndDialog
GetWindowRect
FindWindowW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
VkKeyScanW
SetWindowLongA
GetClassLongA
SetWindowLongW
GetClassLongW
IsWindowUnicode
GetGUIThreadInfo
KillTimer
SetTimer
RemovePropW
GetParent
SetPropW
GetWindowTextW
GetAncestor
UnregisterDeviceNotification
RegisterDeviceNotificationW
SystemParametersInfoW
CallWindowProcA
CallWindowProcW
SetFocus
AttachThreadInput
GetFocus
GetForegroundWindow
SendMessageW
SendInput
GetKeyboardType
GetKeyState
keybd_event
SendMessageTimeoutW
CharLowerW
CharUpperW
PostMessageW
IsWindowEnabled
IsWindow
GetCursorPos

advapi32

OpenServiceW
RegCloseKey
RegQueryValueExW
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigW
OpenSCManagerW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyW
RegOpenKeyExW

shell32

ord680

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW

imm32

ImmGetContext
ImmSetConversionStatus
ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetConversionStatus
ImmNotifyIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSFreeMemory

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

ole32

CoCreateGuid

Sections

.text
Size: 356KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskfx64.dll
.dll windows:4 windows x64 arch:x64

68546f3274a58f9f2be043ec2565647b

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

26/09/2024, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:2c:d3:01:67:83:24:b1:80:ef:a5:3e:06:ae:bf:df:76:76:35:99:3c:e0:f5:5b:81:96:e4:75:d1:85:90:45
Signer

Actual PE Digest

64:2c:d3:01:67:83:24:b1:80:ef:a5:3e:06:ae:bf:df:76:76:35:99:3c:e0:f5:5b:81:96:e4:75:d1:85:90:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskfx\release\noskfx64.pdb

Imports

kernel32

SetLastError
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
CreateThread
GetExitCodeThread
TerminateThread
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryW
GetBinaryTypeW
LocalAlloc
GetCurrentProcess
DuplicateHandle
VirtualAlloc
VirtualFree
OpenProcess
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
CreateFileW
DeviceIoControl
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
GetStringTypeW
GetStringTypeA
Sleep
HeapReAlloc
LocalFree
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
HeapDestroy
HeapCreate
HeapSetInformation
GetModuleFileNameA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
RtlVirtualUnwind
FlsAlloc
GetCurrentThread
TlsSetValue
FlsFree
TlsFree
TlsAlloc
FlsGetValue
DebugBreak
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
Process32NextW
GetModuleFileNameW
GetLastError
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
DeleteCriticalSection
CreateEventW
GetFileType
WriteConsoleW
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
GetSystemInfo
GetVersionExW
ReleaseMutex
WaitForSingleObject
CreateMutexW
SetEvent
FatalAppExitA
GetTickCount
GetCommandLineA
FlsSetValue
RtlCaptureContext
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
InitializeCriticalSection
CreateFileMappingA
GetFileSize
MapViewOfFile
UnmapViewOfFile
LoadLibraryA
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetVersionExA
GetCurrentProcessId
GetSystemTime

user32

MapVirtualKeyW
GetClassNameW
GetAsyncKeyState
GetWindowThreadProcessId
FindWindowA
GetKeyboardLayout
GetSystemMetrics
GetKeyboardLayoutNameW
RemovePropW
GetWindowLongW
GetWindowLongPtrW
EnumChildWindows
ShowWindow
CreateDialogParamW
EndDialog
GetWindowRect
FindWindowW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
VkKeyScanW
SetWindowLongPtrA
GetClassLongPtrA
SetWindowLongPtrW
GetClassLongPtrW
IsWindowUnicode
GetGUIThreadInfo
KillTimer
SetTimer
GetParent
GetPropW
SetPropW
UnregisterDeviceNotification
GetWindowTextW
RegisterDeviceNotificationW
GetAncestor
SystemParametersInfoW
CallWindowProcA
CallWindowProcW
GetForegroundWindow
SetFocus
AttachThreadInput
GetFocus
SendMessageW
SendInput
GetKeyState
SendMessageTimeoutW
CharLowerW
CharUpperW
PostMessageW
GetKeyboardType
IsWindowEnabled
keybd_event
IsWindow
GetCursorPos

advapi32

OpenServiceW
RegCloseKey
RegQueryValueExW
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigW
OpenSCManagerW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyW
RegOpenKeyExW

shell32

ord680

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW

imm32

ImmSetConversionStatus
ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetConversionStatus
ImmGetContext
ImmNotifyIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSFreeMemory

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

ole32

CoCreateGuid

Sections

.text
Size: 572KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskkbd.dll
.dll windows:5 windows x86 arch:x86

74bd75f9f8716b7d145161f81cf940f8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:df:06:1d:73:11:2e:55:d3:4c:e6:aa:97:11:e9:d2
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/10/2019, 00:00

Not After

08/10/2020, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,OU=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:e1:3d:72:3e:10:fc:91:48:80:e7:d9:1a:4a:88:ac
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/10/2019, 00:00

Not After

27/10/2020, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5a:3f:68:75:70:63:2a:7d:95:53:39:d0:fc:24:78:75:cc:77:15:d7:1e:9b:79:e8:d0:89:0c:88:bc:02:f6:7c
Signer

Actual PE Digest

5a:3f:68:75:70:63:2a:7d:95:53:39:d0:fc:24:78:75:cc:77:15:d7:1e:9b:79:e8:d0:89:0c:88:bc:02:f6:7c

Digest Algorithm

sha256

PE Digest Matches

true

e8:b8:af:ba:04:fa:04:97:aa:41:33:a5:38:80:cb:0f:92:46:d5:d5
Signer

Actual PE Digest

e8:b8:af:ba:04:fa:04:97:aa:41:33:a5:38:80:cb:0f:92:46:d5:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtClose
NtQueryValueKey
RtlInitUnicodeString
NtOpenKey
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
RtlIntegerToChar
NtEnumerateValueKey

Exports

Exports

KbdLayerDescriptor
KbdLayerMultiDescriptor
KbdLayerRealDllFile
KbdLayerRealDllFileNT4
KbdNlsLayerDescriptor

Sections

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskm.dll
.dll windows:4 windows x86 arch:x86

9916fa61dea03b8d18c1a6671392c33f

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:a1:b0:fd:26:73:22:a2:e3:30:cc:82:c0:79:7d:3b:17:04:4a:ac:ee:ec:77:c8:bb:ca:04:ad:2f:45:68:4a
Signer

Actual PE Digest

fd:a1:b0:fd:26:73:22:a2:e3:30:cc:82:c0:79:7d:3b:17:04:4a:ac:ee:ec:77:c8:bb:ca:04:ad:2f:45:68:4a

Digest Algorithm

sha256

PE Digest Matches

true

96:24:ba:fd:76:27:ba:1f:ba:aa:ad:10:99:8a:c0:34:38:46:5d:30
Signer

Actual PE Digest

96:24:ba:fd:76:27:ba:1f:ba:aa:ad:10:99:8a:c0:34:38:46:5d:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskm\release\noskm.pdb

Imports

imm32

ImmReleaseContext
ImmGetDefaultIMEWnd
ImmNotifyIME
ImmGetContext

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

kernel32

ExitProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetModuleFileNameW
GetLastError
SetEvent
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
WaitForSingleObject
CreateEventW
CreateThread
GetExitCodeThread
TerminateThread
ResetEvent
GetCurrentThreadId
Sleep
GetSystemDirectoryW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
InterlockedDecrement
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
CreateFileW
CreateFileMappingW
GetFileSize
MapViewOfFile
UnmapViewOfFile
InterlockedExchange
GetACP
WriteFile
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
VirtualAlloc
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetStdHandle
GetModuleFileNameA
GetLocaleInfoA
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentProcessId
GetSystemTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo

user32

PostQuitMessage
SendMessageW
GetCursorPos
GetSystemMetrics
UnregisterClassA
MessageBoxW
keybd_event
SystemParametersInfoW
EnumChildWindows
GetForegroundWindow
DefWindowProcW
IsWindowEnabled
GetClassNameW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassW
FindWindowW
FindWindowExW

ole32

CoCreateGuid

oleaut32

VariantClear
SysStringLen
SysAllocString
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW

crypt32

CertFreeCertificateContext

wintrust

WinVerifyTrust

Sections

.text
Size: 292KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npk/noskne.dll
.dll windows:4 windows x86 arch:x86

