61954lingguang[.]10202F78DD1FD_7[.]0[.]0[.]0_x64__5b5h4n7n89bzm[.]zip

Resubmissions

26/03/2024, 06:02

240326-grkkxagc7y 3

23/03/2024, 07:13

240323-h154msee57 3

23/03/2024, 07:06

240323-hxfdtaee39 3

Sharing

Copy URL Twitter E-mail

General

Target

61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm.zip
Size

25.5MB
MD5

d5817cda3accb28d2ab5c6715fa99f29
SHA1

39f8fcb8d7b4f7ca6853efdb28c31f022b2c3250
SHA256

06264c12a7d531149cf74fe80234fbec4d5d87b0f978e316ad019ac5b42fc655
SHA512

b3a2d262384f9d612d2d0280771dd1e3603b73e4b5060c98658e04f9bdb50a3762df89f151f2fbc32c35d58d701c7e8e9b93956145ac3290d98b6c241006e692
SSDEEP

786432:FWFJNjDUiZ4j/F7qDu/1BSbWFC/Hr+w+89gD3:FmJNnUxF7Z0mAHyw/9gD3

Score

3^/10

Malware Config

Signatures

Unsigned PE 67 IoCs

Checks for missing Authenticode signature.

resource
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Graphics.Canvas.Interop.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.InteractiveExperiences.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Win32.Registry.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.WinUI.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppLifecycle.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppNotifications.Builder.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppNotifications.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.DynamicDependency.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.Resources.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.PushNotifications.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.SDK.NET.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.Security.AccessControl.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.System.Power.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.System.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.Widgets.Providers.Projection.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.WindowsAppRuntime.Bootstrap.Net.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.Concurrent.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.Immutable.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.NonGeneric.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.Primitives.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.TypeConverter.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.DiagnosticSource.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.Process.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.StackTrace.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Drawing.Primitives.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Drawing.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Formats.Asn1.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.Compression.ZipFile.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.Compression.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.FileSystem.Watcher.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.MemoryMappedFiles.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Linq.Expressions.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Linq.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Memory.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Http.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.NameResolution.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.NetworkInformation.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Primitives.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Quic.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Security.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Sockets.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Numerics.Vectors.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ObjectModel.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Private.CoreLib.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Private.Uri.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Reflection.Metadata.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.InteropServices.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.Numerics.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Claims.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Cryptography.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Principal.Windows.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Encoding.CodePages.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Encodings.Web.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Json.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.RegularExpressions.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Threading.Channels.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Threading.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.exe
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Win32APIs.dll
unpack001/61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/WinRT.Runtime.dll

Files

61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm.zip
.zip
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/AppxBlockMap.xml
.xml
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/AppxManifest.xml
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/AppxMetadata/CodeIntegrity.cat
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/AppxSignature.p7x
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/AceEditor.zip
.zip
AceEditor/LICENSE
AceEditor/editor.html
.html .js polyglot
AceEditor/src-noconflict/ace.js
.js
AceEditor/src-noconflict/beautify.js
.js
AceEditor/src-noconflict/ext-beautify.js
.js
AceEditor/src-noconflict/ext-elastic_tabstops_lite.js
.js
AceEditor/src-noconflict/ext-error_marker.js
.js
AceEditor/src-noconflict/ext-hardwrap.js
.js
AceEditor/src-noconflict/ext-keybinding_menu.js
.js
AceEditor/src-noconflict/ext-language_tools.js
.js
AceEditor/src-noconflict/ext-linking.js
.js
AceEditor/src-noconflict/ext-prompt.js
.js
AceEditor/src-noconflict/ext-rtl.js
.js
AceEditor/src-noconflict/ext-searchbox.js
.js
AceEditor/src-noconflict/ext-spellcheck.js
.js
AceEditor/src-noconflict/ext-split.js
.js
AceEditor/src-noconflict/ext-static_highlight.js
.js
AceEditor/src-noconflict/ext-textarea.js
.js
AceEditor/src-noconflict/ext-whitespace.js
.js
AceEditor/src-noconflict/mode-c_cpp.js
.js
AceEditor/src-noconflict/mode-csharp.js
.js
AceEditor/src-noconflict/mode-javascript.js
.js
AceEditor/src-noconflict/mode-json.js
.js
AceEditor/src-noconflict/mode-lua.js
.js
AceEditor/src-noconflict/mode-luapage.js
.js
AceEditor/src-noconflict/mode-text.js
.js
AceEditor/src-noconflict/mode-xml.js
.js
AceEditor/src-noconflict/snippets/c_cpp.js
.js
AceEditor/src-noconflict/snippets/csharp.js
.js
AceEditor/src-noconflict/snippets/javascript.js
.js
AceEditor/src-noconflict/snippets/json.js
.js
AceEditor/src-noconflict/theme-monokai.js
.js
AceEditor/src-noconflict/theme-solarized_dark.js
.js
AceEditor/src-noconflict/theme-solarized_light.js
.js
AceEditor/src-noconflict/theme-twilight.js
.js
AceEditor/src-noconflict/theme-xcode.js
.js
AceEditor/src-noconflict/worker-base.js
.js
AceEditor/src-noconflict/worker-javascript.js
.js
AceEditor/src-noconflict/worker-json.js
.js
AceEditor/src-noconflict/worker-lua.js
.js
AceEditor/src-noconflict/worker-xml.js
.js
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/C.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/CPP.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/INI.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/JS.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/S.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/TXT.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/h.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/hex.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/log.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/nc.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/tsv.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/ICON/y.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Images/1.jpg
.jpg
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Images/2.jpg
.jpg
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Images/3.jpg
.jpg
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/LargeTile.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/SmallTile.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/SplashScreen.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square150x150Logo.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.altform-lightunplated_targetsize-256.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.altform-lightunplated_targetsize-48.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.altform-unplated_targetsize-256.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.altform-unplated_targetsize-48.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.scale-400.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.targetsize-256.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Square44x44Logo.targetsize-48.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/StoreLogo.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/StoreLogo.scale-400.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/Wide310x150Logo.scale-200.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/hb.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/logo.ico
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Assets/logo.png
.png
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.DiaSymReader.Native.amd64.dll
.dll regsvr32 windows:6 windows x64 arch:x64

bffa8501aec5c29321d36de57d4de8be

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:82:3e:a0:58:c9:a3:5b:24:e4:72:aa:89:c8:28:d2:1c:a1:f9:c4:e6:dd:b0:2d:28:52:58:e2:d0:35:00:1d
Signer