2c3b5dfddf482859ff80e2482f5966a3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

50:b2:2e:a1:2b:df:d2:31:35:00:15:0d:c1:4f:57:12:ec:73:68:62:3e:7b:ef:66:a6:7d:62:e2:20:b6:c2:5e
Signer

Actual PE Digest

50:b2:2e:a1:2b:df:d2:31:35:00:15:0d:c1:4f:57:12:ec:73:68:62:3e:7b:ef:66:a6:7d:62:e2:20:b6:c2:5e

Digest Algorithm

sha256

PE Digest Matches

true

db:f8:26:d2:98:2c:91:8e:2f:e5:05:f0:3d:19:c4:41:fd:83:4a:5b
Signer

Actual PE Digest

db:f8:26:d2:98:2c:91:8e:2f:e5:05:f0:3d:19:c4:41:fd:83:4a:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskne\release\noskne.pdb

Imports

kernel32

FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
OpenProcess
CloseHandle
MultiByteToWideChar
GetModuleHandleW
CreateFileW
ReadFile
DeviceIoControl
TerminateThread
CreateEventW
GetExitCodeThread
WaitForSingleObject
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetWindowsDirectoryW
CompareStringW
CompareStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
LCMapStringA
WideCharToMultiByte
LCMapStringW
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

shlwapi

PathFindFileNameW

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskne64.dll
.dll windows:4 windows x64 arch:x64

1094f8d8f4ced5bbf565a396b75c277f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:94:07:7a:37:3e:ad:ad:c3:7e:f2:ae:9c:3a:33:af
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:fd:be:36:64:53:f0:54:2e:9d:84:e0:0f:d6:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/11/2016, 00:00

Not After

07/11/2017, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=Research,O=INCA Internet Co.\,Ltd.,L=Seoul,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f6:25:50:17:b4:0f:ad:a7:1a:4f:65:f1:af:85:5a:e5:11:e4:66:82:60:6a:66:df:d2:27:19:cc:7d:f7:8f:7e
Signer

Actual PE Digest

f6:25:50:17:b4:0f:ad:a7:1a:4f:65:f1:af:85:5a:e5:11:e4:66:82:60:6a:66:df:d2:27:19:cc:7d:f7:8f:7e

Digest Algorithm

sha256

PE Digest Matches

true

c2:14:ac:10:67:28:c1:ff:b1:15:4e:75:28:b2:a4:cd:ca:b7:ae:2e
Signer

Actual PE Digest

c2:14:ac:10:67:28:c1:ff:b1:15:4e:75:28:b2:a4:cd:ca:b7:ae:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskne\release\noskne64.pdb

Imports

kernel32

FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
OpenProcess
CloseHandle
GetModuleHandleW
CreateFileW
ReadFile
MultiByteToWideChar
DeviceIoControl
TerminateThread
CreateEventW
GetExitCodeThread
WaitForSingleObject
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetWindowsDirectoryW
CompareStringW
CompareStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
FlsGetValue
TlsAlloc
TlsFree
FlsFree
SetLastError
TlsSetValue
GetCurrentThread
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA

shlwapi

PathFindFileNameW

Sections

.text
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskp.sys
.sys windows:6 windows x86 arch:x86

3e0386df9884d55ec70a30793a2d0b94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\i386\noskp.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
memcpy
rand
srand
KeInsertQueue
IofCompleteRequest
KeRemoveQueue
KeReadStateQueue
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
KeInitializeQueue
KeRundownQueue
KeBugCheck
ObfReferenceObject
IoCreateNotificationEvent
RtlInitUnicodeString
ObReferenceObjectByHandle
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
ExDeleteNPagedLookasideList
ZwClose
PsCreateSystemThread
KeInitializeMutex
ExFreePoolWithTag
KeInitializeDpc
IoCreateSymbolicLink
IoCreateDevice
KeInsertQueueDpc
ObfDereferenceObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoDriverObjectType
ObReferenceObjectByName
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
ExAllocatePool
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
memset
PsGetVersion
ExInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExInterlockedPopEntrySList

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
HalGetInterruptVector

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 818B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskp64.sys
.sys windows:6 windows x64 arch:x64

d960af87a6417c1a1024d41a28a81713

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxp\npkfxs\objfre\amd64\noskp64.pdb

Imports

ntoskrnl.exe

KeRemoveQueue
IoDeleteSymbolicLink
ExFreePoolWithTag
IoCreateNotificationEvent
KeInitializeMutex
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeDpc
ExpInterlockedPopEntrySList
KeReleaseMutex
PsCreateSystemThread
rand
ExEventObjectType
ZwClose
srand
KeBugCheck
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
KeInitializeQueue
PsGetVersion
ObfReferenceObject
ExAllocatePoolWithTag
IoCreateDevice
ExDeleteNPagedLookasideList
KeInsertQueue
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeReleaseSpinLock
IoDriverObjectType
IoGetDeviceObjectPointer
KeInsertQueueDpc
ObfDereferenceObject
ObReferenceObjectByName
IofCallDriver
KeAcquireSpinLockRaiseToDpc
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
RtlFreeUnicodeString
ZwUnmapViewOfSection
ExAllocatePool
ZwCreateSection
ZwOpenFile
KeBugCheckEx
IoCreateSymbolicLink
KeReadStateQueue

hal

KeQueryPerformanceCounter

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskre.dll
.dll windows:4 windows x86 arch:x86

b569b7c7fdaef41a47441f51655b3413

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

60:8b:48:a1:73:5c:69:d5:10:d4:2f:5b:dc:d2:2d:68:e4:15:76:62:b8:29:fe:c0:f9:2d:87:f3:78:c2:4d:cb
Signer

Actual PE Digest

60:8b:48:a1:73:5c:69:d5:10:d4:2f:5b:dc:d2:2d:68:e4:15:76:62:b8:29:fe:c0:f9:2d:87:f3:78:c2:4d:cb

Digest Algorithm

sha256

PE Digest Matches

true

74:9d:f0:89:ec:4e:1c:83:8d:61:81:1e:d4:59:86:80:eb:90:92:24
Signer

Actual PE Digest

74:9d:f0:89:ec:4e:1c:83:8d:61:81:1e:d4:59:86:80:eb:90:92:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskre\release\noskre.pdb

Imports

kernel32

GetLastError
lstrlenW
FreeLibrary
GetModuleHandleW
LockResource
LoadResource
FindResourceExW
FindResourceW
SizeofResource
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
lstrlenA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetProcAddress
LoadLibraryW
InterlockedDecrement
GetModuleFileNameW
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetUserDefaultLCID
WideCharToMultiByte
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSection
CreateFileW
CreateFileMappingA
CloseHandle
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetCurrentProcessId
GetSystemTime
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThread
Sleep
ExitProcess
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc

user32

SetWindowLongA
GetCursorPos
MessageBoxW
IsWindowUnicode
SetPropW
GetSystemMetrics
GetWindowTextLengthW
SendMessageW
CallWindowProcA
CallWindowProcW
SetFocus
SendMessageTimeoutW
IsWindow
GetWindowLongW
GetClassLongA
SetWindowLongW
GetClassLongW
GetWindowTextA
GetWindowTextLengthA
UnregisterClassA

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextW

ole32

CoInitialize
CoCreateGuid
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CLSIDFromString

oleaut32

CreateErrorInfo
VariantChangeType
VariantInit
VarBstrCat
VariantClear
SysAllocString
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SetErrorInfo
GetErrorInfo

shlwapi

PathAppendW
PathRemoveFileSpecW

crypt32

CertFreeCertificateContext
CertCreateCertificateContext

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

Sections

.text
Size: 416KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/noskre64.dll
.dll windows:4 windows x64 arch:x64

6e1a8d1f438618d15588af529af4ba74

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:ab:7e:a4:45:a1:ff:4f:77:62:27:cd:07:f6:e1:a9:a8:3c:cf:b6:be:12:92:d1:4b:1b:85:71:4e:b8:8a:6d
Signer