Actual PE Digest

c8:82:3e:a0:58:c9:a3:5b:24:e4:72:aa:89:c8:28:d2:1c:a1:f9:c4:e6:dd:b0:2d:28:52:58:e2:d0:35:00:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\Microsoft.DiaSymReader.Native.amd64.pdb

Imports

kernel32

GetLastError
FreeLibrary
InitializeCriticalSectionEx
GetNativeSystemInfo
DisableThreadLibraryCalls
LocalAlloc
GetCurrentThreadId
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CompareStringW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadFile
ReadConsoleW
CreateFileW
CloseHandle
WriteConsoleW
LocalFree
FormatMessageW
GetEnvironmentVariableW
GetTickCount
GetSystemInfo
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
VirtualAlloc
VirtualFree
DeleteFileW
SetEndOfFile
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
ExpandEnvironmentStringsW
GetFullPathNameW
VirtualProtect
VirtualQuery
LoadLibraryExA
GetDriveTypeW
GetCurrentDirectoryW
TryEnterCriticalSection
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork

ole32

CoTaskMemAlloc
CoTaskMemFree

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

Exports

Exports

CreateNGenPdbWriter
CreateSymReader
CreateSymWriter
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectInternal
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Graphics.Canvas.Interop.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Graphics.Canvas.dll
.dll windows:6 windows x64 arch:x64

0a3448f174c1236d8b654cece5a664ef

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:eb:f5:4c:b3:42:96:d0:0c:89:00:fa:15:3b:06:ba:2e:b7:46:f6:38:3e:23:52:b1:5e:89:e7:8d:59:f4:e4
Signer

Actual PE Digest

f9:eb:f5:4c:b3:42:96:d0:0c:89:00:fa:15:3b:06:ba:2e:b7:46:f6:38:3e:23:52:b1:5e:89:e7:8d:59:f4:e4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\a\1\s\bin\uapx64\release\winrt.dll.uap\Microsoft.Graphics.Canvas.pdb

Imports

d2d1

ord13
ord5
ord1

d3d11

CreateDirect3D11DeviceFromDXGIDevice
D3D11CreateDevice
CreateDirect3D11SurfaceFromDXGISurface

dwrite

DWriteCreateFactory

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsPromoteStringBuffer
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsGetStringLen
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsDuplicateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

kernel32

InitializeCriticalSectionEx
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
DecodePointer
EncodePointer
InitOnceExecuteOnce
RaiseException
InitializeSRWLock
Sleep
CompareStringOrdinal
GlobalUnlock
GlobalLock
GlobalSize
MultiByteToWideChar
SetEvent
CloseHandle
GetLastError
CreateEventExW
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetNativeSystemInfo
WakeConditionVariable
InitializeConditionVariable
RtlPcToFileHeader
TryAcquireSRWLockExclusive
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeSListHead
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlUnwindEx

advapi32

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

ole32

CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
GetHGlobalFromStream
CoCreateInstance

api-ms-win-crt-math-l1-1-0

_fdclass
roundf
_fdsign
ceilf
cosf
floorf
fmodf
sinf
sqrtf

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
terminate
_errno
_invalid_parameter_noinfo
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncmp
_wcsicmp
strcpy_s

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh

Exports

Exports

CreateDirect3D11DeviceFromDXGIDevice
CreateDirect3D11SurfaceFromDXGISurface
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetBoundsForICanvasImageInterop
GetInvalidRectanglesForICanvasImageInterop
GetRequiredSourceRectanglesForICanvasImageInterop
InvalidateSourceRectangleForICanvasImageInterop

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.InteractiveExperiences.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Win32.Registry.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.WinUI.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppLifecycle.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.AppLifecycle.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.AppLifecycle.Projection.pdb

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppNotifications.Builder.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.AppNotifications.Builder.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.AppNotifications.Builder.Projection.pdb

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.AppNotifications.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.AppNotifications.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.AppNotifications.Projection.pdb

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.DynamicDependency.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.ApplicationModel.DynamicDependency.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.ApplicationModel.DynamicDependency.Projection.pdb

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.Resources.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\x86\Microsoft.Windows.ApplicationModel.Resources.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.ApplicationModel.Resources.Projection.pdb

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.ApplicationModel.WindowsAppRuntime.Projection.pdb

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.PushNotifications.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.PushNotifications.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.PushNotifications.Projection.pdb

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.SDK.NET.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.Security.AccessControl.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.Security.AccessControl.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.Security.AccessControl.Projection.pdb

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.System.Power.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.System.Power.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.System.Power.Projection.pdb

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.System.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\arm64\Microsoft.Windows.System.Projection\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.System.Projection.pdb

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.Windows.Widgets.Providers.Projection.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\src\sdk\Microsoft.Windows.Widgets.Providers.Projection\obj\Release\net6.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Windows.Widgets.Providers.Projection.pdb

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.WindowsAppRuntime.Bootstrap.Net.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\obj\Release\AnyCPU\Microsoft.WindowsAppRuntime.Bootstrap.Net\net6.0-windows10.0.19041.0\Microsoft.WindowsAppRuntime.Bootstrap.Net.pdb

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 431B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Microsoft.WindowsAppRuntime.Bootstrap.dll
.dll windows:6 windows x64 arch:x64

83d74eff3e077b1dc6ec6f9caac0e2e6

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:d3:bb:3b:33:9f:ca:eb:2b:34:cb:aa:a9:0c:e7:0b:51:55:ce:05:e1:11:13:11:32:f1:34:80:ec:0a:dc:37
Signer

Actual PE Digest

b1:d3:bb:3b:33:9f:ca:eb:2b:34:cb:aa:a9:0c:e7:0b:51:55:ce:05:e1:11:13:11:32:f1:34:80:ec:0a:dc:37

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.WindowsAppRuntime.Bootstrap.pdb

Imports

advapi32

EventWriteTransfer
EventUnregister
EventActivityIdControl
DeregisterEventSource
EventSetInformation
EventRegister
ReportEventW
RegisterEventSourceW
GetSidSubAuthority
GetTokenInformation
GetSidSubAuthorityCount

kernel32

GetProcAddress
SetLastError
GetLastError
GetModuleHandleW
HeapAlloc
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
AcquireSRWLockExclusive
TlsFree
RtlLookupFunctionEntry
FreeLibrary
GetModuleHandleExW
TlsSetValue
TlsGetValue
DisableThreadLibraryCalls
CloseHandle
GetCurrentPackageFullName
DebugBreak
RtlCaptureContext
LoadLibraryW
CompareStringOrdinal
ReleaseSRWLockExclusive
OpenPackageInfoByFullName
GetPackageInfo
AddDllDirectory
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateEventW
GetCurrentProcessId
FormatApplicationUserModelId
GetPackagePathByFullName
FindFirstFileW
HeapFree
GetProcessHeap
InitOnceComplete
GetModuleFileNameW
K32GetModuleFileNameExW
SetEvent
FindClose
ClosePackageInfo
RemoveDllDirectory
CreateEventExW
InitOnceBeginInitialize
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
LoadLibraryExW
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemTimeAsFileTime
EncodePointer
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
QueryPerformanceCounter
RtlVirtualUnwind

ole32

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo
RoFailFastWithErrorContext

oleaut32

SysAllocString
SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo

user32

MessageBoxW
LoadStringA
wsprintfW

rpcrt4

UuidFromStringW

shell32

ShellExecuteExW

api-ms-win-core-errorhandling-l1-1-0

RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA

api-ms-win-crt-runtime-l1-1-0

_initterm
abort
terminate
_errno
_cexit
_crt_atexit
_invalid_parameter_noinfo
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncmp
iswspace
strcpy_s

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
free

Exports

Exports

MddBootstrapInitialize
MddBootstrapInitialize2
MddBootstrapShutdown
MddBootstrapTestInitialize

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\UWP\TextView\7.0\TextView\obj\x64\Release\net8.0-windows10.0.22621.0\win-x64\linked\Share.pdb

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share.pri
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share.xml
.xml
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share/Assets/AceEditor.zip
.zip
AceEditor/LICENSE
AceEditor/editor.html
.html .js polyglot
AceEditor/src-noconflict/ace.js
.js
AceEditor/src-noconflict/beautify.js
.js
AceEditor/src-noconflict/ext-beautify.js
.js
AceEditor/src-noconflict/ext-elastic_tabstops_lite.js
.js
AceEditor/src-noconflict/ext-error_marker.js
.js
AceEditor/src-noconflict/ext-hardwrap.js
.js
AceEditor/src-noconflict/ext-keybinding_menu.js
.js
AceEditor/src-noconflict/ext-language_tools.js
.js
AceEditor/src-noconflict/ext-linking.js
.js
AceEditor/src-noconflict/ext-prompt.js
.js
AceEditor/src-noconflict/ext-rtl.js
.js
AceEditor/src-noconflict/ext-searchbox.js
.js
AceEditor/src-noconflict/ext-spellcheck.js
.js
AceEditor/src-noconflict/ext-split.js
.js
AceEditor/src-noconflict/ext-static_highlight.js
.js
AceEditor/src-noconflict/ext-textarea.js
.js
AceEditor/src-noconflict/ext-whitespace.js
.js
AceEditor/src-noconflict/mode-c_cpp.js
.js
AceEditor/src-noconflict/mode-csharp.js
.js
AceEditor/src-noconflict/mode-javascript.js
.js
AceEditor/src-noconflict/mode-json.js
.js
AceEditor/src-noconflict/mode-lua.js
.js
AceEditor/src-noconflict/mode-luapage.js
.js
AceEditor/src-noconflict/mode-text.js
.js
AceEditor/src-noconflict/mode-xml.js
.js
AceEditor/src-noconflict/snippets/c_cpp.js
.js
AceEditor/src-noconflict/snippets/csharp.js
.js
AceEditor/src-noconflict/snippets/javascript.js
.js
AceEditor/src-noconflict/snippets/json.js
.js
AceEditor/src-noconflict/theme-monokai.js
.js
AceEditor/src-noconflict/theme-solarized_dark.js
.js
AceEditor/src-noconflict/theme-solarized_light.js
.js
AceEditor/src-noconflict/theme-twilight.js
.js
AceEditor/src-noconflict/theme-xcode.js
.js
AceEditor/src-noconflict/worker-base.js
.js
AceEditor/src-noconflict/worker-javascript.js
.js
AceEditor/src-noconflict/worker-json.js
.js
AceEditor/src-noconflict/worker-lua.js
.js
AceEditor/src-noconflict/worker-xml.js
.js
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Share/Themes/Generic.xbf
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.Concurrent.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.Immutable.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.NonGeneric.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Collections.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.Primitives.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.TypeConverter.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 487B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ComponentModel.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.DiagnosticSource.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.Process.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Diagnostics.StackTrace.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 403B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Drawing.Primitives.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Drawing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Formats.Asn1.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.Compression.Native.dll
.dll windows:6 windows x64 arch:x64

d985b2ab046cf5c89d2c6cf278c35fc1

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:19:0a:18:ff:09:54:a7:ba:4f:e1:6f:47:f2:a3:f7:95:7d:94:73:44:1f:45:5f:ad:8d:82:24:e8:e5:97:c7
Signer

Actual PE Digest

90:19:0a:18:ff:09:54:a7:ba:4f:e1:6f:47:f2:a3:f7:95:7d:94:73:44:1f:45:5f:ad:8d:82:24:e8:e5:97:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\native\net8.0-windows-Release-x64\System.IO.Compression.Native\System.IO.Compression.Native.pdb