Actual PE Digest

c5:ab:7e:a4:45:a1:ff:4f:77:62:27:cd:07:f6:e1:a9:a8:3c:cf:b6:be:12:92:d1:4b:1b:85:71:4e:b8:8a:6d

Digest Algorithm

sha256

PE Digest Matches

true

ce:1e:47:3b:76:e7:6f:14:d7:03:22:04:c0:af:d8:e4:32:9b:9b:8c
Signer

Actual PE Digest

ce:1e:47:3b:76:e7:6f:14:d7:03:22:04:c0:af:d8:e4:32:9b:9b:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\noskre\release\noskre64.pdb

Imports

kernel32

lstrlenW
GetLastError
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetModuleHandleW
GetTimeFormatA
GetDateFormatA
GetStringTypeW
GetStringTypeA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
SetConsoleCtrlHandler
FatalAppExitA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetUserDefaultLCID
WideCharToMultiByte
RaiseException
InitializeCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetACP
GetLocaleInfoA
GetThreadLocale
CreateFileW
CreateFileMappingA
CloseHandle
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetSystemTime
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetModuleHandleA
FlsGetValue
TlsAlloc
TlsFree
FlsFree
SetLastError
TlsSetValue
GetCurrentThread
FlsAlloc
Sleep
ExitProcess
HeapSetInformation
HeapCreate
GetCPInfo

user32

GetWindowLongW
GetCursorPos
CallWindowProcA
CallWindowProcW
SetFocus
GetSystemMetrics
IsWindow
SetWindowLongPtrA
GetClassLongPtrA
SetWindowLongPtrW
GetClassLongPtrW
IsWindowUnicode
SetPropW
SendMessageTimeoutW
GetWindowTextLengthW
SendMessageW
GetWindowTextA
GetWindowTextLengthA
MessageBoxW
UnregisterClassA

advapi32

CryptReleaseContext
CryptAcquireContextW
CryptGenRandom

ole32

CoInitialize
CoCreateGuid
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CLSIDFromString

oleaut32

CreateErrorInfo
VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString
SysStringLen
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SetErrorInfo
GetErrorInfo

shlwapi

PathAppendW
PathRemoveFileSpecW

crypt32

CertFreeCertificateContext
CertCreateCertificateContext

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

Sections

.text
Size: 639KB - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosksdk.dll
.dll windows:4 windows x86 arch:x86

c1ac7c938d3a2ae0eff4c43fca456c21

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:6a:b4:3f:b4:8a:a9:46:f2:e1:7c:69:15:8c:e3:75:b3:11:e5:16:cf:88:8c:06:bf:07:e5:76:6b:bf:72:33
Signer

Actual PE Digest

eb:6a:b4:3f:b4:8a:a9:46:f2:e1:7c:69:15:8c:e3:75:b3:11:e5:16:cf:88:8c:06:bf:07:e5:76:6b:bf:72:33

Digest Algorithm

sha256

PE Digest Matches

true

94:81:92:7c:61:b4:a1:f6:91:c0:fc:48:a3:e0:2f:b1:74:22:fb:c0
Signer

Actual PE Digest

94:81:92:7c:61:b4:a1:f6:91:c0:fc:48:a3:e0:2f:b1:74:22:fb:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\nosksdk\release\nosksdk.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

OpenMutexW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetProcAddress
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetModuleFileNameW
GetModuleHandleW
CreateEventW
DeleteCriticalSection
GetLastError
SetEvent
WideCharToMultiByte
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
SetLastError
CreateThread
GetExitCodeThread
WaitForSingleObject
CreateFileA
GetLocaleInfoW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
CompareStringA
CompareStringW
TerminateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
SetEnvironmentVariableA
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
LCMapStringA
LCMapStringW
FatalAppExitA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadIconW
DefWindowProcW
PostQuitMessage
SetForegroundWindow
ShowWindow
CreateDialogParamW
EndDialog
MessageBoxA
GetDlgItem
SetWindowPos
GetClientRect
GetSystemMetrics
MessageBoxW
GetWindowTextA
IsWindowUnicode
IsWindow
GetWindowTextW

advapi32

RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW

Exports

Exports

B13C41F679D245f8A77B299638DA23F4
BD862FD6AED744cd8E9494496F411E77
C3FB1476469C441aAE627C211143EB36
C5DF95B4C2AB4e6bA256752CA1226453
C66BFC39B60740bd97E0BA329879410C
C8C8FF8E24C4491d93770B7AA2DBEA0D
CA5F752F960443ebB1F37CA9C6CB1B43
CA7D6C5180D24fb99441831B0ADEB225
CF7FEF77B7304d9dBE045AD6678BEBB7
D49C95B941BA47cf8070310C5B9F2CA8
D566D5CB1C2142b8BB77452E96483857
DE02AC21F7304d0e859BD8E23DDD3F20
E1CF819097CD4f2b9E51A5816369B34D
E2231243DEEF47a891BFE54F0A2FFC76
F0111B7F4EA04cf5B37069F2739D421B
F40F83011F9D49028732A46B66F78824
F523B3FC057442afB518F17709EE7E97
F797FD3654C64aedBFB54A900ABF4838
F9B781E5E0874a7bB7E64C49F69A85A5
FC1964279D65464eBF3269D01AF4E6D5
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NPKGetWindowText@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptEnd@8
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptInit@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkRegCryptWindow@12
_Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkSetOpt@8

Sections

.text
Size: 200KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosksdk64.dll
.dll windows:4 windows x64 arch:x64

74ff58e83fa8891ee8c1f45c227314d6

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:7c:49:91:ad:23:c0:6f:fc:88:c7:68:67:f1:e3:fb:56:78:86:0a:46:2a:b5:a1:c2:09:dc:03:67:b8:97:1a
Signer

Actual PE Digest

c6:7c:49:91:ad:23:c0:6f:fc:88:c7:68:67:f1:e3:fb:56:78:86:0a:46:2a:b5:a1:c2:09:dc:03:67:b8:97:1a

Digest Algorithm

sha256

PE Digest Matches

true

62:3b:c2:3f:35:ad:89:5e:dd:f6:9e:40:6e:e2:9b:a9:ab:e0:af:75
Signer

Actual PE Digest

62:3b:c2:3f:35:ad:89:5e:dd:f6:9e:40:6e:e2:9b:a9:ab:e0:af:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Source\NOSK\dll\nosksdk\release\nosksdk64.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

OpenMutexW
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
CreateEventW
DeleteCriticalSection
SetEvent
SetThreadPriority
GetThreadPriority
SuspendThread
ResumeThread
SetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
TerminateThread
MultiByteToWideChar
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapReAlloc
InitializeCriticalSection
LoadLibraryA
SetConsoleCtrlHandler
GetConsoleMode
CloseHandle
CompareStringA
CompareStringW
WideCharToMultiByte
RaiseException
GetConsoleCP
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
GetProcessHeap
SetEnvironmentVariableA
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
FlsGetValue
TlsAlloc
TlsFree
FlsFree
TlsSetValue
GetCurrentThread
FlsAlloc
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA

user32

IsWindowUnicode
IsWindow
GetWindowTextW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
LoadIconW
DefWindowProcW
PostQuitMessage
SetForegroundWindow
ShowWindow
CreateDialogParamW
EndDialog
MessageBoxA
MessageBoxW
GetDlgItem
GetWindowTextA
SetWindowPos
GetClientRect
GetSystemMetrics

advapi32

RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW

Exports

Exports

B13C41F679D245f8A77B299638DA23F4
BD862FD6AED744cd8E9494496F411E77
C3FB1476469C441aAE627C211143EB36
C5DF95B4C2AB4e6bA256752CA1226453
C66BFC39B60740bd97E0BA329879410C
C8C8FF8E24C4491d93770B7AA2DBEA0D
CA5F752F960443ebB1F37CA9C6CB1B43
CA7D6C5180D24fb99441831B0ADEB225
CF7FEF77B7304d9dBE045AD6678BEBB7
D49C95B941BA47cf8070310C5B9F2CA8
D566D5CB1C2142b8BB77452E96483857
DE02AC21F7304d0e859BD8E23DDD3F20
E1CF819097CD4f2b9E51A5816369B34D
E2231243DEEF47a891BFE54F0A2FFC76
F0111B7F4EA04cf5B37069F2739D421B
F40F83011F9D49028732A46B66F78824
F523B3FC057442afB518F17709EE7E97
F797FD3654C64aedBFB54A900ABF4838
F9B781E5E0874a7bB7E64C49F69A85A5
FC1964279D65464eBF3269D01AF4E6D5
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NPKGetWindowText
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptEnd
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkCyptInit
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkRegCryptWindow
Java_com_IncaKeyCrypt_keyboardsec_JNIINCA_NpkSetOpt

Sections

.text
Size: 318KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosku.sys
.sys windows:6 windows x86 arch:x86

1ea8c2e6c9edb3fe0bf59d5eb22ef720

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\i386\nosku.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
IoReleaseRemoveLockEx
IofCallDriver
IoAcquireRemoveLockEx
KeRemoveQueue
KeReadStateQueue
KeSetEvent
KeInitializeQueue
KeRundownQueue
ObfReferenceObject
IoCreateNotificationEvent
ObReferenceObjectByHandle
ExEventObjectType
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ExAllocatePool
RtlCompareMemory
memcpy
IoDetachDevice
KeInsertQueue
PoStartNextPowerIrp
IoInitializeRemoveLockEx
IoAttachDeviceToDeviceStack
PsGetVersion
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
ExfInterlockedInsertHeadList
DbgPrint
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
ZwQuerySystemInformation
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeUnicodeString
_vsnprintf
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByName
IoDriverObjectType
MmIsAddressValid
KeTickCount
KeBugCheckEx
srand
rand
ExAllocatePoolWithTag
ExFreePoolWithTag
memset
ExInterlockedPushEntrySList
PoCallDriver
ExInterlockedPopEntrySList
RtlUnwind

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter

usbd.sys

_USBD_ParseConfigurationDescriptorEx@28

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/nosku64.sys
.sys windows:6 windows x64 arch:x64

ec39ad5d8bda55614b3c9c35201693c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\source\nosk\sys\npkfxu\npkfxu\objfre\amd64\nosku64.pdb

Imports

ntoskrnl.exe

IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
ExFreePoolWithTag
IoCreateNotificationEvent
ExInitializeNPagedLookasideList
KeRundownQueue
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
ExpInterlockedPopEntrySList
IoDetachDevice
ExAllocatePool
rand
ExEventObjectType
PoStartNextPowerIrp
srand
IofCompleteRequest
ExQueryDepthSList
ObReferenceObjectByHandle
KeWaitForSingleObject
IoAttachDeviceToDeviceStack
KeInitializeQueue
PoCallDriver
PsGetVersion
KeRemoveQueue
ObfReferenceObject
IoCreateSymbolicLink
IoInitializeRemoveLockEx
IoCreateDevice
ExDeleteNPagedLookasideList
IofCallDriver
KeInsertQueue
KeAcquireSpinLockRaiseToDpc
ExInterlockedInsertHeadList
DbgPrint
_stricmp
RtlAnsiStringToUnicodeString
ZwMapViewOfSection
RtlInitAnsiString
ZwQuerySystemInformation
RtlFreeUnicodeString
ZwUnmapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlUnicodeStringToAnsiString
IoDriverObjectType
_vsnprintf
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
KeBugCheckEx
IoAcquireRemoveLockEx
ExAllocatePoolWithTag
RtlCompareMemory
KeReadStateQueue
_local_unwind
RtlUnwindEx

hal

KeQueryPerformanceCounter

usbd.sys

USBD_ParseConfigurationDescriptorEx

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/np_ck32s.sys
.sys windows:6 windows x86 arch:x86

42b4bd40fdd480615a488ee2a1f82a1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\dev-crt_cur\nprotect_crypto_재인증_20180912\05.암호모듈_소스\windows\sys\bin\Release\i386\np_ck32s.pdb

Imports

ntoskrnl.exe

MmIsAddressValid
memset
ZwQuerySystemInformation
ZwClose
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsTerminateSystemThread
KeDelayExecutionThread
KdDebuggerEnabled
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
PsCreateSystemThread
ExAllocatePoolWithTag
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
memcpy
RtlRandom
KeTickCount
KeQuerySystemTime
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
DbgPrint
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

_NpDecPK@32
_NpDecSymk@28
_NpDestroy@4
_NpEncPK@32
_NpEncSymk@28
_NpGetInfo@8
_NpGetState@8
_NpHMAC@32
_NpHash@24
_NpInit@4
_NpPKGen@16
_NpRandom@12
_NpSKGen@12
_NpSelfTest@4
_NpSignPK@24
_NpVerifyPK@24

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 896B - Virtual size: 818B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/np_ck64s.sys
.sys windows:6 windows x64 arch:x64

e2cb6be3e814f248b538f342e408382c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\dev-crt_cur\nprotect_crypto_재인증_20180912\05.암호모듈_소스\windows\sys\bin\Release_x64\amd64\np_ck64s.pdb

Imports

ntoskrnl.exe

RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
KeDelayExecutionThread
PsCreateSystemThread
KdDebuggerEnabled
PsTerminateSystemThread
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
MmIsAddressValid
ExFreePoolWithTag
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
DbgPrint
RtlRandom
PsGetCurrentThreadId
PsGetCurrentProcessId
KeBugCheckEx
ObfDereferenceObject
ExAllocatePoolWithTag

hal

KeQueryPerformanceCounter

Exports

Exports

NpDecPK
NpDecSymk
NpDestroy
NpEncPK
NpEncSymk
NpGetInfo
NpGetState
NpHMAC
NpHash
NpInit
NpPKGen
NpRandom
NpSKGen
NpSelfTest
NpSignPK
NpVerifyPK

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 357B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npcf_win_32u.dll
.dll windows:5 windows x86 arch:x86

208abebe9e49ddc3d981d2f38dcadd87

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:f3:f0:f7:39:57:a6:9d:a0:71:00:56:02:08:42:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:ac:50:56:07:d6:96:b1:31:59:d3:58:40:07:e9:37
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/07/2018, 00:00

Not After

16/07/2019, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,OU=IT Team,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd
Signer

Actual PE Digest

02:6c:66:76:30:c7:4c:4d:4e:c2:a2:54:80:70:b1:3d:fd:95:c8:ee:9e:f0:1f:09:e2:58:0d:03:d5:6a:a0:dd

Digest Algorithm

sha256

PE Digest Matches

true

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e
Signer

Actual PE Digest

f7:1a:64:89:05:d9:1e:40:12:ac:45:b8:35:d6:43:39:77:01:72:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\INCA\Project\SVN\DevGroup\dev-crt\nProtect_Crypto_재인증_20180912\05.암호모듈_소스\Windows\dll\bin\Release\np_cu_f.pdb

Imports

kernel32

FreeLibrary
QueryPerformanceCounter
GetTickCount
GetProcessHeap
GetProcAddress
LoadLibraryA
GlobalMemoryStatusEx
GetSystemInfo
GetModuleHandleA
QueryPerformanceFrequency
GetCurrentThreadId
GetVersionExA
CloseHandle
GetCurrentProcessId
GetSystemTime
GetFileSize
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetModuleFileNameW
CreateFileW
CreateFileMappingA
GetCurrentProcess
TerminateThread
Sleep
CreateThread
IsProcessorFeaturePresent
GetStringTypeW
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
ExitProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapReAlloc
LCMapStringW

user32

FindWindowA
GetCursorPos
GetSystemMetrics

ole32

CoCreateGuid

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npkakl.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/11/2014, 00:00

Not After

10/11/2015, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f
Signer

Actual PE Digest

a2:a8:88:ce:7f:b0:d2:64:da:51:b6:db:5d:ec:2f:61:cf:fe:9a:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkeycrypt\drivers\5.0\nt\npkakl\npkakl\objfre\i386\npkakl.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npk/npkfxa.sys
.sys windows:6 windows x86 arch:x86

4f95daf21e35f87ace98e4852a8746d0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:aa:48:62:16:80:2c:19:ef:1e:95:b5:55:52:d3:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/11/2014, 00:00

Not After

10/11/2015, 23:59

Subject

CN=INCA INTERNET CO.\, LTD.,O=INCA INTERNET CO.\, LTD.,L=GURO-GU,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a
Signer