Imports

kernel32

HeapCreate
HeapFree
EncodePointer
HeapAlloc
DecodePointer
HeapDestroy
GetProcessHeap
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
_initterm
abort
exit
_initialize_narrow_environment

api-ms-win-crt-string-l1-1-0

wcsncmp

api-ms-win-crt-math-l1-1-0

log2

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderIsFinished
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderSetParameter
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.Compression.ZipFile.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.Compression.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.FileSystem.Watcher.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 989B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.IO.MemoryMappedFiles.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Linq.Expressions.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Linq.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Memory.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Http.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.NameResolution.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.NetworkInformation.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Primitives.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Quic.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Security.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 416KB - Virtual size: 412KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Net.Sockets.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Numerics.Vectors.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.ObjectModel.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Private.CoreLib.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 276KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Private.Uri.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Reflection.Metadata.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 192KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.InteropServices.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.Numerics.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Runtime.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Claims.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Cryptography.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 564KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Security.Principal.Windows.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Encoding.CodePages.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 800KB - Virtual size: 798KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Encodings.Web.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.Json.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 816KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Text.RegularExpressions.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 284KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Threading.Channels.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.Threading.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/System.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.deps.json
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\UWP\TextView\7.0\TextView\obj\x64\Release\net8.0-windows10.0.22621.0\win-x64\TextView.pdb

Sections

.text
Size: 812KB - Virtual size: 809KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.exe
.exe windows:6 windows x64 arch:x64

6a91eb82bfd19d2706c7d43c46f7064e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

Imports

kernel32

FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
wcsftime

api-ms-win-crt-locale-l1-1-0

setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/TextView.runtimeconfig.json
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/Win32APIs.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\UWP\TextView\7.0\TextView\obj\x64\Release\net8.0-windows10.0.22621.0\win-x64\linked\Win32APIs.pdb

Sections

.text
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/WinRT.Runtime.dll
.dll windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 188KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/clretwrc.dll
.dll windows:6 windows x64 arch:x64

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:69:30:06:5a:51:2f:c4:df:2b:1d:d6:16:4c:e8:59:0c:97:b1:72:03:67:d7:03:51:4f:27:5d:ad:e5:61:34
Signer

Actual PE Digest

1d:69:30:06:5a:51:2f:c4:df:2b:1d:d6:16:4c:e8:59:0c:97:b1:72:03:67:d7:03:51:4f:27:5d:ad:e5:61:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\clretwrc\clretwrc.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/clrgc.dll
.dll windows:6 windows x64 arch:x64

1b58a12b22481a73b70459ac1dd7c5be

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:70:1a:1d:8a:51:0a:07:ab:a8:b8:c4:12:4e:90:e9:8d:c9:a3:1b:15:ed:c7:95:d7:a2:64:b0:60:11:0a:47
Signer

Actual PE Digest

82:70:1a:1d:8a:51:0a:07:ab:a8:b8:c4:12:4e:90:e9:8d:c9:a3:1b:15:ed:c7:95:d7:a2:64:b0:60:11:0a:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\gc\clrgc.pdb

Imports

kernel32

RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlCaptureContext
GetEnabledXStateFeatures
InterlockedFlushSList
GetProcessGroupAffinity
DebugBreak
SleepEx
GlobalMemoryStatusEx
SetThreadGroupAffinity
SwitchToThread
ResetEvent
GetSystemInfo
CloseHandle
QueryPerformanceFrequency
GetCurrentThread
GetLogicalProcessorInformation
SetEvent
K32GetProcessMemoryInfo
GetCurrentThreadId
GetLogicalProcessorInformationEx
GetTickCount64
CreateEventW
IsProcessInJob
WaitForSingleObject
GetLargePageMinimum
FlushProcessWriteBuffers
InitializeCriticalSection
SetThreadPriority
GetNumaHighestNodeNumber
SetThreadAffinityMask
SetThreadIdealProcessorEx
QueryInformationJobObject
GetCurrentProcessorNumberEx
VirtualFree
GetThreadIdealProcessorEx
VirtualAlloc
GetProcessAffinityMask
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-runtime-l1-1-0

_initterm
abort
terminate
_cexit
_seh_filter_dll
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

Exports

Exports

GC_Initialize
GC_VersionInfo

Sections

.text
Size: 570KB - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/clrjit.dll
.dll windows:6 windows x64 arch:x64

3f9720bbb0670cc703d4d9b5a9d80407

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:42:6a:87:79:8a:e8:8b:33:96:5b:1a:96:37:37:1a:aa:1a:b9:66:68:33:20:65:3d:5e:d4:c4:85:a5:c6:c3
Signer

Actual PE Digest

ad:42:6a:87:79:8a:e8:8b:33:96:5b:1a:96:37:37:1a:aa:1a:b9:66:68:33:20:65:3d:5e:d4:c4:85:a5:c6:c3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\jit\clrjit.pdb

Imports

kernel32

RaiseException
DebugBreak
OutputDebugStringA
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
QueryThreadCycleTime
GetCurrentThread
GetLastError
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
SetLastError
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
RtlPcToFileHeader

api-ms-win-crt-math-l1-1-0

powf
pow
logf
log2f
_fdopen
log2
log10f
log10
tanhf
log
fmodf
fmod
floorf
_copysign
_copysignf
_isnanf
acosh
asinh
atanh
cbrt
sqrtf
acoshf
asinhf
sinf
cbrtf
truncf
ilogb
ilogbf
_finite
floor
sinh
sinhf
expf
exp
coshf
cosh
cosf
tan
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
acos
sin
atanhf
tanf
tanh
_isnan
sqrt
trunc

api-ms-win-crt-stdio-l1-1-0

fclose
__stdio_common_vsprintf_s
fseek
ftell
fflush
__stdio_common_vfprintf
_fileno
__acrt_iob_func
_wfopen
_dup
_setmode
setvbuf