Actual PE Digest

2a:00:93:67:b2:db:8f:34:92:c5:42:50:aa:17:f6:a6:8c:4f:db:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\build\sources\npkfx65\sys\npkfxa\npkakl\npkfxa\objfre\i386\npkfxa.pdb

Imports

ntoskrnl.exe

IoGetCurrentProcess
RtlCompareMemory
ExAllocatePoolWithTag
memset
MmGetSystemRoutineAddress
RtlInitUnicodeString
ExFreePoolWithTag
KeDelayExecutionThread
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeSetEvent
strstr
_strupr
KeQueryActiveProcessors
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualUnicodeString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
RtlFreeOemString
ZwQuerySystemInformation
KeSetImportanceDpc
ExDeleteResourceLite
KeWaitForSingleObject
IoDeleteSymbolicLink
ZwUnloadDriver
_wcsicmp
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
PsTerminateSystemThread
KdEnableDebugger
IofCompleteRequest
DbgPrint
ExEventObjectType
PsCreateSystemThread
KeInitializeEvent
ExInitializeResourceLite
ExAcquireResourceSharedLite
PsGetVersion
KeTickCount
KeBugCheckEx
memcpy
ObQueryNameString
MmIsAddressValid
PsLookupProcessByProcessId
ObfDereferenceObject
IoCreateDevice
IoCreateSymbolicLink
RtlUpcaseUnicodeStringToOemString
IoDeleteDevice
RtlUnwind

hal

KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_UCHAR
WRITE_PORT_UCHAR
READ_PORT_BUFFER_UCHAR

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nps/bar_bg.npi
nps/bar_full.npi
.gif
nps/bgBottom.npi
.png
nps/bg_launcher.npi
.png
nps/bi.npi
.jpg
nps/close.npi
nps/imgWarn.npi
.jpg
nps/logo.npi
nps/nphapsie_eng.nph
nps/nphapsie_kor.nph
nps/npicommon.npi
.png
nps/npimain_conf.npi
.png
nps/npimsg1.npi
.png
nps/npimsg2.npi
.png
nps/npimsg3.npi
.png
nps/npimsg5.npi
.png
nps/npimsg6.npi
.png
nps/npimsg7.npi
.png
nps/npinpnmini.npi
.png
nps/npiui.npi
.png
nps/npmypcalert.npi
.png
nps/npmypcanoti.npi
.png
nps/npmypcnoti_t.npi
.png
npsf.npb
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:67:43:80:cd:cb:43:22:d5:e0:b9:8a:96:af:a4:f4:de:1b:e6:f1:22:45:f0:af:fb:ab:a4:30:61:cd:35:30
Signer

Actual PE Digest

ab:67:43:80:cd:cb:43:22:d5:e0:b9:8a:96:af:a4:f4:de:1b:e6:f1:22:45:f0:af:fb:ab:a4:30:61:cd:35:30

Digest Algorithm

sha256

PE Digest Matches

true

59:80:6a:48:0b:d6:65:27:6e:58:80:f8:c0:a0:87:0d:8e:c7:29:0b
Signer

Actual PE Digest

59:80:6a:48:0b:d6:65:27:6e:58:80:f8:c0:a0:87:0d:8e:c7:29:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npslm20.npd
.dll windows:4 windows x86 arch:x86

343be62878c10f0df90e6b73f6b35822

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d8:1f:b6:ae:d0:e1:7c:88:e2:a5:89:09:eb:72:69
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

12/10/2021, 00:00

Not After

10/10/2022, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:56:41:2a:61:09:15:e9:a5:57:9b:61:df:0a:81:4b:4f:52:1b:b9:eb:7c:56:43:53:90:99:c4:8f:05:6d:14
Signer

Actual PE Digest

50:56:41:2a:61:09:15:e9:a5:57:9b:61:df:0a:81:4b:4f:52:1b:b9:eb:7c:56:43:53:90:99:c4:8f:05:6d:14

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_Work\nProtectZ\product\npn60\npslm20\build\bin\release\npslm20.pdb

Imports

kernel32

GetVolumeInformationW
GetWindowsDirectoryW
GetLogicalDrives
QueryDosDeviceW
LoadLibraryW
GetSystemDirectoryW
ReleaseMutex
CreateMutexW
CreateFileA
CreateProcessW
SetFilePointer
WriteFile
lstrlenW
GetFileTime
SetFileTime
SystemTimeToFileTime
GetSystemTime
DeleteFileW
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeExW
WaitForSingleObject
TerminateThread
GetLogicalDriveStringsW
GetDriveTypeW
FindFirstFileW
FindNextFileW
FindClose
GetDateFormatW
CreateFileW
DeviceIoControl
GetSystemWow64DirectoryW
GetSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
lstrcmpiW
lstrcmpiA
WideCharToMultiByte
MultiByteToWideChar
ProcessIdToSessionId
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Sleep
Process32NextW
GetModuleHandleA
GetModuleFileNameW
GetCurrentProcess
CreateDirectoryW
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
SetStdHandle
OutputDebugStringW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
IsDebuggerPresent
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetProcessHeap
GetModuleHandleW
GetProcAddress
HeapFree
FileTimeToSystemTime
OpenProcess
CloseHandle
LocalFree
GetLastError
LocalAlloc
SetLastError
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
ExitProcess
GetCPInfo
InterlockedDecrement
GetVersion
HeapAlloc
GetFileSize
ReadFile
WriteConsoleW
CreateThread
GetFileAttributesW
GetCurrentThreadId
GetCommandLineA
GetVersionExA
LCMapStringW
LCMapStringA

user32

LoadStringW
CharUpperW
GetSystemMetrics

advapi32

CryptDecrypt
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
OpenProcessToken
LookupAccountSidW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptDestroyKey
CryptEncrypt
RegEnumKeyExW
CryptDeriveKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegOpenKeyW
GetTokenInformation

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoInitialize
CoCreateInstance
CoCreateGuid

oleaut32

SafeArrayGetUBound
SafeArrayGetElement
VariantClear
VariantChangeType
VariantCopy
VariantInit
SysFreeString
SysAllocString
SafeArrayGetLBound

shlwapi

PathRemoveFileSpecW
StrDupW
PathAppendW
StrStrW
PathFileExistsW
PathIsDirectoryW
PathRemoveBackslashW

wininet

HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetSetOptionW

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertNameToStrW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

WSAGetLastError
gethostbyname
inet_ntoa
htonl
htons
gethostbyaddr
getservbyport
WSASetLastError
inet_addr
WSAStartup
WSACleanup
ntohs
getservbyname

iphlpapi

GetAdaptersInfo
SendARP
GetIpAddrTable
GetIpForwardTable
GetBestRoute
GetAdaptersAddresses

netapi32

NetUserGetInfo
NetUserModalsGet
NetApiBufferFree

psapi

GetModuleFileNameExW
GetModuleBaseNameW

rpcrt4

RpcStringFreeW
UuidToStringW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDW
CM_Get_Parent

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW

dnsapi

DnsQuery_W
DnsFree

Exports

Exports

fn_getVersion

Sections

.text
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npupdatec.exe
.exe windows:4 windows x86 arch:x86

ea1cd0c29ac3d7b5608fbc97ef7dcd12

Code Sign

0d:f1:1e:74:4d:02:01:06:b5:3c:2b:5b:2b:f6:31:05
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/09/2020, 00:00

Not After

06/10/2021, 12:00

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:04:97:76:8e:99:d3:f7:7e:3c:fd:9c:e7:b7:6b:e7
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20/10/2020, 00:00

Not After

17/10/2021, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Guro-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:62:9c:38:2d:ca:da:4d:00:a6:e8:86:4d:55:f9:d2:3f:33:7d:67:b3:55:72:6f:0c:0d:9d:64:a9:13:67:8d
Signer

Actual PE Digest

c5:62:9c:38:2d:ca:da:4d:00:a6:e8:86:4d:55:f9:d2:3f:33:7d:67:b3:55:72:6f:0c:0d:9d:64:a9:13:67:8d

Digest Algorithm

sha256

PE Digest Matches

true

73:30:14:df:ef:3f:88:22:9c:bf:bc:32:cd:57:65:e7:71:22:7e:26
Signer

Actual PE Digest

73:30:14:df:ef:3f:88:22:9c:bf:bc:32:cd:57:65:e7:71:22:7e:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\001_Work\npUpdate\npUpdater\bin\releaseu\npUpdateC.pdb

Imports

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathIsDirectoryW
PathRemoveBackslashW
PathFileExistsW

psapi

GetModuleBaseNameW
GetModuleFileNameExW

kernel32

HeapCreate
VirtualFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
LockResource
GetCurrentProcess
SizeofResource
CreateFileW
HeapDestroy
Sleep
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
CreateEventA
GetCommandLineA
CreateMutexW
CloseHandle
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryW
FindResourceW
LoadResource
DeleteFileW
GetUserDefaultUILanguage
MulDiv
GlobalFree
ResumeThread
GlobalAlloc
FreeResource
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
GlobalLock
GlobalUnlock
MultiByteToWideChar
LocalAlloc
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetLocalTime
GetStartupInfoA
GetFileType
SetHandleCount
WriteFile
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
VirtualAlloc
VirtualProtect
HeapSize
CopyFileW
MoveFileW
MoveFileExW
RemoveDirectoryW
InterlockedCompareExchange
CreateMutexA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
RaiseException
ExitProcess
RtlUnwind
HeapReAlloc
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetStartupInfoW
SetErrorMode
lstrlenA
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
GetFileTime
SystemTimeToFileTime
GetVolumeInformationW
DuplicateHandle
FlushFileBuffers
GetThreadLocale
GetStringTypeExW
InterlockedDecrement
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetVersionExA
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
UnlockFile
LockFile
IsBadReadPtr
lstrlenW
GetFullPathNameW
SetFileTime
SetEndOfFile
SetFilePointer
GetStdHandle
LoadLibraryA
OpenMutexW
ReadFile
GetFileSize
SetLastError
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateDirectoryW
TerminateProcess
ProcessIdToSessionId
CreateProcessW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FormatMessageW
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
FormatMessageA
GetVersion
GetSystemWow64DirectoryW
GetModuleHandleW
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetSystemInfo
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
SetFileAttributesW
GetFileAttributesW
WideCharToMultiByte
GetTickCount
DeviceIoControl
CreateFileA
GetModuleFileNameW

user32

UnregisterClassA
PostThreadMessageW
RegisterClipboardFormatW
UnregisterClassW
MessageBeep
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
CharNextW
DestroyMenu
LoadCursorW
GetSysColorBrush
CharUpperW
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsWindowEnabled
EndPaint
BeginPaint
GetWindowDC
SetCursor
GetMessageW
TranslateMessage
GetActiveWindow
ValidateRect
PostQuitMessage
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetForegroundWindow
ExitWindowsEx
GetTopWindow
GetWindowThreadProcessId
GetWindow
GetWindowTextLengthW
IsWindowVisible
MessageBoxW
DrawFocusRect
OffsetRect
DrawEdge
PostMessageW
GetNextDlgGroupItem
ReleaseCapture
WindowFromPoint
GetCursorPos
GetCapture
GetWindowLongW
ClientToScreen
GetParent
SetRect
ReleaseDC
GetDC
LoadBitmapW
LoadImageW
SetWindowRgn
GetClassNameW
IsIconic
GetKeyState
FillRect
LoadIconW
GetSysColor
InflateRect
GetClassLongW
WindowFromDC
InvalidateRect
IsWindow
GrayStringW
CopyRect
DrawTextExW
DrawIcon
FindWindowW
DrawTextW
GetClientRect
GetDesktopWindow
GetSystemMetrics
TabbedTextOutW
GetWindowRect
EnableWindow
SendMessageW
LoadStringW

gdi32

CreateCompatibleBitmap
GetMapMode
GetWindowExtEx
SelectObject
Escape
GetViewportExtEx
DPtoLP
GetStockObject
PtVisible
CreateFontW
GetBkColor
RectVisible
CreateCompatibleDC
BitBlt
TextOutW
LPtoDP
ExtTextOutW
GetObjectW
CreateRectRgn
CombineRgn
GetPixel
DeleteObject
CreateSolidBrush
SetPixel
StretchBlt
DeleteDC
GetDeviceCaps
CreateFontIndirectW
SelectClipRgn
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
OffsetViewportOrgEx
SaveDC
RestoreDC
SetBkMode
SetMapMode
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateRectRgnIndirect
GetTextColor
GetRgnBox
SetViewportOrgEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

CreateProcessAsUserW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
GetUserNameW
RegDeleteKeyW
RegDeleteValueW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
RegQueryValueW
RegEnumKeyW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
EnumDependentServicesW
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
CreateServiceW
ConvertSidToStringSidW
OpenSCManagerW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyW
InitializeSecurityDescriptor
GetSidSubAuthorityCount
IsValidSid
GetSidSubAuthority
GetSidIdentifierAuthority
LookupAccountSidW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
DuplicateTokenEx
SetKernelObjectSecurity
MakeAbsoluteSD
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
SetEntriesInAclW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHAppBarMessage

comctl32

_TrackMouseEvent
InitCommonControlsEx

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoTaskMemFree
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoGetClassObject
StgOpenStorageOnILockBytes

oleaut32

OleCreateFontIndirect
OleLoadPicture
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
SysAllocStringLen
VariantChangeType
SysStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses
GetBestRoute

wintrust

WinVerifyTrust

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CryptQueryObject
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringW

netapi32

NetGetJoinInformation
NetApiBufferFree
NetLocalGroupGetMembers

wininet

FtpOpenFileW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
InternetOpenW
FtpGetFileSize
HttpSendRequestW
InternetCloseHandle
InternetSetOptionW
InternetConnectW
InternetQueryDataAvailable