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-runtime-l1-1-0

abort
terminate
_cexit
_errno
_seh_filter_dll
_initterm
_initterm_e
_invalid_parameter_noinfo
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

strnlen
strncmp
strcmp
wcsncmp
strcpy_s
_stricmp

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

Exports

Exports

getJit
getLikelyClasses
getLikelyMethods
jitBuildString
jitStartup

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/coreclr.dll
.dll windows:6 windows x64 arch:x64

2737d9922001d87d319ab7906903520e

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:c3:29:6b:41:a9:81:60:4b:49:35:0b:8d:7f:f3:c4:0b:94:fd:11:a3:f5:6a:78:7d:60:f3:fa:12:f5:3d:1a
Signer

Actual PE Digest

b9:c3:29:6b:41:a9:81:60:4b:49:35:0b:8d:7f:f3:c4:0b:94:fd:11:a3:f5:6a:78:7d:60:f3:fa:12:f5:3d:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscoree\coreclr\coreclr.pdb

Imports

kernel32

WaitForSingleObject
RaiseException
FreeLibrary
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
MultiByteToWideChar
GetTickCount
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
RtlLookupFunctionEntry
LocateXStateFeature
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
GetTickCount64
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
GetCurrentThreadId
TlsAlloc
GetCurrentThread
GetCurrentProcessId
CreateThread
GetModuleHandleW
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
WriteFile
GetStdHandle
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
InterlockedPopEntrySList
ExitProcess
Sleep
CreateMemoryResourceNotification
VirtualAlloc
VirtualFree
VirtualProtect
SleepEx
SwitchToThread
SuspendThread
ResumeThread
InitializeContext
SetXStateFeaturesMask
RtlRestoreContext
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ReadFile
GetFileSize
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
SetEvent
ResetEvent
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
CopyContext
WerRegisterRuntimeExceptionModule
RtlInstallFunctionTableCallback
GetSystemDefaultLCID
GetUserDefaultLCID
RtlUnwind
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsSetValue
CreateSemaphoreExW
ReleaseSemaphore
GetACP
LCMapStringEx
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentProcessorNumberEx
GetProcessAffinityMask
QueryInformationJobObject
CreateFileMappingW
GetSystemTimeAsFileTime
GetModuleFileNameW
CreateProcessW
GetCPInfo
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetFullPathNameW
LoadLibraryExA
OpenEventW
ReleaseMutex
ExitThread
CreateMutexW
HeapReAlloc
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
SetFilePointer
MapViewOfFile
GetActiveProcessorGroupCount
GetSystemTime
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
RtlAddFunctionTable
LoadLibraryW
CreateFileMappingA
GetNumaHighestNodeNumber
SetThreadAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlVirtualUnwind
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
CloseHandle
TlsGetValue
GetSystemInfo
GetCurrentProcess
OutputDebugStringW
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
GetCommandLineW
GetProcAddress
GetModuleHandleExW
SetThreadErrorMode
FlushProcessWriteBuffers
SetLastError
DebugBreak
GetLastError
FormatMessageW

advapi32

RegisterEventSourceW
AdjustTokenPrivileges
SetKernelObjectSecurity
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
DeregisterEventSource
ReportEventW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler
CoRevokeInitializeSpy
CoGetContextToken
CoGetObjectContext
CoUnmarshalInterface
CoGetClassObject
CreateStreamOnHGlobal
CoGetMarshalSizeMax
CLSIDFromProgID
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoMarshalInterface

oleaut32

SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
VariantInit
VariantClear
VariantChangeTypeEx
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
QueryPathOfRegTypeLi
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
SetErrorInfo
SysStringLen
SysAllocString
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayGetElemsize

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

_strnicmp
strtok_s
isspace
strncpy
_strdup
iswupper
towlower
isalpha
isdigit
wcstok_s
strnlen
wcsncmp
iswascii
towupper
strncpy_s
strcat_s
strcpy_s
_wcsicmp
wcsncpy_s
wcsnlen
wcscpy_s
strlen
_wcsnicmp
strcmp
_stricmp
wcscat_s
strncat_s
wcsncat_s
strncmp
iswspace
wcscmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
fgets
fputs
_wfopen
fclose
_flushall
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
__stdio_common_vsscanf
fopen
fwrite

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_initialize_narrow_environment
_errno
abort
_controlfp_s
terminate
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-convert-l1-1-0

_ltow_s
_wtoi
atol
_atoi64
_itow_s
strtoull
wcstoul
_wcstoui64
strtoul

api-ms-win-crt-heap-l1-1-0

malloc
realloc
free
calloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

pow
cosh
cosf
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
acos
powf
logf
exp
sin
expf
log2f
log2
floor
tanhf
log10f
tanh
tanf
log10
fmaf
log
tan
fmodf
sinf
acoshf
cbrtf
sinh
modff
modf
_finite
_isnan
_copysign
atanhf
asinhf
asinh
cbrt
acosh
atanh
fmod
sqrt
coshf
sinhf
fma

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

CLRJitAttachState
GetCLRRuntimeHost
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_set_error_writer
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics
g_dacTable

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CLR_UEF
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Section
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/createdump.exe
.exe windows:6 windows x64 arch:x64

7c21ee9d89b5f22d2f7582448b21a30f

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:25:9e:5f:ff:c8:2b:e7:7a:98:d0:bc:53:1f:53:b9:3f:a5:ce:dc:54:c3:aa:5a:6f:fc:3e:e9:9a:ac:da:94
Signer

Actual PE Digest

71:25:9e:5f:ff:c8:2b:e7:7a:98:d0:bc:53:1f:53:b9:3f:a5:ce:dc:54:c3:aa:5a:6f:fc:3e:e9:9a:ac:da:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb

Imports

kernel32

GetTempPathA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
OpenProcess
GetLastError
CreateFileA
CloseHandle
K32GetModuleBaseNameA
LocalFree
FormatMessageA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetProcAddress
GetCurrentProcessId
FreeLibrary
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc

dbghelp

MiniDumpWriteDump

ws2_32

gethostname
WSAGetLastError
WSAStartup

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationProcess
RtlCaptureContext

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fflush
fclose
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
fopen
__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
__p___argv
_c_exit
terminate
_initialize_onexit_table
__p___argc
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_cexit
_configure_narrow_argv
_exit
exit
_invalid_parameter_noinfo_noreturn
strerror
_errno
_initterm_e
_initterm
_get_initial_narrow_environment
_crt_atexit
_initialize_narrow_environment
abort

api-ms-win-crt-string-l1-1-0

strcpy_s
strcat_s
wcsncmp
strcmp

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

calloc
free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/hostfxr.dll
.dll windows:6 windows x64 arch:x64

7534859af8c7bfef2598e27433761580

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:7e:bd:df:10:64:1d:2f:52:fe:bf:98:9c:ce:22:1b:af:4c:ba:86:85:c8:7e:0c:7d:1b:c3:2b:70:8f:ce:4d
Signer

Actual PE Digest

da:7e:bd:df:10:64:1d:2f:52:fe:bf:98:9c:ce:22:1b:af:4c:ba:86:85:c8:7e:0c:7d:1b:c3:2b:70:8f:ce:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb

Imports

kernel32

EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
FindFirstFileExW
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
GetFileSizeEx
GetLastError
OutputDebugStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
WakeAllConditionVariable
SleepConditionVariableSRW
SwitchToThread
QueryPerformanceCounter
InitializeCriticalSectionEx
EncodePointer
DecodePointer

advapi32

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
malloc
realloc
free

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_errno
_configure_narrow_argv
_register_onexit_function
_initterm
_initterm_e
_execute_onexit_table
_crt_atexit
terminate
_invalid_parameter_noinfo_noreturn
_wcserror_s
_cexit
abort
_seh_filter_dll

api-ms-win-crt-string-l1-1-0

wcsncmp
strcpy_s
tolower
toupper
islower
_wcsicmp
isupper
_wcsdup
__strncnt
_wcsnicmp

api-ms-win-crt-stdio-l1-1-0

fclose
fgetc
fwrite
fseek
fgetpos
_wfsopen
ungetc
fsetpos
fflush
fputwc
fread
_fseeki64
fputws
_get_stream_buffer_pointers
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__acrt_iob_func
setvbuf
fputc

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_time64
wcsftime
_gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-locale-l1-1-0

_unlock_locales
__pctype_func
_lock_locales
___lc_codepage_func
setlocale
___lc_locale_name_func

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_dotnet_environment_info
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_bundle_startupinfo
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/hostpolicy.dll
.dll windows:6 windows x64 arch:x64

f26ecd6c7a79e6e9489a3dc9b0514a54

Code Sign

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:89:ed:7b:66:36:be:b9:31:30:c0:5c:64:67:28:89:93:1b:b6:87:0e:94:33:56:0f:67:93:fd:34:ed:b7:db
Signer

Actual PE Digest

46:89:ed:7b:66:36:be:b9:31:30:c0:5c:64:67:28:89:93:1b:b6:87:0e:94:33:56:0f:67:93:fd:34:ed:b7:db

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\hostpolicy\standalone\hostpolicy.pdb

Imports

kernel32

OutputDebugStringW
GetFileSizeEx
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetTempPathW
FindClose
CreateFileW
GetCurrentProcessId
GetLastError
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
Sleep
RemoveDirectoryW
MultiByteToWideChar
CreateDirectoryW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
GetStringTypeW
TryAcquireSRWLockExclusive
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

advapi32

RegOpenKeyExW
RegGetValueW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_initterm
_cexit
_register_onexit_function
abort
_initialize_narrow_environment
_seh_filter_dll
_errno
_wcserror_s
_configure_narrow_argv
_execute_onexit_table
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initterm_e
terminate

api-ms-win-crt-string-l1-1-0

strcpy_s
__strncnt
wcsnlen
wcsncmp
_wcsnicmp
tolower
islower
_wcsdup
isupper
strcspn
strcmp
_wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc
realloc
calloc
free
_callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
_wfsopen
fclose
fwrite
__acrt_iob_func
fflush
fputwc
fputws
_fseeki64
__stdio_common_vfwprintf
__stdio_common_vswprintf
fread
setvbuf
fseek
fsetpos
fputc
ungetc
fgetpos
fgetc

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales
setlocale
__pctype_func
___lc_codepage_func
___mb_cur_max_func
___lc_locale_name_func
localeconv

api-ms-win-crt-math-l1-1-0

ceilf
frexp

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wremove
_wrename

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_gmtime64_s
wcsftime
_time64

Exports

Exports

corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload

Sections

.text
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/mscordaccore.dll
.dll windows:6 windows x64 arch:x64

e9ad42acf7f24caf6b1dc6bdbd5dff55

Code Sign

33:00:00:05:15:b0:ef:41:0f:a4:18:8f:b1:00:00:00:00:05:15
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 18:27

Not After

03/04/2024, 18:27

Subject

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:0d:49:27:df:b1:77:95:6c:b3:dc:71:bc:29:66:0c:a6:4c:a1:9d:a1:33:bd:3b:54:27:c9:f0:ca:dc:16:87
Signer

Actual PE Digest

58:0d:49:27:df:b1:77:95:6c:b3:dc:71:bc:29:66:0c:a6:4c:a1:9d:a1:33:bd:3b:54:27:c9:f0:ca:dc:16:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
ReadProcessMemory
CloseHandle
DebugBreak
GetCurrentProcess
FlushInstructionCache
SetFilePointer
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetACP
LCMapStringEx
FormatMessageW
LocalFree
HeapDestroy
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetProcAddress
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentThread
SwitchToThread
GetProcessAffinityMask
QueryInformationJobObject
SetLastError
TerminateProcess
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
GetEnvironmentVariableW
LoadLibraryExW
CreateFileW
GetFullPathNameW
WakeAllConditionVariable
GetThreadId
GetProcessIdOfThread
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW

ole32

CoCreateGuid
CoTaskMemFree

oleaut32

SetErrorInfo
CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s
wcsncpy_s
strnlen
strncat_s
strncpy_s
strcmp
strcpy_s
strlen
wcsncmp
wcsncat_s
strncmp

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
abort
_initialize_onexit_table
_errno
_initterm_e
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_initterm
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/mscordaccore_amd64_amd64_8.0.324.11423.dll
.dll windows:6 windows x64 arch:x64

e9ad42acf7f24caf6b1dc6bdbd5dff55

Code Sign

33:00:00:05:15:b0:ef:41:0f:a4:18:8f:b1:00:00:00:00:05:15
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 18:27

Not After

03/04/2024, 18:27

Subject

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:0d:49:27:df:b1:77:95:6c:b3:dc:71:bc:29:66:0c:a6:4c:a1:9d:a1:33:bd:3b:54:27:c9:f0:ca:dc:16:87
Signer

Actual PE Digest

58:0d:49:27:df:b1:77:95:6c:b3:dc:71:bc:29:66:0c:a6:4c:a1:9d:a1:33:bd:3b:54:27:c9:f0:ca:dc:16:87

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
ReadProcessMemory
CloseHandle
DebugBreak
GetCurrentProcess
FlushInstructionCache
SetFilePointer
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetACP
LCMapStringEx
FormatMessageW
LocalFree
HeapDestroy
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemInfo
GetSystemTimeAsFileTime
GetProcAddress
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetProcessGroupAffinity
GetCurrentThread
SwitchToThread
GetProcessAffinityMask
QueryInformationJobObject
SetLastError
TerminateProcess
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
GetEnvironmentVariableW
LoadLibraryExW
CreateFileW
GetFullPathNameW
WakeAllConditionVariable
GetThreadId
GetProcessIdOfThread
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW

ole32

CoCreateGuid
CoTaskMemFree

oleaut32

SetErrorInfo
CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s
wcsncpy_s
strnlen
strncat_s
strncpy_s
strcmp
strcpy_s
strlen
wcsncmp
wcsncat_s
strncmp

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
abort
_initialize_onexit_table
_errno
_initterm_e
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_initterm
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/mscordbi.dll
.dll windows:6 windows x64 arch:x64

bca145fa0b13e1a6b3a46239f2fffc6f

Code Sign

33:00:00:05:14:f0:08:1e:e4:8b:db:75:a1:00:00:00:00:05:14
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 18:27

Not After

03/04/2024, 18:27

Subject

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:4e:77:85:c8:03:6a:92:19:e4:be:f5:eb:a9:4b:98:69:91:6b:0a:e1:11:cc:68:30:57:67:1a:c5:92:8c:cd
Signer

Actual PE Digest

31:4e:77:85:c8:03:6a:92:19:e4:be:f5:eb:a9:4b:98:69:91:6b:0a:e1:11:cc:68:30:57:67:1a:c5:92:8c:cd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordbi\mscordbi.pdb

Imports

kernel32

GetCurrentProcessId
FlushFileBuffers
CreateFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryExW
GetProcAddress
WaitForMultipleObjectsEx
SetEvent
ResetEvent
GetCurrentThreadId
FlushInstructionCache
OpenThread
SuspendThread
ResumeThread
CreateThread
InitializeContext
CopyContext
SetThreadContext
TerminateProcess
GetThreadContext
ContinueDebugEvent
FreeLibrary
VirtualQueryEx
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
OpenProcess
IsWow64Process
ReadProcessMemory
WriteProcessMemory
HeapAlloc
HeapFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
HeapCreate
GetProcessHeap
DebugBreak
VirtualQuery
RaiseException
SetLastError
GetACP
LCMapStringEx
MultiByteToWideChar
FormatMessageW
LocalFree
GetSystemInfo
GetModuleFileNameW
GetEnvironmentVariableW
GetFileAttributesExW
GetFullPathNameW
GetCurrentThread
SwitchToThread
CreateProcessW
SleepEx
VirtualAlloc
VirtualFree
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore
SetFilePointer
RtlPcToFileHeader
CloseHandle
GetLastError
CreateEventW
DuplicateHandle
WaitForSingleObject
WriteFile
GetCurrentProcess
ReadFile
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid

oleaut32

CreateErrorInfo
SetErrorInfo
VariantInit

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

api-ms-win-crt-string-l1-1-0

wcscat_s
wcscpy_s
_wcsicmp
wcsnlen
wcsncmp
wcsncat_s
wcsncpy_s
strncmp
strncpy_s
strcpy_s
strcmp

api-ms-win-crt-runtime-l1-1-0

terminate
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_invalid_parameter_noinfo
_initialize_onexit_table
_execute_onexit_table
_cexit
abort
_initialize_narrow_environment
_errno
_initterm

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CoreCLRCreateCordbObject
CoreCLRCreateCordbObject3
CoreCLRCreateCordbObjectEx
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
OpenVirtualProcessImpl2

Sections

.text
Size: 960KB - Virtual size: 960KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/mscorrc.dll
.dll windows:6 windows x64 arch:x64

Code Sign

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/05/2023, 19:03

Not After

08/05/2024, 19:03

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

96:1b:a2:e4:1e:f1:43:8d:71:d1:7a:f2:48:4f:f8:8d:81:18:96:fb:59:21:46:b7:77:5f:13:bf:08:8d:d9:53
Signer

Actual PE Digest

96:1b:a2:e4:1e:f1:43:8d:71:d1:7a:f2:48:4f:f8:8d:81:18:96:fb:59:21:46:b7:77:5f:13:bf:08:8d:d9:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb

Sections

.rdata
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/msquic.dll
.dll windows:6 windows x64 arch:x64

635f2d7a258f33ccdd9ff608508ac52e

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:eb:72:70:ad:bc:c8:33:cf:e0:77:b9:24:3b:fa:51:b3:93:e7:d2:dd:5c:25:fc:ac:82:ae:03:0c:b5:36:41
Signer

Actual PE Digest

c2:eb:72:70:ad:bc:c8:33:cf:e0:77:b9:24:3b:fa:51:b3:93:e7:d2:dd:5c:25:fc:ac:82:ae:03:0c:b5:36:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\__w\1\s\artifacts\bin\windows\x64_Release_schannel\msquic.pdb

Imports

winmm

timeGetDevCaps

secur32

SetCredentialsAttributesW
FreeContextBuffer
QuerySecurityContextToken
AcceptSecurityContext
DeleteSecurityContext
FreeCredentialsHandle
QueryContextAttributesW
AcquireCredentialsHandleW
InitializeSecurityContextW

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InterlockedPushEntrySList
ReleaseSRWLockExclusive
QueryDepthSList
WaitForSingleObject
CloseHandle
CreateEventA
GetCurrentThreadId
SetEvent
ResetEvent
SetThreadPriority
GetLastError
CreateThread
SetThreadIdealProcessor
SetThreadGroupAffinity
HeapCreate
HeapFree
QueryPerformanceCounter
MultiByteToWideChar
GetLogicalProcessorInformationEx
GetSystemTimeAsFileTime
QueryPerformanceFrequency
HeapAlloc
GetModuleHandleW
InitializeSRWLock
GlobalMemoryStatusEx
DeleteCriticalSection
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
GetActiveProcessorCount
GetMaximumProcessorCount
InitializeCriticalSection
LoadLibraryExW
TlsFree
RtlCaptureContext
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
LeaveCriticalSection
GetSystemTimeAdjustment
VirtualFree
VirtualAlloc
GetCurrentProcessId
IsDebuggerPresent
EnterCriticalSection
InterlockedPopEntrySList
GetCurrentProcessorNumberEx
HeapDestroy
IsProcessorFeaturePresent
PostQueuedCompletionStatus
TerminateProcess
InitializeSListHead
LoadLibraryA
GetCurrentProcess
GetProcAddress
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlUnwindEx
CreateIoCompletionPort
RtlLookupFunctionEntry
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
TlsSetValue
Sleep

advapi32

EventUnregister
EventWriteTransfer
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegNotifyChangeKeyValue
EventRegister

iphlpapi

SetCurrentThreadCompartmentId
GetCurrentThreadCompartmentId

bcrypt

BCryptEncrypt
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptDestroyKey

ws2_32

WSARecv
getsockopt
connect
setsockopt
WSAGetLastError
socket
getsockname
WSAStartup
WSASocketW
shutdown
WSASend
closesocket
WSAIoctl
bind
FreeAddrInfoW
WSACleanup
GetAddrInfoW
htonl

crypt32

CertFreeCertificateChain
CertCloseStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertAddCertificateLinkToStore
CertSaveStore
CertGetCertificateChain
CertGetNameStringA
CertFreeCertificateContext

sspicli

QueryContextAttributesExW

ntdll

NtSetInformationThread
RtlNtStatusToDosError
RtlInitUnicodeString

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

api-ms-win-crt-string-l1-1-0

wcscmp
_strnicmp
wcsncmp
strnlen

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_execute_onexit_table
_initialize_onexit_table
_configure_narrow_argv
abort
_cexit
_seh_filter_dll
_initterm_e
terminate
_initterm

api-ms-win-crt-heap-l1-1-0

calloc
free

Exports

Exports

MsQuicClose
MsQuicOpenVersion

Sections

.text
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
61954lingguang.10202F78DD1FD_7.0.0.0_x64__5b5h4n7n89bzm/resources.pri

Resubmissions

Sharing

General

Malware Config

Signatures

Files

bffa8501aec5c29321d36de57d4de8be

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

c8:82:3e:a0:58:c9:a3:5b:24:e4:72:aa:89:c8:28:d2:1c:a1:f9:c4:e6:dd:b0:2d:28:52:58:e2:d0:35:00:1dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

advapi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 295KB - Virtual size: 295KB

.data Size: 17KB - Virtual size: 35KB

.pdata Size: 74KB - Virtual size: 73KB

.didat Size: 512B - Virtual size: 112B

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 18KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 216KB - Virtual size: 215KB

.data Size: 28KB - Virtual size: 25KB

.reloc Size: 4KB - Virtual size: 1KB

0a3448f174c1236d8b654cece5a664ef

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

f9:eb:f5:4c:b3:42:96:d0:0c:89:00:fa:15:3b:06:ba:2e:b7:46:f6:38:3e:23:52:b1:5e:89:e7:8d:59:f4:e4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d2d1

d3d11

dwrite

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

kernel32

advapi32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 399KB - Virtual size: 398KB

.data Size: 6KB - Virtual size: 12KB

.pdata Size: 69KB - Virtual size: 69KB

.didat Size: 512B - Virtual size: 32B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 43KB - Virtual size: 43KB

Headers

DLL Characteristics

File Characteristics

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c8:82:3e:a0:58:c9:a3:5b:24:e4:72:aa:89:c8:28:d2:1c:a1:f9:c4:e6:dd:b0:2d:28:52:58:e2:d0:35:00:1d
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 295KB - Virtual size: 295KB

.data
Size: 17KB - Virtual size: 35KB

.pdata
Size: 74KB - Virtual size: 73KB

.didat
Size: 512B - Virtual size: 112B

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 18KB

.text
Size: 216KB - Virtual size: 215KB

.data
Size: 28KB - Virtual size: 25KB

.reloc
Size: 4KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

f9:eb:f5:4c:b3:42:96:d0:0c:89:00:fa:15:3b:06:ba:2e:b7:46:f6:38:3e:23:52:b1:5e:89:e7:8d:59:f4:e4
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 399KB - Virtual size: 398KB

.data
Size: 6KB - Virtual size: 12KB

.pdata
Size: 69KB - Virtual size: 69KB

.didat
Size: 512B - Virtual size: 32B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 43KB - Virtual size: 43KB

.text
Size: 272KB - Virtual size: 270KB

.data
Size: 36KB - Virtual size: 35KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 42KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 284B

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 200KB - Virtual size: 199KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 72KB - Virtual size: 68KB

.data
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 600B

.text
Size: 108KB - Virtual size: 107KB

.data
Size: 12KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 920B

.text
Size: 96KB - Virtual size: 92KB

.data
Size: 12KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 812B

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 720B

.text
Size: 108KB - Virtual size: 106KB

.data
Size: 16KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 1008B