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

inet_ntoa
inet_addr

Sections

.text
Size: 964KB - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 312KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
npx/nosinfo.npx
npx/npcIdsrule.npx
npx/npcaddon.npx
npx/npcbscallow.npx
npx/npcbscmsgbox.npx
npx/npccheckdom.npx
npx/npcfdsdom.npx
npx/npcfsavantirootkitlist.npx
npx/npcfsavmsgbox.npx
npx/npcfuncmgr.npx
npx/npcfwallow.npx
npx/npcfwmsgbox.npx
npx/npcfwother.npx
npx/npchfm.npx
npx/npchtsgarak_wooribank.npx
npx/npcnpkdom.npx
npx/npcnpnbank_KFCC.npx
npx/npcnpnbank_bankcomm.npx
npx/npcnpnbank_bnk.npx
npx/npcnpnbank_bss.npx
npx/npcnpnbank_charm.npx
npx/npcnpnbank_cu.npx
npx/npcnpnbank_cufilesystem.npx
npx/npcnpnbank_dmd.npx
npx/npcnpnbank_flab_hanwha.npx
npx/npcnpnbank_fsb.npx
npx/npcnpnbank_fsbDBS.npx
npx/npcnpnbank_hanasavings.npx
npx/npcnpnbank_hbsb.npx
npx/npcnpnbank_ibk.npx
npx/npcnpnbank_ibk_Foreign.npx
npx/npcnpnbank_ibk_boxplatform.npx
npx/npcnpnbank_ibk_vcs.npx
npx/npcnpnbank_ibkinternet.npx
npx/npcnpnbank_insungbank.npx
npx/npcnpnbank_jbbank.npx
npx/npcnpnbank_kbsavings.npx
npx/npcnpnbank_kebbank.npx
npx/npcnpnbank_kfb.npx
npx/npcnpnbank_knbank.npx
npx/npcnpnbank_ko.npx
npx/npcnpnbank_livesbbank.npx
npx/npcnpnbank_moaloan.npx
npx/npcnpnbank_moastockloan.npx
npx/npcnpnbank_osb.npx
npx/npcnpnbank_peper.npx
npx/npcnpnbank_puruensaving.npx
npx/npcnpnbank_sangsanginsb.npx
npx/npcnpnbank_sbisb.npx
npx/npcnpnbank_thebank.npx
npx/npcnpnbank_woori_fxtrade.npx
npx/npcnpnbank_wooribank.npx
npx/npcnpnbank_wooriib.npx
npx/npcnpncard_bccardhome.npx
npx/npcnpncard_bluewalnut.npx
npx/npcnpncard_hyundaicard.npx
npx/npcnpncard_hyundaicardhome.npx
npx/npcnpncard_lottecard.npx
npx/npcnpncard_lottedcardhome.npx
npx/npcnpncard_nh_economy.npx
npx/npcnpncard_nhcard.npx
npx/npcnpncard_samsung_tablet.npx
npx/npcnpncard_samsungcard.npx
npx/npcnpncard_samsungcardhome.npx
npx/npcnpncard_shinhancard.npx
npx/npcnpncard_shinhancardcorp.npx
npx/npcnpncard_shinhancardhome.npx
npx/npcnpncard_wooribank.npx
npx/npcnpncommon_international.npx
npx/npcnpncommon_preview.npx
npx/npcnpncompany_KRP.npx
npx/npcnpncompany_aju.npx
npx/npcnpncompany_ajuk.npx
npx/npcnpncompany_auto_hyundaiCapital.npx
npx/npcnpncompany_benzfinancial.npx
npx/npcnpncompany_bestlg.npx
npx/npcnpncompany_bithumb.npx
npx/npcnpncompany_cmid.npx
npx/npcnpncompany_deliveryCar.npx
npx/npcnpncompany_hanacapital.npx
npx/npcnpncompany_hyundaicapital.npx
npx/npcnpncompany_hyundaicapital_AP.npx
npx/npcnpncompany_hyundaicapitalautodigital.npx
npx/npcnpncompany_hyundaicommercial.npx
npx/npcnpncompany_kdb.npx
npx/npcnpncompany_kdbc.npx
npx/npcnpncompany_kedkorea.npx
npx/npcnpncompany_kindkrx.npx
npx/npcnpncompany_konai.npx
npx/npcnpncompany_konaicard.npx
npx/npcnpncompany_kovex.npx
npx/npcnpncompany_krxcs.npx
npx/npcnpncompany_ktnet.npx
npx/npcnpncompany_leadcorp.npx
npx/npcnpncompany_lensa.npx
npx/npcnpncompany_lpoint.npx
npx/npcnpncompany_nhcapital.npx
npx/npcnpncompany_nowrms.npx
npx/npcnpncompany_s2b.npx
npx/npcnpncompany_shinmyung.npx
npx/npcnpncompany_ticketmonster.npx
npx/npcnpncompany_vwfs.npx
npx/npcnpncompany_withcapital.npx
npx/npcnpncompany_woorifcaptialwon.npx
npx/npcnpncompany_xlgames.npx
npx/npcnpndom.npx
npx/npcnpnedu_ghu.npx
npx/npcnpngarak_wooribank.npx
npx/npcnpngov_anyang.npx
npx/npcnpngov_assembly_mail.npx
npx/npcnpngov_barotalk.npx
npx/npcnpngov_childcare.npx
npx/npcnpngov_credit4u.npx
npx/npcnpngov_customs.npx
npx/npcnpngov_cwcl.npx
npx/npcnpngov_cyber.npx
npx/npcnpngov_cyber_credit_couns.npx
npx/npcnpngov_cyberpolice.npx
npx/npcnpngov_cyberseoulshinbo.npx
npx/npcnpngov_d2b.npx
npx/npcnpngov_diais.npx
npx/npcnpngov_dynamicebusan.npx
npx/npcnpngov_edufunc_improve.npx
npx/npcnpngov_eminwon.goyang.npx
npx/npcnpngov_eminwonmolit.npx
npx/npcnpngov_emmskogas.npx
npx/npcnpngov_epost.npx
npx/npcnpngov_epostbank.npx
npx/npcnpngov_epostmall.npx
npx/npcnpngov_excard.npx
npx/npcnpngov_forest.npx
npx/npcnpngov_fss.npx
npx/npcnpngov_fuel.npx
npx/npcnpngov_gimpo.npx
npx/npcnpngov_gsnd.npx
npx/npcnpngov_guri.npx
npx/npcnpngov_gvpn.npx
npx/npcnpngov_happylife.npx
npx/npcnpngov_hf.npx
npx/npcnpngov_hipassdongtan.npx
npx/npcnpngov_icheon.npx
npx/npcnpngov_icl.npx
npx/npcnpngov_iros.npx
npx/npcnpngov_issi.npx
npx/npcnpngov_jindo.npx
npx/npcnpngov_kcue.npx
npx/npcnpngov_kdhc.npx
npx/npcnpngov_kdic.npx
npx/npcnpngov_kecoke.npx
npx/npcnpngov_kemco.npx
npx/npcnpngov_keris.npx
npx/npcnpngov_keris_childneis.npx
npx/npcnpngov_khnp.npx
npx/npcnpngov_kipo.npx
npx/npcnpngov_knoc.npx
npx/npcnpngov_knocecos.npx
npx/npcnpngov_kodit.npx
npx/npcnpngov_kofiu.npx
npx/npcnpngov_learninganyang.npx
npx/npcnpngov_lx.npx
npx/npcnpngov_mailknoc.npx
npx/npcnpngov_mailkogas.npx
npx/npcnpngov_meatwatch.npx
npx/npcnpngov_mhisseoul.npx
npx/npcnpngov_mohw_ng_khis.npx
npx/npcnpngov_nas_assembly.npx
npx/npcnpngov_nationsubsidy.npx
npx/npcnpngov_neis_keris.npx
npx/npcnpngov_neis_public.npx
npx/npcnpngov_nibp.npx
npx/npcnpngov_nonghyup_hers.npx
npx/npcnpngov_nps.npx
npx/npcnpngov_nskkhealth.npx
npx/npcnpngov_nyjdreamcall.npx
npx/npcnpngov_oc.npx
npx/npcnpngov_peti.npx
npx/npcnpngov_police.npx
npx/npcnpngov_policemail.npx
npx/npcnpngov_postfc.npx
npx/npcnpngov_reunionunikorea.npx
npx/npcnpngov_sbhosp.npx
npx/npcnpngov_scourt.npx
npx/npcnpngov_seolbi.npx
npx/npcnpngov_spo.npx
npx/npcnpngov_ssis.npx
npx/npcnpngov_tongil.npx
npx/npcnpngov_unikorea.npx
npx/npcnpngov_wetax.npx
npx/npcnpngov_zvaup_kics.npx
npx/npcnpnins_allianzlife.npx
npx/npcnpnins_axageneralins.npx
npx/npcnpnins_chubb.npx
npx/npcnpnins_dbcm.npx
npx/npcnpnins_dblife_digitalsales.npx
npx/npcnpnins_dgbfnlife.npx
npx/npcnpnins_hana_life.npx
npx/npcnpnins_hanwhalife_inscore.npx
npx/npcnpnins_heungkukfire.npx
npx/npcnpnins_heungkukfirecyber.npx
npx/npcnpnins_heungkukfirega.npx
npx/npcnpnins_heungkukfiresfa.npx
npx/npcnpnins_heungkuklife.npx
npx/npcnpnins_hi.npx
npx/npcnpnins_hisales.npx
npx/npcnpnins_histock.npx
npx/npcnpnins_hwgeneral.npx
npx/npcnpnins_hyundailife.npx
npx/npcnpnins_hyundailifega.npx
npx/npcnpnins_ibki.npx
npx/npcnpnins_inglife.npx
npx/npcnpnins_kdblife.npx
npx/npcnpnins_kdic.npx
npx/npcnpnins_loveageplan.npx
npx/npcnpnins_meritzfire.npx
npx/npcnpnins_mggeneralins.npx
npx/npcnpnins_miraeassetlife.npx
npx/npcnpnins_miraeassetonline.npx
npx/npcnpnins_pcalife.npx
npx/npcnpnins_pensionheungkuklife.npx
npx/npcnpnins_pensionkdblife.npx
npx/npcnpnins_reimbursement.npx
npx/npcnpnins_samsungfire.npx
npx/npcnpnins_samsungfire_b2b2c.npx
npx/npcnpnins_samsungfire_home.npx
npx/npcnpnins_samsunglife_ga.npx
npx/npcnpnorg_eleckareabar.npx
npx/npcnpnorg_kdissw.npx
npx/npcnpnorg_kftc.npx
npx/npcnpnorg_khealth.npx
npx/npcnpnorg_kisanonface_education.npx
npx/npcnpnorg_kisanonface_medical.npx
npx/npcnpnorg_knia.npx
npx/npcnpnorg_kscfc.npx
npx/npcnpnorg_ksd.npx
npx/npcnpnorg_kukmin.npx
npx/npcnpnorg_sejonguni.npx
npx/npcnpnorg_seomin.npx
npx/npcnpnorg_tta.npx
npx/npcnpnpg_kcp.npx
npx/npcnpnpg_kicc.npx
npx/npcnpnpg_vp.npx
npx/npcnpnpreview.npx
npx/npcnpnstock_bemy_koscom.npx
npx/npcnpnstock_bemyunicorn.npx
npx/npcnpnstock_dashinstock.npx
npx/npcnpnstock_fundkoscom.npx
npx/npcnpnstock_grprisk.npx
npx/npcnpnstock_hana.npx
npx/npcnpnstock_hanahts.npx
npx/npcnpnstock_hdable.npx
npx/npcnpnstock_kasset.npx
npx/npcnpnstock_kdbdw.npx
npx/npcnpnstock_miraeassetpension.npx
npx/npcnpnstock_nhfutures.npx
npx/npcnpnstock_samsungcnt.npx
npx/npcnpnstock_shinhaninvest.npx
npx/npcnpnstock_sks.npx
npx/npcnpnstock_woorisajumanagement.npx
npx/npcnpnstock_wtskoscom.npx
npx/npcnpnuamsgbox.npx
npx/npcnpnuseractor.npx
npx/npcprotectpidallowlist.npx
npx/npcrtddriver.npx
npx/npcrtdmsgbox.npx
npx/npcrtdrunregistry.npx
npx/npcrtdscandll.npx
npx/npcrtdscanfolder.npx
npx/npcscanner.npx
npx/npcscanoption.npx
npx/npcslm20.npx
npx/npcstt.npx
npx/npcsttmsgbox.npx
npx/npcstttray.npx
npx/npcsvc.npx
npx/npcurlmon.npx
npx/npcvmchk.npx
npx/nplbsc.npx
npx/nplfsav.npx
npx/nplfw.npx
npx/nplnpn.npx
npx/nplnpnuamsgbox.npx
npx/nplnpnuseractor.npx
npx/nplrtd.npx
npx/nplscanner.npx
npx/nplstt.npx
npx/nplsttnmmsg.npx
npx/nplsvc.npx
npx/npsmsgbox.npx
npx/npsnpninca.npx
npx/npsscanner.npx
npx/npsstt.npx
.ps1
npx/npssttmsgbox.npx
ns/icon_logo.npi
.png
ns/icon_warn.npi
.png
ns/nphapsie_eng.nph
ns/nphapsie_kor.nph
ns/npicommon.npi
.png
ns/npimain_conf.npi
.png
ns/npimsg1.npi
.png
ns/npimsg2.npi
.png
ns/npimsg3.npi
.png
ns/npimsg5.npi
.png
ns/npimsg6.npi
.png
ns/npimsg7.npi
.png
ns/npinpnmini.npi
.png
sqlite3.dll
.dll windows:4 windows x86 arch:x86

4c5c5909408c445f31195d829f40233a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:44:8b:91:94:25:0f:9b:1b:a8:2c:cc:f4:8e:87:65
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

04/10/2022, 00:00

Not After

03/10/2023, 23:59

Subject

CN=INCA Internet Co.\,Ltd.,O=INCA Internet Co.\,Ltd.,L=Gangseo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

88:2e:26:91:6b:b3:43:e1:81:08:43:99:06:58:a1:a1:a2:16:1e:ab:ca:ae:90:ef:ea:e9:74:21:b3:b7:8e:fc
Signer

Actual PE Digest

88:2e:26:91:6b:b3:43:e1:81:08:43:99:06:58:a1:a1:a2:16:1e:ab:ca:ae:90:ef:ea:e9:74:21:b3:b7:8e:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\001_work\nprotectz\product\npn60\npsqlite3\build\bin\release\sqlite3.pdb

Imports

kernel32

SystemTimeToFileTime
GetStdHandle
GetCurrentProcess
FindFirstFileW
GetProcAddress
CloseHandle
CreateFileW
GetCurrentProcessId
LoadLibraryW
GetEnvironmentVariableA
FindClose
GetSystemTime
FreeLibrary
FlushViewOfFile
FlushFileBuffers
Sleep
SetFilePointer
LockFile
GetTempPathW
DeleteFileW
TryEnterCriticalSection
GetSystemInfo
WaitForSingleObjectEx
MapViewOfFile
FormatMessageW
OutputDebugStringW
GetTempPathA
UnmapViewOfFile
GetVersionExW
GetLastError
LocalFree
GetTickCount
HeapDestroy
UnlockFileEx
AreFileApisANSI
LeaveCriticalSection
SetEndOfFile
GetProcessHeap
DeleteFileA
GetFullPathNameW
GetFileAttributesA
HeapSize
GetSystemTimeAsFileTime
HeapCreate
GetFullPathNameA
FormatMessageA
HeapAlloc
WriteFile
HeapValidate
LockFileEx
EnterCriticalSection
GetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceW
DeleteCriticalSection
HeapReAlloc
InitializeCriticalSection
CreateFileA
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryA
OutputDebugStringA
HeapFree
ReadFile
GetFileSize
CreateFileMappingA
CreateFileMappingW
CreateMutexW
WaitForSingleObject
WideCharToMultiByte
GetVersionExA
HeapCompact
InterlockedCompareExchange
MultiByteToWideChar
UnlockFile
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetFileType
GetModuleHandleA
ExitProcess
GetDriveTypeA
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
VirtualFree
VirtualAlloc
SetHandleCount
GetStartupInfoA
SetStdHandle
GetModuleFileNameA
RtlUnwind
GetCurrentDirectoryA
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 824KB - Virtual size: 823KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f23f452093b5c1ff091a2f9fb4fa3e9

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98Certificate

Extended Key Usages

Key Usages

b1:23:68:43:c9:c3:ea:7b:6b:45:58:fb:d6:a9:dc:2e:ac:ce:ff:e2:56:e3:0c:f2:07:6a:90:83:58:cb:5a:07Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 152KB

.rsrc Size: 25KB - Virtual size: 25KB

05195c4c68546332284aba78a64bfe4c

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:6a:ca:0f:0a:72:79:b6:f0:e0:8c:5c:ff:e7:2f:d3Certificate

Extended Key Usages

Key Usages

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1fSigner

Headers

File Characteristics

PDB Paths

Imports

winhttp

crypt32

rpcrt4

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 148KB - Virtual size: 145KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

03a1fe3fde0b98269544b8bec2d124a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0e:8c:7b:5f:c6:3f:50:b0:ba:7c:a2:3c:96:cd:57:98
Certificate

b1:23:68:43:c9:c3:ea:7b:6b:45:58:fb:d6:a9:dc:2e:ac:ce:ff:e2:56:e3:0c:f2:07:6a:90:83:58:cb:5a:07
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 152KB

.rsrc
Size: 25KB - Virtual size: 25KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:6a:ca:0f:0a:72:79:b6:f0:e0:8c:5c:ff:e7:2f:d3
Certificate

c5:a8:fd:2c:ba:41:9e:30:e8:db:31:bc:b3:57:3e:f7:a8:10:e2:55:5a:33:98:06:8d:77:46:7e:72:ad:99:1f
Signer

.text
Size: 148KB - Virtual size: 145KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

18:16:f7:49:fe:49:78:25:8e:c7:13:46:10:0b:3d:d4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

65:72:84:61:40:00:8e:02:be:98:1e:e7:c6:ec:57:c7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

d8:66:9b:97:2c:7e:10:50:24:6d:04:21:98:6e:6c:d6:90:05:40:7f:75:64:9d:b3:91:dd:cb:cb:f0:a1:eb:c5
Signer

9d:ab:e0:dd:48:08:73:cb:b9:ba:56:e8:da:07:b7:bf:75:a7:fd:de
Signer

.text
Size: 176KB - Virtual size: 174KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

10:25:dc:ec:f9:63:80:cb:93:f6:da:22:e3:b6:e5:f9
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate