MCPR[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MCPR.exe
Size

11.8MB
MD5

71c628a358903b9ef617bf6abaf7b8b8
SHA1

e14a9161d4d2dc4be4821928549bf8838c520a4a
SHA256

1cee9c5ae7735dd64a8acf9ebf0b616d6999ba70dd4b7692e17b7b085b993841
SHA512

05bb5db374e42b0b4577a34bad85514ba479dfa5d526376100978aae9e081dbd2d27cbf9ee448e20ffd3ea46b32aea4217019b20282f05143187f5f2884fcdf2
SSDEEP

196608:YSekQYJ5Cv8fd7wJjFpqu5yFe3MfZonDdEEQHD7qg0t0AJc63jSzSnAjDoIf9fqE:BVQY3o8acu513Mh2jt0v6ezSn2oIYE

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$1/VS/SdOASMon.dll
unpack001/$1/VS/VSCore/latest/32/mfehidin.exe
unpack001/$1/VS/VSCore/latest/64/mfehidin.exe
unpack001/$1/WPS/drivers/22.6/x64/mc-sec-installer.exe
unpack001/$1/WPS/drivers/22.6/x64/mc-sec-kernel.dll
unpack001/$1/WPS/drivers/22.6/x64/mc-sec-unprotector.exe
unpack001/$1/WPS/drivers/22.6/x64/mfesec.sys
unpack001/$1/mccleanup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

MCPR.exe
.exe windows:4 windows x86 arch:x86

3abe302b6d9a1256e6a915429af4ffd2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9
Signer

Actual PE Digest

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9

Digest Algorithm

sha256

PE Digest Matches

true

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9
Signer

Actual PE Digest

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$1/APPSTATS/RegKeyList.txt
$1/APPSTATS/appstats.ini
$1/APPSTATS/appstats_1.ini
$1/Auth/auth.ini
$1/Auth/auth1.ini
$1/Auth/files_authcore.txt
$1/Auth/files_ffplg.txt
$1/Auth/files_ieplg.txt
$1/Auth/master.ini
$1/Auth/reg.txt
$1/CSP/RegKeyList.txt
$1/CSP/csp.ini
$1/CSP/csp1.ini
$1/EMProxy/EmProxy.ini
$1/EMProxy/EmPrxy11.ini
$1/EMProxy/filelist.txt
$1/EMProxy/master.ini
$1/EMProxy/reglist.txt
$1/EULA.txt
$1/FWDriver/FWDriver1.ini
$1/FWDriver/FWDriver2.ini
$1/FWDriver/FWDriver_RegKeyList.txt
$1/FWDriver/depend.ini
$1/FWDriver/fwdriver.ini
$1/FWDriver/master.ini
$1/FWDriverCleanUP.wse
$1/HW/HW.ini
$1/HW/HW1.ini
$1/HW/HW11.ini
$1/HW/HW_RegKeyList.txt
$1/HW/depend.ini
$1/HW/master.ini
$1/HWCleanUP.wse
$1/LAM/FileList.txt
$1/LAM/FileListBeta.txt
$1/LAM/FileListRefresh.txt
$1/LAM/RegKeyList.txt
$1/LAM/RegKeyListBeta.txt
$1/LAM/RegKeyListRefresh.txt
$1/LAM/lam.ini
$1/LAM/lam1.ini
$1/LAM/lambeta.ini
$1/LAM/lamrefresh.ini
$1/MAS/Files_MAS11_Win9x.txt
$1/MAS/Files_MAS11_WinNT.txt
$1/MAS/Files_MAS20_Win9x.txt
$1/MAS/Files_MAS20_WinNT.txt
$1/MAS/RegKeys_MAS11_Win9x.txt
$1/MAS/RegKeys_MAS11_WinNT.txt
$1/MAS/RegKeys_MAS20_Win9x.txt
$1/MAS/RegKeys_MAS20_WinNT.txt
$1/MAS/depend.ini
$1/MAS/mas.ini
$1/MAS/mas1.ini
$1/MAS/mas2.ini
$1/MAS/master.ini
$1/MAS/project.info
$1/MAT/Files_MAT1.txt
$1/MAT/RegKeyList.txt
$1/MAT/mat.ini
$1/MAT/mat1.ini
$1/MBK/MBK.ini
$1/MBK/MBK1.ini
$1/MBK/MBK_RegKeyList.txt
$1/MBK/depend.ini
$1/MBK/master.ini
$1/MBKCleanUP.wse
$1/MCPR/cleanup.ini
$1/MCPR/mcpr.ini
$1/MCPR/regkeylist.txt
$1/MCPRCleanUP.wse
$1/MFP/MFP.ini
$1/MFP/MFP2.ini
$1/MFP/filelist_MFP2.txt
$1/MFP/mfputil_x64.exe
.exe windows:5 windows x64 arch:x64

375125cf54c4147129d3f93d93ac06f3

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5
Signer

Actual PE Digest

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5

Digest Algorithm

sha256

PE Digest Matches

true

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5
Signer

Actual PE Digest

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\seshan\Code\trunk_safeeyes\support-projects\McCleanup\MFPUtil\x64\Release\MFPUtil_x64.pdb

Imports

kernel32

FreeLibrary
CreateProcessW
WaitForSingleObject
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
GetLastError
GetProcAddress
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
RaiseException
RtlPcToFileHeader
HeapFree
RtlUnwindEx
LCMapStringA
LCMapStringW
GetStringTypeW
HeapAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MFP/mfputil_x86.exe
.exe windows:5 windows x86 arch:x86

1864160f6d8d189f3a2346ae1f5e0198

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56
Signer

Actual PE Digest

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56

Digest Algorithm

sha256

PE Digest Matches

true

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56
Signer

Actual PE Digest

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\seshan\Code\trunk_safeeyes\support-projects\McCleanup\MFPUtil\Release\MFPUtil_x86.pdb

Imports

kernel32

FreeLibrary
CreateProcessW
WaitForSingleObject
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
GetLastError
GetProcAddress
CloseHandle
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
RaiseException
HeapFree
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeW
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
GetModuleHandleA

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MFP/regkeylist_MFP2.txt
$1/MFP/x64/mfp.xml
$1/MFP/x64/sediag.exe
.exe windows:5 windows x64 arch:x64

ff273075d3607a6d0bc9ff1a0a970451

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:a8:be:b5:b4:6f:89:7e:31:fe:67:e7:bf:bb:82:fc:37:97:ec:74:86:64:f2:31:f3:b7:9a:bb:1f:15:1b:01
Signer

Actual PE Digest

a4:a8:be:b5:b4:6f:89:7e:31:fe:67:e7:bf:bb:82:fc:37:97:ec:74:86:64:f2:31:f3:b7:9a:bb:1f:15:1b:01

Digest Algorithm

sha256

PE Digest Matches

true

a4:a8:be:b5:b4:6f:89:7e:31:fe:67:e7:bf:bb:82:fc:37:97:ec:74:86:64:f2:31:f3:b7:9a:bb:1f:15:1b:01
Signer

Actual PE Digest

a4:a8:be:b5:b4:6f:89:7e:31:fe:67:e7:bf:bb:82:fc:37:97:ec:74:86:64:f2:31:f3:b7:9a:bb:1f:15:1b:01

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\BuildEngineSpace\Temp\042c0399-17d6-4d6f-ad18-85b845106b7f\UNIQUE_BUILDFOLDER_1\build\MFP\x64\Release\sediag.pdb

Imports

ws2_32

WSCGetProviderPath32
WSCDeinstallProvider
WSCInstallProvider
WSCDeinstallProvider32
WSCEnumProtocols32
WSCWriteProviderOrder
WSCWriteProviderOrder32
WSCEnumProtocols
WSCGetProviderPath

shell32

DragQueryFileA
DragFinish
SHGetSpecialFolderLocation
SHGetFolderPathA
ShellExecuteExA
ShellExecuteA
SHGetPathFromIDListA
SHAppBarMessage
SHBrowseForFolderA
SHGetFileInfoA
SHGetDesktopFolder

rpcrt4

UuidCreate

kernel32

GetStringTypeW
CompareStringW
WriteConsoleW
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
DeviceIoControl
HeapCreate
GetVersion
HeapSetInformation
GetStdHandle
SetHandleCount
GetTimeZoneInformation
LCMapStringW
IsValidCodePage
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
SetStdHandle
HeapSize
HeapQueryInformation
CreateThread
ExitThread
ExitProcess
HeapReAlloc
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
GetStartupInfoW
GetCommandLineA
HeapAlloc
HeapFree
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RaiseException
FindResourceExW
QueryPerformanceCounter
VirtualProtect
SearchPathA
GetProfileIntA
GetTempFileNameA
GetNumberFormatA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
GetFileAttributesExA
SetErrorMode
GetCurrentDirectoryA
lstrcpyA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetACP
GlobalFlags
TlsFree
LocalReAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
OutputDebugStringA
GetLocaleInfoA
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
CloseHandle
GetVersionExA
GetLastError
LoadLibraryExW
Sleep
GetTickCount
GetModuleHandleA
GetTempPathA
MultiByteToWideChar
GetWindowsDirectoryA
GetModuleFileNameA
DeleteFileA
LocalFree
LocalAlloc
GetCurrentProcess
GetCurrentThread
SetLastError
lstrlenA
MulDiv
GetConsoleCP
lstrlenW
FormatMessageA
GlobalUnlock
GlobalLock
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GlobalAlloc
GlobalSize
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
TlsGetValue
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
lstrcmpiA
GetPrivateProfileStringA
WritePrivateProfileStringA
CopyFileA
GetPrivateProfileIntA
WaitForSingleObject
ResumeThread
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExA
lstrcmpA
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GlobalFree
DeactivateActCtx
CreateActCtxW
lstrcmpW
FindResourceA
FreeResource
GetModuleFileNameW
ActivateActCtx
ReleaseActCtx

user32

IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
FrameRect
GetUpdateRect
RegisterClipboardFormatA
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFrameControl
DrawEdge
DrawStateA
GetSystemMenu
LoadMenuW
SetClassLongPtrA
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
DrawIconEx
GetNextDlgGroupItem
LoadImageA
GetIconInfo
OffsetRect
MessageBeep
NotifyWinEvent
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
GetAsyncKeyState
IsRectEmpty
CreatePopupMenu
GetMenuDefaultItem
IntersectRect
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
KillTimer
SetTimer
InvalidateRect
DeleteMenu
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
SystemParametersInfoA
PostThreadMessageA
GetMenuItemInfoA
InflateRect
RealChildWindowFromPoint
UnregisterClassA
LoadCursorA
GetSysColorBrush
CharUpperA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
MapVirtualKeyA
GetKeyNameTextA
ReleaseDC
GetDC
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
CopyIcon
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
GetFocus
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetWindowLongPtrA
SetWindowLongPtrA
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
DestroyMenu
IsClipboardFormatAvailable
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
CopyRect
SetWindowLongA
SetWindowPos
PtInRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetParent
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
GetWindowLongA
SetFocus
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
BringWindowToTop
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
DrawIcon
MessageBoxA
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
SendMessageA
EnableWindow
CharUpperBuffA
GetWindowRgn
DestroyCursor
MapDialogRect
SubtractRect
GetDoubleClickTime

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

ole32

OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
RevokeDragDrop
OleDuplicateData
ReleaseStgMedium
CoInitialize
CoInitializeSecurity
DoDragDrop
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit
VariantChangeType
SysAllocStringLen
SysStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate

shlwapi

PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathAppendA
wnsprintfW

gdi32

DPtoLP
CombineRgn
SetRectRgn
GetTextCharsetInfo
EnumFontFamiliesA
CreateCompatibleBitmap
CreateDIBitmap
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPoint32A
GetBkColor
CreateHatchBrush
GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExA
GetRgnBox
OffsetRgn
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
GetDeviceCaps
CopyMetaFileA
CreateDCA
SetTextColor
SetBkColor
GetObjectA
CreateBitmap
CreateRectRgnIndirect
PatBlt
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
DeleteObject
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreatePalette

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ImageList_GetIconSize

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 540KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MFP/x64/seinst.dll
.dll windows:5 windows x64 arch:x64

50a55411702edaa346f60597a10000c0

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:67:39:37:d9:49:70:68:2d:ef:12:49:87:46:ce:37:56:a8:27:b6:0f:fe:67:af:d4:64:ec:67:c9:a3:54:61
Signer

Actual PE Digest

67:67:39:37:d9:49:70:68:2d:ef:12:49:87:46:ce:37:56:a8:27:b6:0f:fe:67:af:d4:64:ec:67:c9:a3:54:61

Digest Algorithm

sha256

PE Digest Matches

true

67:67:39:37:d9:49:70:68:2d:ef:12:49:87:46:ce:37:56:a8:27:b6:0f:fe:67:af:d4:64:ec:67:c9:a3:54:61
Signer

Actual PE Digest

67:67:39:37:d9:49:70:68:2d:ef:12:49:87:46:ce:37:56:a8:27:b6:0f:fe:67:af:d4:64:ec:67:c9:a3:54:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\042c0399-17d6-4d6f-ad18-85b845106b7f\UNIQUE_BUILDFOLDER_1\build\MFP\x64\Release\seinst.pdb

Imports

ws2_32

WSCGetProviderPath32
WSCDeinstallProvider
WSCInstallProvider
WSCDeinstallProvider32
WSCWriteProviderOrder
WSCEnumProtocols32
WSCEnumProtocols
WSCGetProviderPath
WSCWriteProviderOrder32

rpcrt4

UuidCreate

kernel32

GetStartupInfoW
GetConsoleCP
GetConsoleMode
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoW
CompareStringW
SetHandleCount
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetVersionExW
LoadLibraryExW
DeviceIoControl
GetProcessHeap
GetStdHandle
LCMapStringW
IsValidCodePage
SizeofResource
LockResource
LoadResource
FlsAlloc
FindResourceW
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameA
GetSystemTime
SystemTimeToFileTime
CompareFileTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
MultiByteToWideChar
GetLocaleInfoA
LoadLibraryW
GetModuleHandleA
lstrlenA
GetLastError
GetWindowsDirectoryA
GetModuleFileNameA
GetVersionExA
DeleteFileA
CloseHandle
LocalFree
LocalAlloc
FlsFree
FlsGetValue
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetFileType
SetStdHandle
HeapQueryInformation
HeapSize
CreateThread
ExitThread
ExitProcess
HeapReAlloc
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
GetTimeFormatA
GetDateFormatA
HeapAlloc
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
HeapFree
FindResourceExW
GetUserDefaultLCID
GetCurrentProcess
GetCurrentThread
WaitForSingleObject
VirtualProtect
SearchPathA
MulDiv
lstrlenW
FormatMessageA
Sleep
GetProfileIntA
GetTickCount
GetNumberFormatA
GetTempPathA
GetTempFileNameA
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetFileAttributesExA
GetCurrentDirectoryA
GetACP
lstrcpyA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
TlsGetValue
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
lstrcmpiA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GlobalUnlock
ResumeThread
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExA
lstrcmpA
GetModuleHandleW
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetCurrentProcessId
FindResourceA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ActivateActCtx
DeactivateActCtx
lstrcmpW
SetLastError
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock

user32

CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
GetNextDlgGroupItem
LoadImageA
GetIconInfo
EnableScrollBar
InvertRect
GetMenuDefaultItem
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CopyAcceleratorTableA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateA
MessageBeep
ReleaseCapture
SetCapture
GetSystemMenu
LoadMenuW
SetClassLongPtrA
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
DestroyIcon
IsIconic
KillTimer
SetTimer
InvalidateRect
DeleteMenu
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
InflateRect
RealChildWindowFromPoint
LoadCursorA
GetSysColorBrush
UnregisterClassA
CharUpperA
GetSystemMetrics
CreateDialogIndirectParamA
GetNextDlgTabItem
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
PostQuitMessage
GetWindowThreadProcessId
IsWindowEnabled
ShowWindow
PostThreadMessageA
SetWindowTextA
IsDialogMessageA
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconW
SubtractRect
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetWindowLongPtrA
SetWindowLongPtrA
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
ValidateRect
UpdateWindow
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
GetWindowRect
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
WaitMessage
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
CopyRect
GetWindowLongA
SetWindowLongA
PtInRect
GetWindow
EndPaint
GetWindowRgn
DestroyCursor
DrawIcon
MoveWindow
MapDialogRect
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
BringWindowToTop
SetWindowPos
GetDesktopWindow
DialogBoxParamA
PostMessageA
HideCaret
EndDialog
GetDlgItem
SendMessageW
SetWindowTextW
GetSysColor
EnableWindow
RedrawWindow
GetClientRect
SendMessageA
MapVirtualKeyExA
GetKeyNameTextA
LoadIconA
IsCharLowerA
IntersectRect

gdi32

Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
CombineRgn
PatBlt
DPtoLP
GetTextExtentPoint32A
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
CreateDIBSection
CreateRoundRectRgn
ExtTextOutA
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceA
SetPixelV
RectVisible
TextOutA
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetDeviceCaps
GetObjectA
CreatePolygonRgn
CreateSolidBrush
CreateFontIndirectA

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExW
RegDeleteValueA
RegDeleteKeyA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumValueA
RegQueryValueA
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

shell32

ShellExecuteW
ShellExecuteA
SHGetFileInfoA
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHAppBarMessage
DragQueryFileA
DragFinish

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
wnsprintfW

ole32

OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoInitialize
ReleaseStgMedium
OleDuplicateData

oleaut32

VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

InternetQueryDataAvailable
HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpAddRequestHeadersA

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundA

Exports

Exports

AllowSilentUninstall
CanUninstallWithoutCode
CheckInstallSID
CheckUninstallCode
CreateSecureFile
EnableUserRoaming
GenerateESRHash
GenerateHelpID
GenerateSecurityHash
GetIPL
GetIPLCount
GetIPLSize
GetMFPProductName
InstallLSP
InstallLSPNoCode
InstallToControlPanel
IsForeignLSPPresent
IsIncompatibleProductPresent
IsSafeEyesDisabled
RemoveFromControlPanel
SetAutomaticDisablementKey
SetDefaultTimedDisablementKey
SetUserRoamingKey
SetupLSP
SetupLSPCategorization
SetupLockDown
ShowMsgDlg
UninstallForeignLSP
UninstallLSP
UninstallLSPNoCode
UpdateEncryptedUsernameAndPasswordToUnicode
UpdateUsernameAndPasswordToEncrypted

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MFP/x86/mfp.xml
$1/MFP/x86/sediag.exe
.exe windows:5 windows x86 arch:x86

e4646d26b3ea46ef4dea314fb8091b27

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:c6:20:48:bc:ba:66:85:40:20:4f:fe:ac:31:82:9b:1f:26:f1:53:92:8f:41:80:65:db:85:ce:b7:8f:5a:a9
Signer

Actual PE Digest

23:c6:20:48:bc:ba:66:85:40:20:4f:fe:ac:31:82:9b:1f:26:f1:53:92:8f:41:80:65:db:85:ce:b7:8f:5a:a9

Digest Algorithm

sha256

PE Digest Matches

true

23:c6:20:48:bc:ba:66:85:40:20:4f:fe:ac:31:82:9b:1f:26:f1:53:92:8f:41:80:65:db:85:ce:b7:8f:5a:a9
Signer

Actual PE Digest

23:c6:20:48:bc:ba:66:85:40:20:4f:fe:ac:31:82:9b:1f:26:f1:53:92:8f:41:80:65:db:85:ce:b7:8f:5a:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildEngineSpace\Temp\042c0399-17d6-4d6f-ad18-85b845106b7f\build\MFP\Win32\Release\sediag.pdb

Imports

ws2_32

WSCInstallProvider
WSCGetProviderPath
WSCWriteProviderOrder
WSCDeinstallProvider
WSCEnumProtocols

shell32

ShellExecuteExA
ShellExecuteA
SHGetFolderPathA
SHAppBarMessage
SHBrowseForFolderA
SHGetFileInfoA
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
DragFinish
DragQueryFileA

rpcrt4

UuidCreate

kernel32

DeviceIoControl
CompareStringW
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
HeapCreate
GetStdHandle
SetHandleCount
GetTimeZoneInformation
LCMapStringW
IsValidCodePage
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetFileType
SetStdHandle
HeapSize
HeapQueryInformation
CreateThread
ExitThread
ExitProcess
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapAlloc
HeapFree
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
RaiseException
FindResourceExW
VirtualProtect
SearchPathA
GetProfileIntA
GetTempFileNameA
GetNumberFormatA
GetFileTime
SetEnvironmentVariableA
GetFileAttributesA
FileTimeToLocalFileTime
GetFileAttributesExA
SetErrorMode
GetCurrentDirectoryA
lstrcpyA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetACP
GlobalFlags
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
FreeLibrary
GetProcAddress
LoadLibraryA
OutputDebugStringA
GetLocaleInfoA
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
CloseHandle
GetVersionExA
GetLastError
LoadLibraryExW
Sleep
GetTickCount
GetModuleHandleA
GetTempPathA
MultiByteToWideChar
GetWindowsDirectoryA
GetModuleFileNameA
InterlockedDecrement
DeleteFileA
LocalFree
LocalAlloc
GetCurrentProcess
GetCurrentThread
SetLastError
lstrlenA
MulDiv
lstrlenW
FormatMessageA
GlobalUnlock
CreateFileW
GetProcessHeap
WriteConsoleW
GetFileSizeEx
GlobalLock
GlobalAlloc
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
lstrcmpiA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GlobalSize
WaitForSingleObject
ResumeThread
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExA
lstrcmpA
GetModuleHandleW
InterlockedExchange
GetCurrentProcessId
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
lstrcmpW
CopyFileA
GlobalFree
DeactivateActCtx
FindResourceA
FreeResource
GetModuleFileNameW
ActivateActCtx
ReleaseActCtx
CreateActCtxW

user32

IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExA
IsCharLowerA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
FrameRect
GetUpdateRect
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
SubtractRect
InsertMenuItemA
TranslateAcceleratorA
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CopyAcceleratorTableA
DrawFrameControl
DrawEdge
DrawStateA
GetSystemMenu
LoadMenuW
SetClassLongA
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
DrawIconEx
GetNextDlgGroupItem
LoadImageA
GetIconInfo
OffsetRect
MessageBeep
NotifyWinEvent
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
GetAsyncKeyState
IsRectEmpty
CreatePopupMenu
GetMenuDefaultItem
IntersectRect
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
KillTimer
SetTimer
PostThreadMessageA
DeleteMenu
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
InflateRect
RealChildWindowFromPoint
UnregisterClassA
LoadCursorA
GetSysColorBrush
CharUpperA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
MapVirtualKeyA
GetKeyNameTextA
ReleaseDC
GetDC
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
GetForegroundWindow
GetLastActivePopup
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
CreateMenu
SetMenuDefaultItem
InvalidateRect
IsClipboardFormatAvailable
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
CopyRect
PtInRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetParent
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
GetWindowLongA
SetFocus
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
BringWindowToTop
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
DrawIcon
MessageBoxA
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
SendMessageA
EnableWindow
MapDialogRect
DestroyCursor
GetWindowRgn
MoveWindow
LoadCursorW

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyA
RegQueryValueA
RegEnumValueA

ole32

DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
OleDuplicateData
ReleaseStgMedium
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoInitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantChangeType

shlwapi

PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathFindExtensionA
PathAppendA
wnsprintfW

gdi32

RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
GetBkColor
DPtoLP
CombineRgn
SetRectRgn
GetTextFaceA
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExA
GetRgnBox
OffsetRgn
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetDeviceCaps
CopyMetaFileA
CreateDCA
SetTextColor
SetBkColor
GetObjectA
CreateBitmap
CreateRectRgnIndirect
PatBlt
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
DeleteObject
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
CreateHatchBrush
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
CreateDIBitmap
CreateCompatibleBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetSystemPaletteEntries

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ImageList_GetIconSize

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MFP/x86/seinst.dll
.dll windows:5 windows x86 arch:x86

dec6fd6b8d895599001c8d86d940702a

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:18:f3:13:ac:8a:a9:4c:0b:e2:08:22:da:26:58:ec:61:6c:10:f4:59:bb:87:df:f3:7d:41:e6:61:73:5e:8e
Signer

Actual PE Digest

50:18:f3:13:ac:8a:a9:4c:0b:e2:08:22:da:26:58:ec:61:6c:10:f4:59:bb:87:df:f3:7d:41:e6:61:73:5e:8e

Digest Algorithm

sha256

PE Digest Matches

true

50:18:f3:13:ac:8a:a9:4c:0b:e2:08:22:da:26:58:ec:61:6c:10:f4:59:bb:87:df:f3:7d:41:e6:61:73:5e:8e
Signer

Actual PE Digest

50:18:f3:13:ac:8a:a9:4c:0b:e2:08:22:da:26:58:ec:61:6c:10:f4:59:bb:87:df:f3:7d:41:e6:61:73:5e:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\042c0399-17d6-4d6f-ad18-85b845106b7f\build\MFP\Win32\Release\seinst.pdb

Imports

ws2_32

WSCGetProviderPath
WSCEnumProtocols
WSCInstallProvider
WSCWriteProviderOrder
WSCDeinstallProvider

rpcrt4

UuidCreate

kernel32

CompareStringW
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetVersionExW
LoadLibraryExW
DeviceIoControl
GetProcessHeap
InterlockedCompareExchange
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameA
GetSystemTime
SystemTimeToFileTime
CompareFileTime
FreeEnvironmentStringsW
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
MultiByteToWideChar
GetLocaleInfoA
LoadLibraryW
GetModuleHandleA
lstrlenA
GetLastError
GetWindowsDirectoryA
GetModuleFileNameA
GetVersionExA
InterlockedDecrement
DeleteFileA
CloseHandle
LocalFree
LocalAlloc
GetLocaleInfoW
GetCurrentThread
WaitForSingleObject
GetStringTypeW
GetConsoleMode
GetConsoleCP
GetStartupInfoW
SetHandleCount
GetStdHandle
LCMapStringW
IsValidCodePage
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
GetFileType
SetStdHandle
HeapQueryInformation
HeapSize
CreateThread
ExitThread
ExitProcess
HeapReAlloc
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualAlloc
GetDateFormatA
GetTimeFormatA
HeapAlloc
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RaiseException
RtlUnwind
HeapFree
FindResourceExW
GetUserDefaultLCID
MulDiv
lstrlenW
QueryPerformanceCounter
GetCurrentProcess
GetEnvironmentStringsW
VirtualProtect
SearchPathA
FormatMessageA
GlobalUnlock
GlobalLock
Sleep
GetProfileIntA
GetTickCount
GetNumberFormatA
GetTempPathA
GetTempFileNameA
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetFileAttributesExA
GetCurrentDirectoryA
GetACP
lstrcpyA
GetSystemDirectoryW
GetOEMCP
GetCPInfo
GlobalFlags
InterlockedIncrement
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
lstrcmpiA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
ResumeThread
GlobalAlloc
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
LoadLibraryExA
lstrcmpA
GetModuleHandleW
InterlockedExchange
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetCurrentProcessId
FindResourceA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ActivateActCtx
DeactivateActCtx
lstrcmpW
SetLastError
GlobalFree
CopyFileA
GlobalSize

user32

CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
GetNextDlgGroupItem
LoadImageA
GetIconInfo
EnableScrollBar
InvertRect
GetMenuDefaultItem
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CopyAcceleratorTableA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateA
MessageBeep
ReleaseCapture
SetCapture
GetSystemMenu
LoadMenuW
SetClassLongA
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
DestroyIcon
IsIconic
KillTimer
SetTimer
InvalidateRect
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
IntersectRect
InflateRect
RealChildWindowFromPoint
LoadCursorA
GetSysColorBrush
UnregisterClassA
CharUpperA
GetSystemMetrics
CreateDialogIndirectParamA
GetNextDlgTabItem
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
PostQuitMessage
GetWindowThreadProcessId
PostThreadMessageA
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
ValidateRect
UpdateWindow
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
GetWindowRect
EqualRect
WaitMessage
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
RegisterClipboardFormatA
CopyIcon
CharUpperBuffA
GetDoubleClickTime
IsCharLowerA
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
GetKeyNameTextA
MapVirtualKeyExA
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
CopyRect
PtInRect
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
BringWindowToTop
SetWindowPos
GetDesktopWindow
DialogBoxParamA
PostMessageA
HideCaret
EndDialog
GetDlgItem
SendMessageW
SetWindowTextW
GetSysColor
EnableWindow
RedrawWindow
GetClientRect
SendMessageA
GetWindowRgn
RegisterWindowMessageA
DeleteMenu

gdi32

Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
CombineRgn
PatBlt
DPtoLP
GetTextExtentPoint32A
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
CreateDIBSection
CreateRoundRectRgn
ExtTextOutA
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceA
SetPixelV
RectVisible
TextOutA
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetDeviceCaps
GetObjectA
CreatePolygonRgn
CreateSolidBrush
CreateFontIndirectA

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExW
RegDeleteValueA
RegDeleteKeyA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegEnumValueA
RegQueryValueA
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW

shell32

ShellExecuteW
ShellExecuteA
SHGetFileInfoA
SHGetDesktopFolder
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHAppBarMessage
DragQueryFileA
DragFinish

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
wnsprintfW

ole32

OleCreateMenuDescriptor
CoTaskMemFree
CoCreateGuid
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoTaskMemAlloc
StringFromGUID2
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoInitialize
ReleaseStgMedium
OleDuplicateData

oleaut32

SysAllocString
VarBstrFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
SysAllocStringLen
VariantChangeType
VariantInit
VariantClear
SysFreeString

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

InternetOpenA
InternetQueryDataAvailable
HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetCloseHandle
HttpAddRequestHeadersA

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundA

Exports

Exports

AllowSilentUninstall
CanUninstallWithoutCode
CheckInstallSID
CheckUninstallCode
CreateSecureFile
EnableUserRoaming
GenerateESRHash
GenerateHelpID
GenerateSecurityHash
GetIPL
GetIPLCount
GetIPLSize
GetMFPProductName
InstallLSP
InstallLSPNoCode
InstallToControlPanel
IsForeignLSPPresent
IsIncompatibleProductPresent
IsSafeEyesDisabled
RemoveFromControlPanel
SetAutomaticDisablementKey
SetDefaultTimedDisablementKey
SetUserRoamingKey
SetupLSP
SetupLSPCategorization
SetupLockDown
ShowMsgDlg
UninstallForeignLSP
UninstallLSP
UninstallLSPNoCode
UpdateEncryptedUsernameAndPasswordToUnicode
UpdateUsernameAndPasswordToEncrypted

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 282KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MGS/RegKeyList.txt
$1/MGS/RemoveUWP.ps1
$1/MGS/cleanMGSTasks.bat
$1/MGS/master.ini
$1/MGS/mgs.ini
$1/MGS/mgs10.ini
$1/MHN/master.ini
$1/MHN/mhn.ini
$1/MHN/mhn10.ini
$1/MHN/mhn12.ini
$1/MHN/mhn_10_files.txt
$1/MHN/mhn_10_regkeylist.txt
$1/MHN/mhn_12_files.txt
$1/MHN/mhn_12_regkeylist.txt
$1/MHN/project.info
$1/MNA/McSHIns.dll
.dll windows:5 windows x86 arch:x86

1af4354f2ce591c3730b0cff082585e8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:4a:36:1e:16:8a:81:a8:f3:ef:aa:da:33:25:08:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/09/2008, 00:00

Not After

09/10/2011, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f0:38:75:41:dd:ed:fe:1d:f0:4c:86:6b:f8:4a:d5:af:d3:c5:0f:ee
Signer

Actual PE Digest

f0:38:75:41:dd:ed:fe:1d:f0:4c:86:6b:f8:4a:d5:af:d3:c5:0f:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\BuildSystem\Node\SHAREDSVC_LI100_6338073368317.Build\build\Win32\Release\McSHIns.pdb

Imports

kernel32

GetLocaleInfoA
GetThreadLocale
GetVersionExW
CloseHandle
GetCurrentProcess
GetProcAddress
GetModuleHandleW
GetFileAttributesW
FindClose
FindFirstFileW
EnterCriticalSection
LeaveCriticalSection
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
lstrcmpiW
GetShortPathNameW
GetACP
GetTempFileNameW
MoveFileExW
SetFileAttributesW
GetCurrentProcessId
CreateMutexW
GetModuleFileNameW
RemoveDirectoryW
FindNextFileW
DeleteFileW
CreateDirectoryW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentDirectoryW
CreateFileW
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
GetLocalTime
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
VirtualQuery
Sleep
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
CopyFileW
GetLastError
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
HeapFree
RaiseException
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
HeapReAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetModuleHandleA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen

Exports

Exports

AddSharedSvcToFW
RemoveSharedSvcFromFW
RemoveSvcFromFW

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MNA/master.ini
$1/MNA/mna.ini
$1/MNA/mna10.ini
$1/MNA/mna_10_files.txt
$1/MNA/mna_10_regkeylist.txt
$1/MNA/project.info
$1/MOBK/mobk.ini
$1/MOBK/mobkc.ini
$1/MOCP/MOCP.ini
$1/MOCP/MOCP30.ini
$1/MOCP/filelist_MOCP30.txt
$1/MOCP/regkeylist_MOCP30.txt
$1/MPS/Files_Win2K_SHRED_6_0.txt
$1/MPS/Files_Win2K_SHR_5_0.txt
$1/MPS/Files_Win98_SHRED_6_0.txt
$1/MPS/Files_Win98_SHR_5_0.txt
$1/MPS/RegKeyList.txt
$1/MPS/RegKeyList_mps9.txt
$1/MPS/Reg_Win2K_SHRED_6_0.txt
$1/MPS/Reg_Win2K_SHR_5_0.txt
$1/MPS/Reg_Win98_SHRED_6_0.txt
$1/MPS/Reg_Win98_SHR_5_0.txt
$1/MPS/Regmps10.txt
$1/MPS/Regmps11.txt
$1/MPS/Regmps12.txt
$1/MPS/Regmps13.txt
$1/MPS/depend.ini
$1/MPS/master.ini
$1/MPS/mps10.ini
$1/MPS/mps11.ini
$1/MPS/mps12.ini
$1/MPS/mps13.ini
$1/MPS/mps7.ini
$1/MPS/mps8.ini
$1/MPS/mps9.ini
$1/MPS/mps_uninst.ini
$1/MPS/mpscu.ini
$1/MPS/mpscu1.ini
$1/MPS/mpsunins.dll
.dll windows:6 windows x86 arch:x86

8bd64d5326b7ecd53885bbea84e91316

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:97:23:4e:81:01:84:68:4d:c6:dd:0f:41:6d:7a:65:4f:be:59:4c:d2:2e:af:22:a5:e9:52:5c:37:e5:71:d3
Signer

Actual PE Digest

ba:97:23:4e:81:01:84:68:4d:c6:dd:0f:41:6d:7a:65:4f:be:59:4c:d2:2e:af:22:a5:e9:52:5c:37:e5:71:d3

Digest Algorithm

sha256

PE Digest Matches

true

ba:97:23:4e:81:01:84:68:4d:c6:dd:0f:41:6d:7a:65:4f:be:59:4c:d2:2e:af:22:a5:e9:52:5c:37:e5:71:d3
Signer

Actual PE Digest

ba:97:23:4e:81:01:84:68:4d:c6:dd:0f:41:6d:7a:65:4f:be:59:4c:d2:2e:af:22:a5:e9:52:5c:37:e5:71:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\285a4d90-a3de-4f27-b448-97f2220cba44\build\Win32\Release\mpsunins.pdb

Imports

advapi32

CryptAcquireContextW

kernel32

GetLastError
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
CloseHandle
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
SetLastError
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Exports

Exports

mpsunins

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MPS/project.info
$1/MPS/proxy1.ini
$1/MPS/proxy_uninst.ini
$1/MPS/redirector1.ini
$1/MPS/redirector_uninst.ini
$1/MPS/shr5.ini
$1/MPS/shred.ini
$1/MPS/shred6.ini
$1/MPS/shredder.ini
$1/MPS/shredder_uninst.ini
$1/MPS/unreglsp.bat
$1/MPS/unregproxysvc.bat
$1/MPS/unregredirsvc.bat
$1/MPSCleanUP.wse
$1/MQC/Depend.ini
$1/MQC/dummy.ini
$1/MQC/master.ini
$1/MQC/mcpins.dll
.dll windows:6 windows x86 arch:x86

6b2310cfec788fb640c6338cce459854

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:ba:07:87:5f:35:89:62:87:1d:2a:27:2f:d4:29:e4:e6:56:b4:ee:58:11:c3:b9:58:b2:d2:ce:69:4a:d0:e4
Signer

Actual PE Digest

a0:ba:07:87:5f:35:89:62:87:1d:2a:27:2f:d4:29:e4:e6:56:b4:ee:58:11:c3:b9:58:b2:d2:ce:69:4a:d0:e4

Digest Algorithm

sha256

PE Digest Matches

true

a0:ba:07:87:5f:35:89:62:87:1d:2a:27:2f:d4:29:e4:e6:56:b4:ee:58:11:c3:b9:58:b2:d2:ce:69:4a:d0:e4
Signer

Actual PE Digest

a0:ba:07:87:5f:35:89:62:87:1d:2a:27:2f:d4:29:e4:e6:56:b4:ee:58:11:c3:b9:58:b2:d2:ce:69:4a:d0:e4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\3779b680-1eb3-4c38-8787-7aa0332c5dfa\build\Win32\Release\McpIns.pdb

Imports

wintrust

WinVerifyTrust

kernel32

DeleteCriticalSection
SetLastError
LoadLibraryExW
ReleaseSRWLockShared
AcquireSRWLockShared
GlobalFindAtomW
IsBadReadPtr
SystemTimeToFileTime
GetCurrentProcessId
GetCurrentDirectoryW
OutputDebugStringW
GetVersionExW
GetModuleFileNameW
CreateFileW
LockFileEx
UnlockFileEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetWindowsDirectoryW
GlobalAddAtomW
CopyFileW
MoveFileW
MoveFileExW
ReplaceFileW
DeleteFileA
DecodePointer
GetTempPathA
GetTempFileNameA
FreeEnvironmentStringsW
RaiseException
InitializeCriticalSectionEx
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetSystemTime
GetDateFormatW
GetModuleHandleW
GetShortPathNameW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
SetEndOfFile
WriteConsoleW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
SetStdHandle
FlushFileBuffers
GetStdHandle
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetFileType
GetConsoleCP
WideCharToMultiByte
GetProcAddress
LoadLibraryW
FreeLibrary
CloseHandle
GetLastError
MultiByteToWideChar
GetCurrentProcess
FindFirstFileExA
FindNextFileA
SetFileAttributesA
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetStringTypeW
FormatMessageW
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
SetFilePointerEx
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
IsValidCodePage

user32

wsprintfW

advapi32

RegEnumKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyW
RegDeleteValueW
GetUserNameW
RegGetValueW
RegLoadKeyW
OpenProcessToken
RegDeleteKeyW
RegUnLoadKeyW
RegSaveKeyW

shell32

SHCreateDirectoryExW
SHGetFolderPathW

ole32

StringFromGUID2

shlwapi

SHCopyKeyW
PathAppendW
PathFileExistsA
PathRemoveFileSpecW
PathFileExistsW
PathAddExtensionA
PathStripToRootW
PathFindFileNameA
PathRemoveExtensionA
PathRemoveFileSpecA
PathFindExtensionW

crypt32

CryptDecodeObject
CryptMsgOpenToDecode
CryptMsgClose
CryptMsgUpdate
CryptMsgGetParam
CertCloseStore
CertGetSubjectCertificateFromStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy

Exports

Exports

DllCreateTasks
DllMcprUnInstall
DllPostInstall
DllPreUnInstall

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MQC/mqc.ini
$1/MQC/mqc10.ini
$1/MQC/mqc70.ini
$1/MQC/mqc80.ini
$1/MQC/mqc_10_regkeylist.txt
$1/MQC/mqc_70_regkeylist.txt
$1/MQC/mqc_80_regkeylist.txt
$1/MQC/mqc_files_70.txt
$1/MQC/mqc_files_80.txt
$1/MQC/mqccu.ini
$1/MQC/mqccu1.ini
$1/MQC/mqccu10.ini
$1/MQC/msc.ini
$1/MQC/project.info
$1/MSAD/RegKeyList.txt
$1/MSAD/msad.ini
$1/MSAD/msad1.ini
$1/MSAD/wa1.ini
$1/MSC/McMSCIns.dll
.dll windows:5 windows x86 arch:x86

f8996250f9e74620c20dad4c3d0072de

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:c7:20:3c:2d:ec:fb:86:69:32:e6:38:04:c6:12:7a:e4:8e:30:d9:f0:97:ce:f3:18:d8:e7:4b:8e:e3:81:13
Signer

Actual PE Digest

6c:c7:20:3c:2d:ec:fb:86:69:32:e6:38:04:c6:12:7a:e4:8e:30:d9:f0:97:ce:f3:18:d8:e7:4b:8e:e3:81:13

Digest Algorithm

sha256

PE Digest Matches

true

6c:c7:20:3c:2d:ec:fb:86:69:32:e6:38:04:c6:12:7a:e4:8e:30:d9:f0:97:ce:f3:18:d8:e7:4b:8e:e3:81:13
Signer

Actual PE Digest

6c:c7:20:3c:2d:ec:fb:86:69:32:e6:38:04:c6:12:7a:e4:8e:30:d9:f0:97:ce:f3:18:d8:e7:4b:8e:e3:81:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\39f7d586-30a1-4672-a4ff-541ba00aee6e\UNIQUE_BUILDFOLDER_1\build\Win32\Release\McMSCIns.pdb

Imports

wintrust

WinVerifyTrust

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

ReleaseMutex
CreateDirectoryW
lstrlenA
GetShortPathNameW
SetFilePointer
CreateFileA
GetWindowsDirectoryA
IsBadStringPtrW
CopyFileW
GetTempFileNameW
MoveFileExW
SetFileAttributesW
LoadLibraryExW
GetWindowsDirectoryW
GetLocalTime
OpenMutexW
GetCurrentDirectoryW
GetVolumeInformationW
GetDateFormatW
GetLocaleInfoW
SystemTimeToFileTime
GetSystemTimeAsFileTime
GlobalUnlock
GlobalLock
FlushFileBuffers
SetLastError
InterlockedExchange
SwitchToThread
GetEnvironmentVariableW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringW
WritePrivateProfileStructW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
QueryPerformanceCounter
IsBadWritePtr
VerSetConditionMask
VerifyVersionInfoW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedDecrement
InterlockedIncrement
OpenEventW
GetModuleHandleW
RemoveDirectoryW
GetLongPathNameW
RaiseException
SetEndOfFile
WriteFile
DeleteFileW
WaitForSingleObject
CreateFileW
GetFileSize
CreateMutexW
EnterCriticalSection
LeaveCriticalSection
FindFirstFileW
FindNextFileW
FindClose
DeleteCriticalSection
InitializeCriticalSection
GetThreadLocale
GetLocaleInfoA
GetACP
EncodePointer
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcmpiW
LocalFree
OpenProcess
lstrlenW
CreateProcessW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
GetLastError
GlobalAlloc
GetCurrentProcess
GlobalFree
FreeLibrary
CloseHandle
GetVersionExW
WriteConsoleW
SetEnvironmentVariableA
GetStringTypeW
HeapSize
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetStdHandle
ExitProcess
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
HeapReAlloc
HeapDestroy
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
GetFileAttributesW
IsBadReadPtr
LocalAlloc
GetModuleFileNameW
SetEnvironmentVariableW
GetUserDefaultLCID
InterlockedCompareExchange
Sleep
VirtualQuery
GetTickCount
GetCurrentThreadId
ReadFile
GetCurrentProcessId
CompareStringW
GetDateFormatA
GetTimeFormatA
GetCPInfo
LCMapStringW
GetCommandLineA
DecodePointer

user32

DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
LoadBitmapW
LoadIconW
PostMessageW
LoadStringW
wsprintfW
FindWindowW
LoadImageW

advapi32

RegQueryInfoKeyW
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
DeleteAce
SetSecurityDescriptorControl
SetFileSecurityW
GetExplicitEntriesFromAclW
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
QueryServiceConfigW
QueryServiceStatusEx
StartServiceW
ControlService
QueryServiceStatus
DeleteService
RegEnumValueW
GetSecurityDescriptorControl
RegCreateKeyExA
RegDeleteKeyW
RegSetValueExA
OpenSCManagerW
LockServiceDatabase
OpenServiceW
QueryServiceConfig2W
ChangeServiceConfig2W
CloseServiceHandle
UnlockServiceDatabase
RegEnumKeyExA
RegDeleteValueA
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
AllocateAndInitializeSid
EqualSid
OpenProcessToken
FreeSid

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHChangeNotify
SHCreateDirectoryExW

ole32

CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoGetClassObject
StringFromGUID2
CoInitialize
CLSIDFromString
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadTypeLi
CreateDispTypeInfo
CreateStdDispatch
SysStringByteLen
VariantChangeTypeEx
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString

shlwapi

SHDeleteKeyW
PathAppendW
SHCopyKeyW
PathFileExistsW
SHStrDupW

crypt32

CryptMsgClose
CertFreeCertificateContext
CertCloseStore
CertGetNameStringW
CertGetCertificateContextProperty
CryptDecodeObject
CryptMsgGetParam
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertGetSubjectCertificateFromStore
CryptQueryObject
CertFreeCertificateChain

psapi

EnumProcessModules
GetModuleInformation
GetModuleFileNameExW

Exports

Exports

ConditionHandlerAppEntitlement
CreateShortCuts
CreateVSOScheduledScanTask
DetectIncompatible
DllFUFunction
DllInstallFunction
DllPreUninstall
DllSrvFunction
DllUninstallFunction
DllUpgradeFunction
McGetMSCInstaller
NoUIUninstallRemoveMSCRegKey
OnFreeLibrary
PostInstall
PreInstall
RefreshPackageInfoAndShortcut
RemoveMPSLogTemplates
RemoveProductsStatus
StartApplication
SubmitProductsStatus
UninstallIncompatible
UpdateTaskNextRunTime
WriteRTLFlag

Sections

.text
Size: 439KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MSC/Reg_Win2K_MSC_6_0.txt
$1/MSC/Reg_Win98_MSC_6_0.txt
$1/MSC/ReleaseNotes.txt
$1/MSC/filelist70.txt
$1/MSC/master.ini
$1/MSC/mcmsc.ini
$1/MSC/mcmsc7.ini
$1/MSC/msc.ini
$1/MSC/msc6.ini
$1/MSC/mscclnup.dll
.dll windows:5 windows x86 arch:x86

fee0b08f3f0c4814ecd5407a209185f3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ef:be:8b:1f:57:dc:70:66:14:a3:04:6b:2f:cf:af:33:d2:da:9d:f3
Signer

Actual PE Digest

ef:be:8b:1f:57:dc:70:66:14:a3:04:6b:2f:cf:af:33:d2:da:9d:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Team_MSC_1\SecurityCenter\pkg\cleanup\mscclnup\Release\mscclnup.pdb

Imports

wintrust

WinVerifyTrust

kernel32

IsBadReadPtr
SystemTimeToFileTime
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
GetVersionExW
InterlockedCompareExchange
SwitchToThread
WriteConsoleW
SetStdHandle
RaiseException
GetConsoleMode
GetConsoleCP
SetFilePointer
Sleep
InterlockedExchange
LoadLibraryExW
SetLastError
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
OutputDebugStringW
GetModuleFileNameW
CreateFileW
GetCurrentProcessId
GetCommandLineA
GetCurrentThreadId
DecodePointer
FlushFileBuffers
EncodePointer
RtlUnwind
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapSize
IsProcessorFeaturePresent
WriteFile
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

shell32

SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

crypt32

CertGetCertificateContextProperty
CertGetNameStringW
CryptDecodeObject
CertFreeCertificateContext
CertFreeCertificateChain
CryptMsgClose
CryptMsgGetParam
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertGetSubjectCertificateFromStore
CertCloseStore
CryptQueryObject

Exports

Exports

RemoveMSCDesktopShortcut
StopMcAgentEXE

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/MSC/reglist70.txt
$1/MSC/reglist7064.txt
$1/MSHR/Files_Win2K_SHRED_5_0.txt
$1/MSHR/Files_Win2K_SHRED_6_0.txt
$1/MSHR/Files_Win2K_SHR_5_0.txt
$1/MSHR/Files_Win98_SHRED_5_0.txt
$1/MSHR/Files_Win98_SHRED_6_0.txt
$1/MSHR/Files_Win98_SHR_5_0.txt
$1/MSHR/Reg_Win2K_SHRED_5_0.txt
$1/MSHR/Reg_Win2K_SHRED_6_0.txt
$1/MSHR/Reg_Win2K_SHR_5_0.txt
$1/MSHR/Reg_Win98_SHRED_5_0.txt
$1/MSHR/Reg_Win98_SHRED_6_0.txt
$1/MSHR/Reg_Win98_SHR_5_0.txt
$1/MSHR/depend.ini
$1/MSHR/master.ini
$1/MSHR/shr5.ini
$1/MSHR/shred.ini
$1/MSHR/shred6.ini
$1/MSK/Depend.ini
$1/MSK/dummy.ini
$1/MSK/master.ini
$1/MSK/msc.ini
$1/MSK/msk.ini
$1/MSK/msk100.ini
$1/MSK/msk110.ini
$1/MSK/msk120.ini
$1/MSK/msk130.ini
$1/MSK/msk61.ini
$1/MSK/msk70.ini
$1/MSK/msk80.ini
$1/MSK/msk90.ini
$1/MSK/msk_100_regkeylist.txt
$1/MSK/msk_110_regkeylist.txt
$1/MSK/msk_120_regkeylist.txt
$1/MSK/msk_130_regkeylist.txt
$1/MSK/msk_61_regkeylist.txt
$1/MSK/msk_70_regkeylist.txt
$1/MSK/msk_80_regkeylist.txt
$1/MSK/msk_90_regkeylist.txt
$1/MSK/msk_files_100.txt
$1/MSK/msk_files_110.txt
$1/MSK/msk_files_120.txt
$1/MSK/msk_files_130.txt
$1/MSK/msk_files_61.txt
$1/MSK/msk_files_70.txt
$1/MSK/msk_files_80.txt
$1/MSK/msk_files_90.txt
$1/MSK/mskcu.ini
$1/MSK/mskcu1.ini
$1/MSK/project.info
$1/MSK/unregplg.bat
$1/MSKCleanUP.wse
$1/MWL/master.ini
$1/MWL/mwl.ini
$1/MWL/mwl20.ini
$1/MWL/mwl_20_files.txt
$1/MWL/mwl_20_regkeylist.txt
$1/MWL/project.info
$1/MXD/FileList.txt
$1/MXD/RegKeyList.txt
$1/MXD/mxd.ini
$1/MXD/mxd15.ini
$1/MasCleanUP.wse
$1/McClnUI.exe
.exe windows:6 windows x86 arch:x86

979dd30e6f04fff503bd2c4783d6f3a4

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

04/10/2021, 17:33

Not After

04/10/2024, 17:33

Subject

SERIALNUMBER=2306741,CN=McAfee\, LLC,O=McAfee\, LLC,STREET=6220 America Ctr Dr,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

12/03/2021, 00:00

Not After

11/03/2024, 23:59

Subject

CN=McAfee\, LLC,OU=Engineering,O=McAfee\, LLC,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:8b:fe:04:41:89:3d:6b:44:ea:f1:26:27:f5:b3:92:18:46:42:b7:54:3d:94:cd:54:34:93:93:c2:4b:78:8b
Signer

Actual PE Digest

08:8b:fe:04:41:89:3d:6b:44:ea:f1:26:27:f5:b3:92:18:46:42:b7:54:3d:94:cd:54:34:93:93:c2:4b:78:8b

Digest Algorithm

sha256

PE Digest Matches

true

08:8b:fe:04:41:89:3d:6b:44:ea:f1:26:27:f5:b3:92:18:46:42:b7:54:3d:94:cd:54:34:93:93:c2:4b:78:8b
Signer

Actual PE Digest

08:8b:fe:04:41:89:3d:6b:44:ea:f1:26:27:f5:b3:92:18:46:42:b7:54:3d:94:cd:54:34:93:93:c2:4b:78:8b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\B\T\3cba438f-d177-4426-9b38-0008ccd24f19\build\Win32\Release\McClnUI.pdb

Imports

crypt32

CryptBinaryToStringW
CryptMsgOpenToDecode
CryptMsgUpdate
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertGetSubjectCertificateFromStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CertGetCertificateChain

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExW
GetModuleInformation
EnumProcessModules

kernel32

ProcessIdToSessionId
WritePrivateProfileStringW
WritePrivateProfileStructW
GetWindowsDirectoryW
GetComputerNameW
GetSystemDefaultLocaleName
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetFileSizeEx
MapViewOfFile
WaitForSingleObjectEx
LocalFileTimeToFileTime
SetFileTime
DosDateTimeToFileTime
FormatMessageA
QueryPerformanceCounter
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
AreFileApisANSI
TryEnterCriticalSection
DeviceIoControl
GlobalMemoryStatusEx
QueryFullProcessImageNameW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateThread
GlobalFindAtomW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAddAtomW
GetSystemInfo
MoveFileW
ReplaceFileW
SetFileAttributesA
GetTempFileNameA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ExitProcess
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteConsoleW
GetStdHandle
VirtualAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoEx
GetCPInfo
CompareStringEx
GetLongPathNameW
GetTickCount
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetLocalTime
GetCurrentProcessId
CreateMutexW
ReleaseMutex
OutputDebugStringW
SetFilePointer
GetCurrentThreadId
CopyFileW
CreateFileW
lstrlenW
GetModuleHandleExW
GlobalAlloc
GetSystemDirectoryW
InitializeCriticalSection
GetExitCodeProcess
MoveFileExW
IsWow64Process
GetGeoInfoW
GetUserGeoID
GlobalFree
MultiByteToWideChar
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
VerifyVersionInfoW
VerSetConditionMask
SetLastError
LoadLibraryExW
ExpandEnvironmentStringsW
WideCharToMultiByte
WriteFile
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeW
ResetEvent
CreateEventW
Sleep
CreateProcessW
K32GetModuleBaseNameW
K32EnumProcessModules
OpenProcess
K32EnumProcesses
GetCurrentProcess
RemoveDirectoryW
CreateDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetUserDefaultLCID
GetProcessHeap
FormatMessageW
GetEnvironmentVariableW
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
ReadFile
FreeLibrary
GetModuleFileNameW
WaitForSingleObject
SetEvent
CloseHandle
LoadLibraryW
DecodePointer
GetProcAddress
GetModuleHandleW
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
LocalFree
LocalAlloc
LCMapStringEx
EncodePointer
IsProcessorFeaturePresent
GetFileInformationByHandleEx
SetFilePointerEx
SetFileInformationByHandle
GetFileInformationByHandle
FindFirstFileExW
GetExitCodeThread
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceComplete
InitOnceBeginInitialize
QueryPerformanceFrequency
GetStringTypeW
LoadLibraryExA
VirtualProtect
GetFileSize

user32

MsgWaitForMultipleObjects
GetDC
ReleaseDC
LoadStringW
GetMessageW
DispatchMessageW
UnregisterClassW
TranslateMessage
LoadBitmapW
LoadIconW
DialogBoxParamW
PtInRect
MessageBoxW
LoadAcceleratorsW
TranslateAcceleratorW
IsDialogMessageW
LoadCursorW
RegisterClassExW
GetClientRect
GetDesktopWindow
CreateWindowExW
ShowWindow
UpdateWindow
GetWindowLongW
SetWindowLongW
InvalidateRect
SetWindowPos
SendMessageW
GetDlgItem
SetWindowTextW
MapWindowPoints
PostMessageW
SetTimer
SetLayeredWindowAttributes
BeginPaint
EndPaint
GetCursorPos
ScreenToClient
SetCursor
SetDlgItemTextW
SendDlgItemMessageW
GetWindowRect
CreateDialogParamW
DefWindowProcW
PostQuitMessage
GetDlgItemTextW
DestroyWindow
RedrawWindow
EnableWindow
GetDlgCtrlID
EndDialog
KillTimer
MsgWaitForMultipleObjectsEx
PeekMessageW
GetParent

gdi32

SetBkColor
GetStockObject
SetBkMode
GetObjectW
SelectObject
BitBlt
CreateCompatibleDC
DeleteDC
CreateFontW
CreateBitmap
DeleteObject

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
FreeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
CreateProcessAsUserW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RevertToSelf
ImpersonateLoggedOnUser
RegQueryInfoKeyW
RegEnumValueW
EventWriteTransfer
EventUnregister
EventRegister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
RegSetValueExW
RegSetKeySecurity
RegNotifyChangeKeyValue
RegGetKeySecurity
RegFlushKey
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
EqualSid
GetTokenInformation
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetKnownFolderPath
SHGetFolderPathW
ShellExecuteW

ole32

CLSIDFromString
CoCreateGuid
CLSIDFromProgID
StringFromGUID2
StringFromCLSID
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoGetClassObject
CoGetPSClsid
CoSetProxyBlanket

oleaut32

VarUdateFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantCopy
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
PathAddExtensionA
PathRemoveFileSpecA
SHDeleteKeyW
PathFileExistsW
PathFileExistsA
StrTrimW
StrRChrW
PathFindExtensionW
PathRemoveFileSpecW
PathRemoveExtensionA
PathStripToRootW
PathAppendW

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
accept
bind
listen
connect
ioctlsocket
recv
recvfrom
getsockopt
htons
freeaddrinfo
inet_ntop
inet_pton
setsockopt
getpeername
getnameinfo
gethostname
getsockname
select
getaddrinfo
getservbyport
getservbyname
send
sendto
shutdown
socket
closesocket
getprotobyname
getprotobynumber

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInterfaceW
SetupDiEnumDeviceInterfaces

wtsapi32

WTSEnumerateSessionsW
WTSEnumerateProcessesW
WTSFreeMemory

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 477KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/McProxy/McProxy1.ini
$1/McProxy/McProxy4.ini
$1/McProxy/McProxy_uninst.ini
$1/McProxy/RegKeyList_McProxy1.txt
$1/McProxy/RegKeyList_McProxy4.txt
$1/McProxy/depend.ini
$1/McProxy/master.ini
$1/McSvcHost/master.ini
$1/McSvcHost/mcsvhost.ini
$1/McSvcHost/mcsvhost10.ini
$1/McSvcHost/mcsvhost_10_files.txt
$1/McSvcHost/mcsvhost_10_regkeylist.txt
$1/McSvcHost/project.info
$1/Mpf/MPFP_FileList.txt
$1/Mpf/MPFP_RegKeyList.txt
$1/Mpf/MPFP_RegKeyList11.txt
$1/Mpf/MPFP_RegKeyList13.txt
$1/Mpf/MPFP_RegKeyList_NetBTDependency.txt
$1/Mpf/depend.ini
$1/Mpf/firesvc.exe
.exe windows:6 windows x86 arch:x86

df4ddaa445e637b13b0e771e0fec6ffc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

58:7c:d2:1a:05:d3:4d:3d:df:aa:91:28:52:1c:f4:fc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/07/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:b5:bf:84:3d:bc:40:c9:a7:41:be:2e:f6:05:5c:8c:c6:27:ee:79:00:8a:1e:df:13:2e:32:4c:04:8e:39:67
Signer

Actual PE Digest

29:b5:bf:84:3d:bc:40:c9:a7:41:be:2e:f6:05:5c:8c:c6:27:ee:79:00:8a:1e:df:13:2e:32:4c:04:8e:39:67

Digest Algorithm

sha256

PE Digest Matches

true

aa:74:aa:aa:06:92:df:ff:d6:f1:76:05:1c:d9:a0:f4:fe:42:f8:e1
Signer

Actual PE Digest

aa:74:aa:aa:06:92:df:ff:d6:f1:76:05:1c:d9:a0:f4:fe:42:f8:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildEngineSpace\Temp\739ccb56-46ea-4790-92db-afe0e861e6af\build\Win32\Release\firesvc.pdb

Imports

kernel32

HeapFree
GetModuleFileNameW
InitializeCriticalSectionEx
GetSystemDirectoryW
HeapSize
GetLastError
DeleteFileW
HeapReAlloc
RaiseException
LoadLibraryW
HeapAlloc
DecodePointer
GetProcAddress
MoveFileExW
DeleteCriticalSection
GetProcessHeap
FreeLibrary
CopyFileW
GetModuleHandleW
LoadLibraryExW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileType
SetStdHandle
GetStringTypeW
CreateFileW

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/Mpf/firesvc64.exe
.exe windows:6 windows x64 arch:x64

8476af8211a6be9d7ded394f65a4ed52

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

58:7c:d2:1a:05:d3:4d:3d:df:aa:91:28:52:1c:f4:fc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/07/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:61:ce:f1:3f:a6:01:ac:6d:2c:17:bc:c4:75:f1:c2:c4:8d:45:6f:d6:56:4b:c6:dd:2a:37:2d:f5:68:04:c4
Signer

Actual PE Digest

0e:61:ce:f1:3f:a6:01:ac:6d:2c:17:bc:c4:75:f1:c2:c4:8d:45:6f:d6:56:4b:c6:dd:2a:37:2d:f5:68:04:c4

Digest Algorithm

sha256

PE Digest Matches

true

4c:3a:db:5b:b6:fa:6a:2e:24:74:56:03:5b:29:5d:13:ea:ae:f1:57
Signer

Actual PE Digest

4c:3a:db:5b:b6:fa:6a:2e:24:74:56:03:5b:29:5d:13:ea:ae:f1:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\BuildEngineSpace\Temp\739ccb56-46ea-4790-92db-afe0e861e6af\UNIQUE_BUILDFOLDER_1\build\x64\Release\firesvc.pdb

Imports

kernel32

HeapFree
GetModuleFileNameW
InitializeCriticalSectionEx
GetSystemDirectoryW
HeapSize
GetLastError
DeleteFileW
HeapReAlloc
RaiseException
LoadLibraryW
HeapAlloc
GetProcAddress
MoveFileExW
DeleteCriticalSection
GetProcessHeap
FreeLibrary
CopyFileW
GetModuleHandleW
LoadLibraryExW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileType
SetStdHandle
GetStringTypeW
CreateFileW

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/Mpf/master.ini
$1/Mpf/mpf11.ini
$1/Mpf/mpf13.ini
$1/Mpf/mpfp.ini
$1/Mpf/mpfp1.ini
$1/Mpf/mpfp2.ini
$1/Mpf/mpfpcu.ini
$1/Mpf/mpfpcu1.ini
$1/Mpf/msc.ini
$1/Mpf/msc1.ini
$1/Mpf/project.info
$1/MpfCleanUP.wse
$1/NMC/master.ini
$1/NMC/nmc.ini
$1/NMC/nmc10.ini
$1/NMC/nmc_10_files.txt
$1/NMC/nmc_10_regkeylist.txt
$1/NMC/project.info
$1/PCB/pcb.ini
$1/PCB/pcb1.ini
$1/PEF/RegKeyList.txt
$1/PEF/pef.ini
$1/PEF/pef1.ini
$1/RESIDUE/RegKeyList_ForceRemove.txt
$1/RESIDUE/RegKeyList_ResidueSVC.txt
$1/RESIDUE/RegKeyList_ResidueSVC_wss.txt
$1/RESIDUE/RegKeyList_Trace.txt
$1/RESIDUE/residue.ini
$1/RESIDUE/residueflist.txt
$1/RESIDUE/residuesvc.ini
$1/RedirSvc/RedirSvc1.ini
$1/RedirSvc/RedirSvc_uninst.ini
$1/RedirSvc/RegKeyList_RedirSvc1.txt
$1/RedirSvc/depend.ini
$1/RedirSvc/master.ini
$1/Remediation/remedi.ini
$1/Remediation/remedi8.ini
$1/SafeConnect/FileList.txt
$1/SafeConnect/RegKeyList.txt
$1/SafeConnect/SafeConnect.ini
$1/SafeConnect/SafeConnect10.ini
$1/SafeConnect/clean_safeconnect.bat
$1/SafeConnect/master.ini
$1/SafeFamily/MFSY.ini
$1/SafeFamily/MFSY1.ini
$1/Silent_VsCleanUP.wse
$1/StartCleanup.bat
$1/StartCleanupDebug.bat
$1/StopServices/stopservices.ini
$1/StopServices/stopservices1.ini
$1/Sustainability/RegKeyList.txt
$1/Sustainability/Sustainability.ini
$1/Sustainability/Sustainability1.ini
$1/Symlink/RegKeyList.txt
$1/Symlink/Symlink.ini
$1/Symlink/Symlink10.ini
$1/Symlink/master.ini
$1/TrueKey/BCARegKeyList.txt
$1/TrueKey/CSPRegKeyList.txt
$1/TrueKey/ITARegKeyList.txt
$1/TrueKey/TrueKey.ini
$1/TrueKey/TrueKey1.ini
$1/TrueKey/TrueKeyRegKeyList.txt
$1/TrueKey/YAP.ini
$1/TrueKey/YAP1.ini
$1/TrueKey/YapRegKeyList.txt
$1/VS/Casper/2.6/32/installer.exe
.exe windows:5 windows x86 arch:x86

84423f4d61c24fb9e63b80494ec26f2c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:31:7b:bb:44:20:e2:d0:e3:6e:25:12:81:93:97:c4
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/04/2016, 00:00

Not After

05/04/2019, 23:59

Subject

CN=Intel Corporation,OU=ISecG Enterprise,O=Intel Corporation,POSTALCODE=95054,STREET=FM1-110+STREET=2200 Mission College Blvd,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

24/04/2015, 21:46

Not After

24/04/2018, 21:46

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0d:da:27:ee:02:19:10:c8:8f:06:02:db:9c:74:6a:18:4f:c0:d3:9c:47:3e:49:eb:a3:22:ce:41:52:a3:ae:ab
Signer

Actual PE Digest

0d:da:27:ee:02:19:10:c8:8f:06:02:db:9c:74:6a:18:4f:c0:d3:9c:47:3e:49:eb:a3:22:ce:41:52:a3:ae:ab

Digest Algorithm

sha256

PE Digest Matches

true

c9:fe:b4:3c:5e:55:07:9d:a3:8a:4b:b2:69:fe:ae:14:d9:36:88:cd
Signer

Actual PE Digest

c9:fe:b4:3c:5e:55:07:9d:a3:8a:4b:b2:69:fe:ae:14:d9:36:88:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_655005\BUILD\update\av_solution\release\installer.pdb

Imports

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ntdll

VerSetConditionMask
RtlUnwind

kernel32

lstrlenW
SetEndOfFile
EncodePointer
GetCPInfo
IsDebuggerPresent
HeapReAlloc
CreateThread
ExitThread
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
AreFileApisANSI
HeapSize
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetStartupInfoW
FlushFileBuffers
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
VerifyVersionInfoW
GetFileAttributesExW
GetFullPathNameW
GetProcessHeap
HeapFree
HeapAlloc
ExpandEnvironmentStringsW
GetModuleFileNameW
OutputDebugStringW
FormatMessageA
GetSystemInfo
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileA
GetOverlappedResult
WriteFile
CreateNamedPipeA
ConnectNamedPipe
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemDirectoryA
LoadLibraryA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentThread
GetExitCodeThread
CreateEventA
LoadLibraryExA
InterlockedExchange
ExitProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetFileSizeEx
MultiByteToWideChar
CreateFileW
ReadFile
InterlockedDecrement
GetVersion
IsWow64Process
IsProcessorFeaturePresent
GetVersionExW
GetCurrentProcess
GetModuleHandleA
GetTickCount
SetErrorMode
GetCommandLineW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
LockResource
Process32FirstW
MoveFileW
GetExitCodeProcess
SizeofResource
CopyFileW
OpenProcess
WaitForSingleObject
CreateProcessW
LoadResource
FindResourceW
GetDriveTypeW
CloseHandle
OpenEventW
FindNextFileW
CreateEventW
FindClose
Sleep
FindFirstFileW
GetLongPathNameW
GetModuleHandleW
DeleteFileW
WideCharToMultiByte
GetPrivateProfileStringW
LoadLibraryExW
GetNativeSystemInfo
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalFree
DeleteCriticalSection
DecodePointer
LocalAlloc
GetProcAddress
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary
GetModuleHandleExW

psapi

GetModuleFileNameExW

user32

wsprintfW
GetSystemMetrics

advapi32

RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EnumerateTraceGuids
StartTraceW
EnableTrace
ControlTraceW
QueryServiceConfigW
GetServiceDisplayNameW
ChangeServiceConfigW
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAccessDeniedAceEx
FreeSid
AllocateAndInitializeSid
InitializeAcl
QueryServiceObjectSecurity
AddAccessAllowedAceEx
SetServiceObjectSecurity
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
CopySid
GetTokenInformation
CryptExportKey
CryptGenKey
CryptGetKeyParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
RegCreateKeyExA
RegDeleteKeyA
ImpersonateLoggedOnUser
RevertToSelf
CryptAcquireContextA
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptDeriveKey
CryptSetKeyParam
CryptDecrypt
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumValueW
ControlService
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
TraceEvent

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHFileOperationW
ord165

shlwapi

SHDeleteKeyW
PathGetDriveNumberW
PathIsNetworkPathW
PathIsRelativeW

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromString
StringFromCLSID
CoCreateGuid
StringFromGUID2
CoCreateInstance

ws2_32

WSACleanup
closesocket
getsockopt
setsockopt
gethostname
ioctlsocket
send
gethostbyaddr
recv
WSASetLastError
__WSAFDIsSet
select
shutdown
WSAStringToAddressA
WSAStartup
getservbyname
inet_ntoa
gethostbyname
inet_addr
WSAEnumNetworkEvents
WSAGetLastError
connect
getservbyport
WSACreateEvent
WSACloseEvent
WSAEventSelect
ntohl
ntohs
htonl
htons
socket

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
VariantInit
SysAllocString
VariantClear

wintrust

WinVerifyTrust

crypt32

CertNameToStrA
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertSetCertificateContextProperty
CertGetNameStringA
CertFindChainInStore
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertGetIssuerCertificateFromStore
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CertCreateCertificateContext
CryptVerifyMessageSignature
CertVerifySubjectCertificateContext
CryptMsgClose

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/Casper/2.6/32/mfeavsinst.xml
$1/VS/Casper/2.6/64/installer.exe
.exe windows:5 windows x64 arch:x64

fd2a15696a4d0c9fe9dbe0c56ea446cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:31:7b:bb:44:20:e2:d0:e3:6e:25:12:81:93:97:c4
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/04/2016, 00:00

Not After

05/04/2019, 23:59

Subject

CN=Intel Corporation,OU=ISecG Enterprise,O=Intel Corporation,POSTALCODE=95054,STREET=FM1-110+STREET=2200 Mission College Blvd,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf
Certificate

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Not Before

30/05/2014, 16:35

Not After

17/03/2021, 18:33

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:a1:1e:74:fc:0b:87:54:58:0f:50:95:4c:47:c9:4e:67:75:4f:28
Certificate

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Not Before

24/04/2015, 21:46

Not After

24/04/2018, 21:46

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:E892-D055-162F+OU=Thales TSS ESN:E892-D055-162F,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:50:38:69:36:46:d0:24:86:ed:8d:b7:12:c2:a8:0a:e8:fb:29:42:98:a0:8a:6f:a1:f6:c1:09:67:1b:fe:06
Signer

Actual PE Digest

11:50:38:69:36:46:d0:24:86:ed:8d:b7:12:c2:a8:0a:e8:fb:29:42:98:a0:8a:6f:a1:f6:c1:09:67:1b:fe:06

Digest Algorithm

sha256

PE Digest Matches

true

60:65:15:65:5d:48:e4:be:34:9f:2f:b3:39:25:08:81:96:ed:67:ea
Signer

Actual PE Digest

60:65:15:65:5d:48:e4:be:34:9f:2f:b3:39:25:08:81:96:ed:67:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_655006\BUILD\update\av_solution\amd64rel\installer.pdb

Imports

setupapi

SetupOpenInfFileW
SetupCloseInfFile
SetupInstallServicesFromInfSectionW

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ntdll

RtlUnwindEx
VerSetConditionMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader

kernel32

SetEndOfFile
EncodePointer
GetCPInfo
IsDebuggerPresent
HeapReAlloc
CreateThread
ExitThread
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
AreFileApisANSI
lstrlenW
GetModuleHandleExW
HeapSize
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetStartupInfoW
FlushFileBuffers
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
VerifyVersionInfoW
GetFileAttributesExW
GetFullPathNameW
GetCurrentProcess
GetProcessHeap
HeapFree
ExpandEnvironmentStringsW
HeapAlloc
GetModuleFileNameW
OutputDebugStringW
FormatMessageA
GetSystemInfo
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileA
GetOverlappedResult
WriteFile
CreateNamedPipeA
ConnectNamedPipe
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemDirectoryA
LoadLibraryA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentThread
GetExitCodeThread
CreateEventA
LoadLibraryExA
ExitProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetFileSizeEx
MultiByteToWideChar
CreateFileW
ReadFile
GetVersion
IsProcessorFeaturePresent
GetVersionExW
GetModuleHandleA
GetTickCount
SetErrorMode
GetCommandLineW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
LockResource
Process32FirstW
MoveFileW
GetExitCodeProcess
SizeofResource
CopyFileW
OpenProcess
WaitForSingleObject
CreateProcessW
LoadResource
FindResourceW
GetDriveTypeW
CloseHandle
OpenEventW
FindNextFileW
CreateEventW
FindClose
Sleep
FindFirstFileW
GetLongPathNameW
GetModuleHandleW
DeleteFileW
WideCharToMultiByte
GetPrivateProfileStringW
LoadLibraryExW
GetNativeSystemInfo
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalFree
DeleteCriticalSection
DecodePointer
LocalAlloc
GetProcAddress
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary

psapi

GetModuleFileNameExW

user32

GetSystemMetrics
wsprintfW

advapi32

RegCloseKey
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EnumerateTraceGuids
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
StartTraceW
EnableTrace
ControlTraceW
QueryServiceConfigW
GetServiceDisplayNameW
ChangeServiceConfigW
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAccessDeniedAceEx
FreeSid
AllocateAndInitializeSid
InitializeAcl
QueryServiceObjectSecurity
AddAccessAllowedAceEx
SetServiceObjectSecurity
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
CopySid
GetTokenInformation
CryptExportKey
CryptGenKey
CryptGetKeyParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
RegCreateKeyExA
RegDeleteKeyA
ImpersonateLoggedOnUser
RevertToSelf
CryptAcquireContextA
CryptImportKey
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDeriveKey
CryptSetKeyParam
CryptDecrypt
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumValueW
ControlService
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
TraceEvent

shell32

SHFileOperationW
SHGetFolderPathW
ord165
SHCreateDirectoryExW

shlwapi

PathIsNetworkPathW
PathIsRelativeW
SHDeleteKeyW
PathGetDriveNumberW

ole32

StringFromCLSID
CoCreateGuid
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoInitialize
CoUninitialize

ws2_32

gethostbyaddr
getservbyport
WSASetLastError
WSACleanup
closesocket
getsockopt
setsockopt
socket
ioctlsocket
send
recv
getservbyname
connect
WSACreateEvent
select
shutdown
WSACloseEvent
WSAEventSelect
ntohl
ntohs
htonl
htons
gethostname
WSAStringToAddressA
gethostbyname
inet_ntoa
WSAStartup
inet_addr
WSAEnumNetworkEvents
WSAGetLastError
__WSAFDIsSet

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
VariantInit
SysAllocString
VariantClear

wintrust

WinVerifyTrust

crypt32

CryptVerifyMessageSignature
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertNameToStrA
CertFreeCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertSetCertificateContextProperty
CertGetNameStringA
CertFindChainInStore
CertOpenSystemStoreA
CertCreateCertificateContext
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/Casper/2.6/64/mfeavsinst.xml
$1/VS/Casper/latest/32/mfeamcin.exe
.exe windows:5 windows x86 arch:x86

5553d42d102df7e3ac059fba9ed73bf2

Code Sign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

da:6e:88:13:1a:19:8f:bf:d5:1d:94:e5:e4:c3:1a:bc:2a:d3:a8:f4:4b:01:4a:49:a0:12:58:62:c4:47:f8:77
Signer

Actual PE Digest

da:6e:88:13:1a:19:8f:bf:d5:1d:94:e5:e4:c3:1a:bc:2a:d3:a8:f4:4b:01:4a:49:a0:12:58:62:c4:47:f8:77

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_693644\BUILD\update\av_solution\release\mfeamcin.pdb

Imports

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ntdll

VerSetConditionMask
RtlUnwind

kernel32

lstrlenW
SetEndOfFile
EncodePointer
GetCPInfo
IsDebuggerPresent
HeapReAlloc
CreateThread
ExitThread
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
AreFileApisANSI
HeapSize
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetStartupInfoW
FlushFileBuffers
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
GetFileAttributesExW
GetFullPathNameW
GetProcessHeap
HeapFree
HeapAlloc
GetModuleFileNameW
OutputDebugStringW
ExpandEnvironmentStringsW
FormatMessageA
GetSystemInfo
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileA
GetOverlappedResult
WriteFile
CreateNamedPipeA
ConnectNamedPipe
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemDirectoryA
LoadLibraryA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentThread
GetExitCodeThread
CreateEventA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryExA
InterlockedExchange
VerifyVersionInfoW
ExitProcess
SetLastError
GetFileSizeEx
MultiByteToWideChar
CreateFileW
ReadFile
InterlockedIncrement
InterlockedDecrement
GetVersion
IsWow64Process
IsProcessorFeaturePresent
GetVersionExW
GetCurrentProcess
GetModuleHandleA
GetTickCount
SetErrorMode
GetCommandLineW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
LockResource
Process32FirstW
MoveFileW
GetExitCodeProcess
SizeofResource
CopyFileW
OpenProcess
WaitForSingleObject
CreateProcessW
LoadResource
FindResourceW
GetDriveTypeW
CloseHandle
OpenEventW
FindNextFileW
CreateEventW
FindClose
Sleep
FindFirstFileW
GetLongPathNameW
GetModuleHandleW
DeleteFileW
WideCharToMultiByte
GetPrivateProfileStringW
LoadLibraryExW
GetNativeSystemInfo
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalFree
DeleteCriticalSection
DecodePointer
LocalAlloc
GetProcAddress
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary
GetModuleHandleExW

psapi

GetModuleFileNameExW

user32

wsprintfW
GetSystemMetrics

advapi32

RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EnumerateTraceGuids
StartTraceW
EnableTrace
ControlTraceW
QueryServiceConfigW
GetServiceDisplayNameW
ChangeServiceConfigW
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAccessDeniedAceEx
FreeSid
AllocateAndInitializeSid
InitializeAcl
QueryServiceObjectSecurity
AddAccessAllowedAceEx
SetServiceObjectSecurity
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
CopySid
GetTokenInformation
CryptExportKey
CryptGenKey
CryptGetKeyParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
RegCreateKeyExA
RegDeleteKeyA
ImpersonateLoggedOnUser
RevertToSelf
CryptAcquireContextA
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptDeriveKey
CryptSetKeyParam
CryptDecrypt
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumValueW
ControlService
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
TraceEvent

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHFileOperationW
ord165

shlwapi

SHDeleteKeyW
PathGetDriveNumberW
PathIsNetworkPathW
PathIsRelativeW

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromString
StringFromCLSID
CoCreateGuid
StringFromGUID2
CoCreateInstance

ws2_32

WSACleanup
closesocket
getsockopt
setsockopt
gethostname
ioctlsocket
send
gethostbyaddr
recv
WSASetLastError
__WSAFDIsSet
select
shutdown
WSAStringToAddressA
WSAStartup
getservbyname
inet_ntoa
gethostbyname
inet_addr
WSAEnumNetworkEvents
WSAGetLastError
connect
getservbyport
WSACreateEvent
WSACloseEvent
WSAEventSelect
ntohl
ntohs
htonl
htons
socket

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
VariantInit
SysAllocString
VariantClear

wintrust

WinVerifyTrust

crypt32

CertNameToStrA
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertSetCertificateContextProperty
CertGetNameStringA
CertFindChainInStore
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertGetIssuerCertificateFromStore
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CertCreateCertificateContext
CryptVerifyMessageSignature
CertVerifySubjectCertificateContext
CryptMsgClose

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/Casper/latest/32/mfeavsinst.xml
$1/VS/Casper/latest/32/mfeavsinst_lam.xml
$1/VS/Casper/latest/64/mfeamcin.exe
.exe windows:5 windows x64 arch:x64

23f9e55579a0736567178af39e5045af

Code Sign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:3e:df:89:bc:e0:57:b8:ba:f4:23:a6:21:ea:93:bb:c7:18:f2:ec:24:6d:ea:83:98:20:27:a8:d6:03:71:10
Signer

Actual PE Digest

33:3e:df:89:bc:e0:57:b8:ba:f4:23:a6:21:ea:93:bb:c7:18:f2:ec:24:6d:ea:83:98:20:27:a8:d6:03:71:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_693645\BUILD\update\av_solution\amd64rel\mfeamcin.pdb

Imports

setupapi

SetupOpenInfFileW
SetupCloseInfFile
SetupInstallServicesFromInfSectionW

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ntdll

RtlUnwindEx
VerSetConditionMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader

kernel32

lstrlenW
SetEndOfFile
EncodePointer
GetCPInfo
IsDebuggerPresent
HeapReAlloc
CreateThread
ExitThread
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
AreFileApisANSI
GetModuleHandleExW
HeapSize
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetStartupInfoW
FlushFileBuffers
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
GetFileAttributesExW
GetFullPathNameW
GetCurrentProcess
GetProcessHeap
HeapFree
HeapAlloc
GetModuleFileNameW
ExpandEnvironmentStringsW
OutputDebugStringW
FormatMessageA
GetSystemInfo
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileA
GetOverlappedResult
WriteFile
CreateNamedPipeA
ConnectNamedPipe
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemDirectoryA
LoadLibraryA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentThread
GetExitCodeThread
CreateEventA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryExA
VerifyVersionInfoW
ExitProcess
SetLastError
GetFileSizeEx
MultiByteToWideChar
CreateFileW
ReadFile
GetVersion
IsProcessorFeaturePresent
GetVersionExW
GetModuleHandleA
GetTickCount
SetErrorMode
GetCommandLineW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
LockResource
Process32FirstW
MoveFileW
GetExitCodeProcess
SizeofResource
CopyFileW
OpenProcess
WaitForSingleObject
CreateProcessW
LoadResource
FindResourceW
GetDriveTypeW
CloseHandle
OpenEventW
FindNextFileW
CreateEventW
FindClose
Sleep
FindFirstFileW
GetLongPathNameW
GetModuleHandleW
DeleteFileW
WideCharToMultiByte
GetPrivateProfileStringW
LoadLibraryExW
GetNativeSystemInfo
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
SetCurrentDirectoryW
GetCurrentDirectoryW
LocalFree
DeleteCriticalSection
DecodePointer
LocalAlloc
GetProcAddress
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary

psapi

GetModuleFileNameExW

user32

GetSystemMetrics
wsprintfW

advapi32

RegCloseKey
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EnumerateTraceGuids
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
StartTraceW
EnableTrace
ControlTraceW
QueryServiceConfigW
GetServiceDisplayNameW
ChangeServiceConfigW
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAccessDeniedAceEx
FreeSid
AllocateAndInitializeSid
InitializeAcl
QueryServiceObjectSecurity
AddAccessAllowedAceEx
SetServiceObjectSecurity
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
CopySid
GetTokenInformation
CryptExportKey
CryptGenKey
CryptGetKeyParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
RegCreateKeyExA
RegDeleteKeyA
ImpersonateLoggedOnUser
RevertToSelf
CryptAcquireContextA
CryptImportKey
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDeriveKey
CryptSetKeyParam
CryptDecrypt
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumValueW
ControlService
QueryServiceStatus
StartServiceW
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
TraceEvent

shell32

SHFileOperationW
SHGetFolderPathW
ord165
SHCreateDirectoryExW

shlwapi

PathIsNetworkPathW
PathIsRelativeW
SHDeleteKeyW
PathGetDriveNumberW

ole32

StringFromCLSID
CoCreateGuid
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoInitialize
CoUninitialize

ws2_32

gethostbyaddr
getservbyport
WSASetLastError
WSACleanup
closesocket
getsockopt
setsockopt
socket
ioctlsocket
send
recv
getservbyname
connect
WSACreateEvent
select
shutdown
WSACloseEvent
WSAEventSelect
ntohl
ntohs
htonl
htons
gethostname
WSAStringToAddressA
gethostbyname
inet_ntoa
WSAStartup
inet_addr
WSAEnumNetworkEvents
WSAGetLastError
__WSAFDIsSet

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocStringByteLen
SysFreeString
VariantInit
SysAllocString
VariantClear

wintrust

WinVerifyTrust

crypt32

CryptVerifyMessageSignature
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertNameToStrA
CertFreeCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertSetCertificateContextProperty
CertGetNameStringA
CertFindChainInStore
CertOpenSystemStoreA
CertCreateCertificateContext
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/Casper/latest/64/mfeavsinst.xml
$1/VS/Casper/latest/64/mfeavsinst_lam.xml
$1/VS/ReleaseNotes.txt
$1/VS/SdOASMon.dll
.dll windows:4 windows x86 arch:x86

4f8e1fb56e1432421c0c907cb7a0e180

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\McAfee\CVS\sunsrc\build\win32\release\SdOASMon.pdb

Imports

wintrust

WinVerifyTrust

kernel32

Sleep
SystemTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
LoadLibraryA
GetSystemDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrlenA
GetLastError
GetACP
GetLocaleInfoA
GetThreadLocale
GetCurrentProcessId
FindClose
FindFirstFileA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
GetShortPathNameA
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
VirtualAlloc
WriteFile
HeapSize
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegDeleteKeyW
CloseServiceHandle
RegCloseKey
RegSetValueExW
RegOpenKeyExW

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString

Exports

Exports

SdOASMon

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/10.16/MCAFEECERTS/McAfeeCerts.xml
.xml
$1/VS/VSCore/10.16/Packages/vscore/vtpinfo.exe
.exe windows:6 windows x86 arch:x86

75e8380a42d85ebe52b19873a1bfecd5

Code Sign

7b:52:e6:04:46:ec:9b:17:8e:92:9f:7c:36:15:4a:eb
Certificate

Issuer

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Not Before

25/02/2021, 00:00

Not After

25/02/2022, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,POSTALCODE=95054,STREET=2821 Mission College Blvd,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

27/10/2014, 00:00

Not After

26/10/2024, 23:59

Subject

CN=McAfee Code Signing CA 2,O=McAfee\, Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/07/2015, 21:03

Not After

22/07/2025, 21:03

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:89:c4:13:24:8e:63:d3:a2:78:b4:ea
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/07/2019, 18:58

Not After

12/07/2022, 18:58

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:f3:8d:02:55:ab:48:e2:d7:27:50:2f:66:b2:59:9f:26:d2:12:05:2e:67:10:71:f5:9f:8f:e6:16:8f:e7:59
Signer

Actual PE Digest

35:f3:8d:02:55:ab:48:e2:d7:27:50:2f:66:b2:59:9f:26:d2:12:05:2e:67:10:71:f5:9f:8f:e6:16:8f:e7:59

Digest Algorithm

sha256

PE Digest Matches

true

35:f3:8d:02:55:ab:48:e2:d7:27:50:2f:66:b2:59:9f:26:d2:12:05:2e:67:10:71:f5:9f:8f:e6:16:8f:e7:59
Signer

Actual PE Digest

35:f3:8d:02:55:ab:48:e2:d7:27:50:2f:66:b2:59:9f:26:d2:12:05:2e:67:10:71:f5:9f:8f:e6:16:8f:e7:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\workspace\McAfee\Corporate_Products\MPT\NA\SYSCORE\build_job\syscore\build\release_2019\bin\Release\vtpinfo.pdb

Imports

kernel32

GetCurrentDirectoryW
CreateFileW
GetFileSize
ReadFile
WriteFile
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
CreateProcessW
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
FormatMessageA
FormatMessageW
LoadLibraryW
FileTimeToSystemTime
GetStdHandle
GetEnvironmentVariableW
SetEnvironmentVariableW
SetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
DuplicateHandle
SetErrorMode
CreatePipe
SetEvent
ResetEvent
CreateEventW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateThread
GetCurrentThreadId
GetSystemTimeAsFileTime
CopyFileExW
MoveFileW
MoveFileExW
GetComputerNameW
SystemTimeToFileTime
FreeConsole
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
MultiByteToWideChar
GetSystemDirectoryW
GetModuleHandleW
GetCurrentThread
DeviceIoControl
GetCurrentProcessId
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
WriteConsoleW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
HeapSize
HeapReAlloc
DecodePointer

Sections

.text
Size: 449KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/4.6/32/DAInstall.exe
.exe windows:4 windows x86 arch:x86

860d02467a6068edaa9db0fe37c0dbd9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:56:77:88:88:64:6b:ed:da:6a:d6:d4:2e:04:b1:e0:1a:30:54:5f
Signer

Actual PE Digest

ab:56:77:88:88:64:6b:ed:da:6a:d6:d4:2e:04:b1:e0:1a:30:54:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_440197\BUILD\VSCore\release\DAInstall.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
iswdigit
qsort
printf
towlower
?terminate@@YAXXZ
_controlfp
towupper
realloc
memmove
wcschr
_errno
_wfopen
fwprintf
vfwprintf
fclose
vwprintf
time
localtime
_wcsnicmp
swscanf
wprintf
_wcslwr
iswspace
wcsrchr
_snwprintf
_wcsicmp
wcsstr
wcsncpy
memset
malloc
free
memcpy

kernel32

GetLocalTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
OutputDebugStringA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
DebugBreak
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
TerminateProcess
GetTickCount
GetCurrentThreadId
MoveFileW
CreateDirectoryW
SetErrorMode
CreateFileW
CloseHandle
DeviceIoControl
LocalFree
LocalAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetLastError
GetCurrentProcess
GetVersionExW
GetShortPathNameW
GetSystemTimeAsFileTime
MoveFileExW
RemoveDirectoryW
GetModuleFileNameW
LoadLibraryExW
FindClose
FindFirstFileW
WriteFile
SetEndOfFile
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
ReadFile
GetFileSize
FindNextFileW
lstrlenW
GetSystemDirectoryW
DeleteFileW
GetFileAttributesW
Sleep
CopyFileW
FormatMessageW
InterlockedDecrement
InterlockedCompareExchange
InterlockedIncrement

user32

LoadStringW
wsprintfW

advapi32

OpenProcessToken
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
GetTokenInformation
SetSecurityDescriptorOwner
RegGetKeySecurity
RegOpenKeyExW
RegSetKeySecurity
RegCloseKey
TraceEvent
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetLengthSid
GetAclInformation
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
FreeSid
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

shell32

SHGetFolderPathW

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/4.6/32/mfeapfk.inf
$1/VS/VSCore/4.6/32/mfeavfk.inf
$1/VS/VSCore/4.6/32/mfebopk.inf
$1/VS/VSCore/4.6/32/mfefirek.inf
$1/VS/VSCore/4.6/32/mfehidin.exe
.exe windows:5 windows x86 arch:x86

bccdaa9888134cf1ca42259ef1662433

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:a3:78:a5:cd:09:9f:e8:2c:60:f9:9d:74:23:31:e4:e7:c5:5d:6a
Signer

Actual PE Digest

4b:a3:78:a5:cd:09:9f:e8:2c:60:f9:9d:74:23:31:e4:e7:c5:5d:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_442000\BUILD\SYSCore\release\mfehidin.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupOpenInfFileW
SetupInitDefaultQueueCallbackEx
SetupFindNextLine
SetupCopyOEMInfW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupGetStringFieldW

cabinet

ord23
ord20
ord22

kernel32

InterlockedIncrement
InterlockedDecrement
SetErrorMode
GetStdHandle
SetEndOfFile
CreateDirectoryW
GetCurrentDirectoryW
MoveFileW
CopyFileExW
GetTickCount
TerminateProcess
GetSystemInfo
GetVersionExA
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
DebugBreak
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetCurrentDirectoryA
VirtualProtect
IsBadReadPtr
HeapAlloc
HeapFree
RtlUnwind
DeleteFileA
HeapReAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetModuleFileNameA
GetProcessHeap
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
LCMapStringA
MultiByteToWideChar
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTempPathA
GetTempFileNameA
GetFileAttributesExA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleW
GetWindowsDirectoryW
ReadFile
GetEnvironmentVariableW
GetLocalTime
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetSystemDirectoryW
GetModuleFileNameW
Sleep
CreateProcessW
WaitForSingleObject
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
WideCharToMultiByte
GetFullPathNameA
DeviceIoControl
CloseHandle
CreateFileW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
SetConsoleCtrlHandler
GetCurrentProcess
GetExitCodeProcess
SetCurrentDirectoryW
GetFullPathNameW
CreateMutexW
LoadLibraryExW
GetVersionExW
CreateDirectoryA
SetFilePointer
WriteFile
LCMapStringW
CreateFileA
GetVersion
OutputDebugStringA

advapi32

CryptReleaseContext
GetExplicitEntriesFromAclW
IsValidSid
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
RegEnumValueW
CryptAcquireContextW
CryptGetProvParam
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ControlService
QueryServiceStatus
StartServiceW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
CloseServiceHandle
StartTraceW
EnableTrace
ControlTraceW
TraceEvent
GetSecurityDescriptorDacl

shell32

SHGetFolderPathW

shlwapi

SHGetValueW
SHSetValueW
wnsprintfW
SHDeleteKeyW

ole32

CoInitialize
CoCreateInstance

oleaut32

VariantInit
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen

crypt32

CertOpenStore
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptVerifyDetachedMessageSignature

sfc

SfcIsFileProtected

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/4.6/32/mfehidk.inf
$1/VS/VSCore/4.6/32/mfendisk.inf
$1/VS/VSCore/4.6/32/mfendisk_m.inf
$1/VS/VSCore/4.6/32/mfenlfk.inf
$1/VS/VSCore/4.6/32/mfetdi2k.inf
$1/VS/VSCore/4.6/32/mfewfpk.inf
$1/VS/VSCore/4.6/32/vscore.xml
$1/VS/VSCore/4.6/64/DAInstall.exe
.exe windows:5 windows x64 arch:x64

297a7bdeb8d026c12612658f8de81871

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:a9:61:d8:82:1f:a4:51:bf:ab:13:19:32:d2:a7:6d:3d:2d:82:3f
Signer

Actual PE Digest

52:a9:61:d8:82:1f:a4:51:bf:ab:13:19:32:d2:a7:6d:3d:2d:82:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_440197\BUILD\VSCore\amd64rel\DAInstall.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
?terminate@@YAXXZ
iswdigit
qsort
towlower
wcschr
towupper
realloc
memmove
_wfopen
fwprintf
vfwprintf
fclose
vwprintf
time
localtime
_wcsnicmp
swscanf
wprintf
_wcslwr
iswspace
wcsrchr
_snwprintf
_wcsicmp
wcsstr
wcsncpy
memset
malloc
free
__C_specific_handler
memcpy

kernel32

GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
DebugBreak
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TerminateProcess
GetTickCount
GetCurrentThreadId
MoveFileW
GetFileAttributesW
SetErrorMode
CreateFileW
CloseHandle
DeviceIoControl
LocalFree
LocalAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetLastError
GetCurrentProcess
GetVersionExW
GetShortPathNameW
GetSystemTimeAsFileTime
MoveFileExW
GetModuleFileNameW
LoadLibraryExW
FindClose
FindFirstFileW
SetFilePointer
ReadFile
lstrlenW
GetSystemDirectoryW
DeleteFileW
Sleep
CopyFileW
FormatMessageW
GetLocalTime
FindNextFileW

user32

LoadStringW
wsprintfW

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
GetTokenInformation
SetSecurityDescriptorOwner
RegGetKeySecurity
RegOpenKeyExW
RegSetKeySecurity
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
FreeSid
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceEvent

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bldvar
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/4.6/64/mfeapfk.inf
$1/VS/VSCore/4.6/64/mfeavfk.inf
$1/VS/VSCore/4.6/64/mfefirek.inf
$1/VS/VSCore/4.6/64/mfehidin.exe
.exe windows:5 windows x64 arch:x64

5299e86d38a7ee05cf1ca5a5d99733db

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:7a:9d:07:25:4c:17:66:6b:16:62:f7:72:5c:ca:52:5a:e4:7c:31
Signer

Actual PE Digest

49:7a:9d:07:25:4c:17:66:6b:16:62:f7:72:5c:ca:52:5a:e4:7c:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_442000\BUILD\SYSCore\amd64rel\mfehidin.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupOpenInfFileW
SetupInitDefaultQueueCallbackEx
SetupFindFirstLineW
SetupDefaultQueueCallbackW
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupCloseInfFile
SetupFindNextLine
SetupCopyOEMInfW
SetupGetStringFieldW

cabinet

ord23
ord20
ord22

kernel32

SetLastError
SetErrorMode
GetStdHandle
SetEndOfFile
CreateDirectoryW
GetCurrentDirectoryW
MoveFileW
CopyFileExW
GetTickCount
TerminateProcess
GetSystemInfo
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DebugBreak
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetVersion
GetTempPathA
VirtualProtect
IsBadReadPtr
HeapAlloc
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
DeleteFileA
HeapReAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
ExitProcess
GetModuleFileNameA
HeapSetInformation
HeapCreate
GetProcessHeap
OutputDebugStringA
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlPcToFileHeader
HeapSize
GetCPInfo
GetOEMCP
GetTimeZoneInformation
LCMapStringW
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeW
GetConsoleCP
GetConsoleMode
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetTempFileNameA
GetFileAttributesExA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleW
GetWindowsDirectoryW
ReadFile
GetEnvironmentVariableW
GetLocalTime
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
GetSystemWow64DirectoryW
GetSystemDirectoryW
GetModuleFileNameW
Sleep
CreateProcessW
WaitForSingleObject
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
WideCharToMultiByte
GetFullPathNameA
DeviceIoControl
CloseHandle
CreateFileW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
GetCurrentProcess
GetExitCodeProcess
SetConsoleCtrlHandler
SetCurrentDirectoryW
GetFullPathNameW
CreateMutexW
LoadLibraryExW
GetVersionExW
CreateDirectoryA
SetFilePointer
WriteFile
CreateFileA
GetACP
GetCurrentDirectoryA

advapi32

CryptReleaseContext
GetExplicitEntriesFromAclW
IsValidSid
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
RegEnumValueW
CryptAcquireContextW
CryptGetProvParam
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ControlService
QueryServiceStatus
StartServiceW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
CloseServiceHandle
StartTraceW
EnableTrace
ControlTraceW
TraceEvent
GetSecurityDescriptorDacl

shell32

SHGetFolderPathW

shlwapi

SHSetValueW
SHDeleteKeyW
wnsprintfW
SHGetValueW

ole32

CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VariantInit
SysStringLen

crypt32

CertOpenStore
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptVerifyDetachedMessageSignature

sfc

SfcIsFileProtected

Sections

.text
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bldvar
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/4.6/64/mfehidk.inf
$1/VS/VSCore/4.6/64/mfendisk.inf
$1/VS/VSCore/4.6/64/mfendisk_m.inf
$1/VS/VSCore/4.6/64/mfenlfk.inf
$1/VS/VSCore/4.6/64/mfetdi2k.inf
$1/VS/VSCore/4.6/64/mfewfpk.inf
$1/VS/VSCore/4.6/64/vscore.xml
$1/VS/VSCore/4.6/64/x86/DAInstall.exe
.exe windows:4 windows x86 arch:x86

860d02467a6068edaa9db0fe37c0dbd9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:c9:8b:9a:dd:1b:30:09:09:83:cb:e5:3b:9e:64:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/03/2014, 00:00

Not After

04/03/2017, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:56:77:88:88:64:6b:ed:da:6a:d6:d4:2e:04:b1:e0:1a:30:54:5f
Signer

Actual PE Digest

ab:56:77:88:88:64:6b:ed:da:6a:d6:d4:2e:04:b1:e0:1a:30:54:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_440197\BUILD\VSCore\release\DAInstall.pdb

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
iswdigit
qsort
printf
towlower
?terminate@@YAXXZ
_controlfp
towupper
realloc
memmove
wcschr
_errno
_wfopen
fwprintf
vfwprintf
fclose
vwprintf
time
localtime
_wcsnicmp
swscanf
wprintf
_wcslwr
iswspace
wcsrchr
_snwprintf
_wcsicmp
wcsstr
wcsncpy
memset
malloc
free
memcpy

kernel32

GetLocalTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
OutputDebugStringA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
DebugBreak
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
TerminateProcess
GetTickCount
GetCurrentThreadId
MoveFileW
CreateDirectoryW
SetErrorMode
CreateFileW
CloseHandle
DeviceIoControl
LocalFree
LocalAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetLastError
GetCurrentProcess
GetVersionExW
GetShortPathNameW
GetSystemTimeAsFileTime
MoveFileExW
RemoveDirectoryW
GetModuleFileNameW
LoadLibraryExW
FindClose
FindFirstFileW
WriteFile
SetEndOfFile
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
ReadFile
GetFileSize
FindNextFileW
lstrlenW
GetSystemDirectoryW
DeleteFileW
GetFileAttributesW
Sleep
CopyFileW
FormatMessageW
InterlockedDecrement
InterlockedCompareExchange
InterlockedIncrement

user32

LoadStringW
wsprintfW

advapi32

OpenProcessToken
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
GetTokenInformation
SetSecurityDescriptorOwner
RegGetKeySecurity
RegOpenKeyExW
RegSetKeySecurity
RegCloseKey
TraceEvent
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetLengthSid
GetAclInformation
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
FreeSid
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags

shell32

SHGetFolderPathW

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/5.6/32/cfwids.inf
$1/VS/VSCore/5.6/32/lam10.xml
$1/VS/VSCore/5.6/32/mfeaack.inf
$1/VS/VSCore/5.6/32/mfeavfk.inf
$1/VS/VSCore/5.6/32/mfedisk.inf
$1/VS/VSCore/5.6/32/mfeelamk.inf
$1/VS/VSCore/5.6/32/mfefirek.inf
$1/VS/VSCore/5.6/32/mfehidin.exe
.exe windows:5 windows x86 arch:x86

fb1b21acb2a6c089014f2a644b8a18c9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

58:7c:d2:1a:05:d3:4d:3d:df:aa:91:28:52:1c:f4:fc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/07/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d6:cd:2b:d9:af:26:02:43:41:de:bd:22:dd:0a:91:0e:1a:ef:94:d6:02:6b:8d:05:53:0d:41:e2:57:56:07:49
Signer

Actual PE Digest

d6:cd:2b:d9:af:26:02:43:41:de:bd:22:dd:0a:91:0e:1a:ef:94:d6:02:6b:8d:05:53:0d:41:e2:57:56:07:49

Digest Algorithm

sha256

PE Digest Matches

true

24:17:78:88:91:10:08:fb:8d:dd:8e:16:41:5f:e4:96:e1:10:63:28
Signer

Actual PE Digest

24:17:78:88:91:10:08:fb:8d:dd:8e:16:41:5f:e4:96:e1:10:63:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_682131\BUILD\SYSCore\release\mfehidin.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
CertCompareCertificate
CertEnumCertificatesInStore
CertAddSerializedElementToStore
CertSerializeCertificateStoreElement
CertCreateCertificateContext
CryptVerifyMessageSignature
CryptVerifyDetachedMessageSignature
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertDeleteCertificateFromStore

setupapi

SetupDefaultQueueCallbackW
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW
SetupFindNextLine
SetupCopyOEMInfW
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupCloseInfFile
SetupInitDefaultQueueCallbackEx

cabinet

ord23
ord20
ord22

kernel32

CreateDirectoryW
SetFilePointer
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
SetCurrentDirectoryW
GetLocalTime
GetEnvironmentVariableW
MultiByteToWideChar
SetLastError
InterlockedIncrement
InterlockedDecrement
SetErrorMode
GetStdHandle
SetEndOfFile
SetEnvironmentVariableW
MoveFileW
CopyFileExW
SetEvent
GetSystemInfo
GetVersionExA
InterlockedCompareExchange
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileAttributesExW
GetSystemWindowsDirectoryW
GetExitCodeProcess
GetLogicalDriveStringsW
DeleteCriticalSection
GetFileSizeEx
InitializeCriticalSection
VirtualProtect
IsBadReadPtr
TlsAlloc
TlsSetValue
TlsGetValue
DebugBreak
TransactNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
HeapFree
HeapAlloc
RtlUnwind
RaiseException
DeleteFileA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapDestroy
CreateMutexW
VirtualFree
VirtualAlloc
GetModuleHandleA
CreateFileA
GetModuleFileNameA
TlsFree
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
HeapSize
WideCharToMultiByte
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
LCMapStringA
LCMapStringW
LoadLibraryExA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetCurrentProcess
GetModuleHandleW
CreateFileW
DeviceIoControl
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
CloseHandle
Sleep
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
GetFullPathNameW
LoadLibraryW
LocalAlloc
LocalFree
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetLastError
GetVersionExW
GetCurrentDirectoryA
GetTempPathA
GetFileAttributesExA
GetTempFileNameA
FileTimeToDosDateTime
GetWindowsDirectoryW
ReadFile
FlushFileBuffers
GetCurrentProcessId
SetConsoleCtrlHandler
GetCommandLineW
FindResourceW
LoadResource
SizeofResource
LockResource
GetTempPathW
WriteFile
ExitProcess
ReleaseMutex
EnterCriticalSection
HeapCreate

user32

wsprintfW

advapi32

EnableTrace
QueryServiceStatusEx
CryptCreateHash
ControlTraceW
EnumerateTraceGuids
GetSecurityDescriptorDacl
GetExplicitEntriesFromAclW
IsValidSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
EqualSid
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptGetProvParam
AllocateAndInitializeSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
ControlService
RegQueryInfoKeyW
RegEnumKeyExW
ChangeServiceConfig2W
CreateServiceW
ChangeServiceConfigW
RegFlushKey
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCreateKeyW
RegSetValueW
OpenServiceW
QueryServiceStatus
StartServiceW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
TraceEvent
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
StartTraceW
CryptReleaseContext
QueryAllTracesW

shell32

SHGetFolderPathW

shlwapi

SHDeleteKeyW
wnsprintfW
SHSetValueW
SHGetValueW

ole32

StringFromGUID2
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysStringLen
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantInit
GetErrorInfo
SysFreeString

wintrust

CryptCATClose
WinVerifyTrust

sfc

SfcIsFileProtected

rpcrt4

UuidCreate
UuidFromStringW

Sections

.text
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/5.6/32/mfehidk.inf
$1/VS/VSCore/5.6/32/mfendisk.inf
$1/VS/VSCore/5.6/32/mfendisk_m.inf
$1/VS/VSCore/5.6/32/mfenlfk.inf
$1/VS/VSCore/5.6/32/mferkdet.inf
$1/VS/VSCore/5.6/32/mfetdi2k.inf
$1/VS/VSCore/5.6/32/mfewfpk.inf
$1/VS/VSCore/5.6/32/vscore.xml
$1/VS/VSCore/5.6/64/cfwids.inf
$1/VS/VSCore/5.6/64/lam10.xml
$1/VS/VSCore/5.6/64/mfeaack.inf
$1/VS/VSCore/5.6/64/mfeavfk.inf
$1/VS/VSCore/5.6/64/mfedisk.inf
$1/VS/VSCore/5.6/64/mfeelamk.inf
$1/VS/VSCore/5.6/64/mfefirek.inf
$1/VS/VSCore/5.6/64/mfehidin.exe
.exe windows:5 windows x64 arch:x64

bf6af4149f148069d7947907354f712a

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

58:7c:d2:1a:05:d3:4d:3d:df:aa:91:28:52:1c:f4:fc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21/07/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c6:b0:22:77:29:ff:f2:83:7e:42:0a:e5:cc:2f:30:b6:c4:9b:fb:69:b3:50:72:15:be:83:ba:f7:0c:09:83:e0
Signer

Actual PE Digest

c6:b0:22:77:29:ff:f2:83:7e:42:0a:e5:cc:2f:30:b6:c4:9b:fb:69:b3:50:72:15:be:83:ba:f7:0c:09:83:e0

Digest Algorithm

sha256

PE Digest Matches

true

4f:cf:c9:ac:83:fb:54:8a:88:95:49:77:d1:18:d8:12:fe:75:a9:d4
Signer

Actual PE Digest

4f:cf:c9:ac:83:fb:54:8a:88:95:49:77:d1:18:d8:12:fe:75:a9:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_682131\BUILD\SYSCore\amd64rel\mfehidin.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

crypt32

CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
CertCompareCertificate
CertEnumCertificatesInStore
CertAddSerializedElementToStore
CertSerializeCertificateStoreElement
CertCreateCertificateContext
CryptVerifyMessageSignature
CryptVerifyDetachedMessageSignature
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertDeleteCertificateFromStore

setupapi

SetupInitDefaultQueueCallbackEx
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW
SetupFindNextLine
SetupCopyOEMInfW
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupCloseInfFile
SetupDefaultQueueCallbackW

cabinet

ord23
ord20
ord22

kernel32

CreateFileA
CreateDirectoryW
SetFilePointer
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
SetCurrentDirectoryW
GetLocalTime
GetEnvironmentVariableW
MultiByteToWideChar
SetLastError
SetErrorMode
GetStdHandle
SetEndOfFile
SetEnvironmentVariableW
MoveFileW
CopyFileExW
SetEvent
GetSystemInfo
GetVersionExA
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileAttributesExW
GetSystemWindowsDirectoryW
EnterCriticalSection
GetLogicalDriveStringsW
CreateMutexW
DeleteCriticalSection
GetFileSizeEx
InitializeCriticalSection
VirtualProtect
IsBadReadPtr
DebugBreak
TransactNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
DeleteFileA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
RtlCaptureContext
HeapSetInformation
HeapCreate
GetCurrentDirectoryA
GetModuleFileNameA
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
HeapSize
WideCharToMultiByte
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
SetStdHandle
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetCurrentProcess
GetModuleHandleW
CreateFileW
DeviceIoControl
GetSystemWow64DirectoryW
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
CloseHandle
Sleep
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
GetFullPathNameW
LoadLibraryW
LocalAlloc
LocalFree
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetLastError
GetVersionExW
GetTempPathA
GetTempFileNameA
FileTimeToLocalFileTime
GetFileAttributesExA
FileTimeToDosDateTime
GetWindowsDirectoryW
ReadFile
FlushFileBuffers
GetCurrentProcessId
SetConsoleCtrlHandler
GetCommandLineW
FindResourceW
LoadResource
SizeofResource
LockResource
GetTempPathW
WriteFile
ReleaseMutex
ExitProcess
GetExitCodeProcess
RtlVirtualUnwind

user32

wsprintfW

advapi32

EnableTrace
QueryServiceStatusEx
CryptCreateHash
ControlTraceW
EnumerateTraceGuids
GetSecurityDescriptorDacl
GetExplicitEntriesFromAclW
IsValidSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
EqualSid
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
AllocateAndInitializeSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
ControlService
RegQueryInfoKeyW
RegEnumKeyExW
ChangeServiceConfig2W
CreateServiceW
ChangeServiceConfigW
RegFlushKey
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegCreateKeyW
RegSetValueW
OpenServiceW
QueryServiceStatus
StartServiceW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
TraceEvent
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
StartTraceW
CryptReleaseContext
CryptGetProvParam
QueryAllTracesW

shell32

SHGetFolderPathW

shlwapi

SHDeleteKeyW
wnsprintfW
SHSetValueW
SHGetValueW

ole32

StringFromGUID2
CoInitialize
CoCreateInstance

oleaut32

GetErrorInfo
SysAllocString
SysStringLen
VarBstrCat
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantInit
SysFreeString

wintrust

CryptCATClose
WinVerifyTrust

sfc

SfcIsFileProtected

rpcrt4

UuidFromStringW
UuidCreate

Sections

.text
Size: 600KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bldvar
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/5.6/64/mfehidk.inf
$1/VS/VSCore/5.6/64/mfendisk.inf
$1/VS/VSCore/5.6/64/mfendisk_m.inf
$1/VS/VSCore/5.6/64/mfenlfk.inf
$1/VS/VSCore/5.6/64/mferkdet.inf
$1/VS/VSCore/5.6/64/mfetdi2k.inf
$1/VS/VSCore/5.6/64/mfewfpk.inf
$1/VS/VSCore/5.6/64/vscore.xml
$1/VS/VSCore/latest/32/cfwids.inf
$1/VS/VSCore/latest/32/guids.xml
$1/VS/VSCore/latest/32/mfeaack.inf
$1/VS/VSCore/latest/32/mfeaacsk.inf
$1/VS/VSCore/latest/32/mfeavfk.inf
$1/VS/VSCore/latest/32/mfebopk.inf
$1/VS/VSCore/latest/32/mfeclftk.inf
$1/VS/VSCore/latest/32/mfedisk.inf
$1/VS/VSCore/latest/32/mfeelamk.inf
$1/VS/VSCore/latest/32/mfefirek.inf
$1/VS/VSCore/latest/32/mfehck.inf
$1/VS/VSCore/latest/32/mfehidin.exe
.exe windows:5 windows x86 arch:x86

69bcfb17baab5873df0176492121369b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BUILD_956429\BUILD\SYSCore\release\mfehidin.pdb

Imports

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupDefaultQueueCallbackW
SetupInitDefaultQueueCallbackEx
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW
SetupFindNextLine
SetupCopyOEMInfW

psapi

GetModuleFileNameExW

kernel32

FileTimeToLocalFileTime
GetFileAttributesExA
GetTempFileNameA
GetTempPathA
GetCurrentDirectoryA
CreateFileA
CreateDirectoryW
SetFilePointer
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetCurrentDirectoryW
GetLocalTime
GetEnvironmentVariableW
InterlockedCompareExchange
CreateThread
InterlockedExchange
LoadLibraryA
RaiseException
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
SetErrorMode
GetStdHandle
SetEndOfFile
SetEnvironmentVariableW
MoveFileW
CopyFileExW
CreateEventW
SetEvent
SetFilePointerEx
GetSystemInfo
QueryDosDeviceW
GetLogicalDriveStringsW
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
FileTimeToDosDateTime
VirtualProtect
IsBadReadPtr
TlsAlloc
TlsSetValue
TlsGetValue
DebugBreak
TransactNamedPipe
SetNamedPipeHandleState
RtlUnwind
HeapFree
HeapAlloc
GetFileType
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteFileA
GetVersionExA
HeapReAlloc
TlsFree
UnhandledExceptionFilter
GetWindowsDirectoryW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleA
ExitProcess
GetModuleFileNameA
OutputDebugStringA
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetProcessHeap
SetStdHandle
SetHandleCount
GetStartupInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetTickCount
LCMapStringA
LCMapStringW
LoadLibraryExA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualQuery
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadFile
FlushFileBuffers
GetCurrentProcessId
SetConsoleCtrlHandler
GetCommandLineW
CreateMutexW
FindResourceW
LoadResource
SizeofResource
LockResource
GetTempPathW
WriteFile
ReleaseMutex
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleExW
GetExitCodeProcess
InitializeCriticalSection
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
GetCurrentProcess
DeviceIoControl
GetSystemDirectoryW
GetModuleHandleW
CreateFileW
WaitNamedPipeW
OpenProcess
TerminateProcess
CreateProcessW
WaitForSingleObject
CloseHandle
Sleep
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
GetFullPathNameW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
SetLastError
SetUnhandledExceptionFilter

user32

wsprintfW

advapi32

GetExplicitEntriesFromAclW
QueryServiceConfig2W
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptGetProvParam
CryptReleaseContext
StartTraceW
EnableTrace
QueryAllTracesW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
EqualSid
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
GetSidIdentifierAuthority
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeleteService
ChangeServiceConfig2W
CreateServiceW
ChangeServiceConfigW
ControlService
RegQueryInfoKeyW
RegEnumKeyExW
RegFlushKey
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
QueryServiceConfigW
QueryServiceStatus
StartServiceW
RegCreateKeyW
RegSetValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
TraceEvent
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorDacl
EnumerateTraceGuids
ControlTraceW
IsValidSid

shell32

SHGetFolderPathW

shlwapi

SHDeleteKeyW
SHSetValueW
wnsprintfW
SHGetValueW

ole32

StringFromGUID2
CoTaskMemFree
CoInitialize
CoCreateInstance
StringFromCLSID
CoCreateGuid

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocString
SysStringLen
VarBstrCat
VariantInit
GetErrorInfo
VariantClear
SysAllocStringByteLen
SysFreeString

rpcrt4

UuidCreate
UuidFromStringW

Sections

.text
Size: 668KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/latest/32/mfehidk.inf
$1/VS/VSCore/latest/32/mfenlfk.inf
$1/VS/VSCore/latest/32/mfeplk.inf
$1/VS/VSCore/latest/32/mferkdet.inf
$1/VS/VSCore/latest/32/mfetdi2k.inf
$1/VS/VSCore/latest/32/mfewfpk.inf
$1/VS/VSCore/latest/32/wss.xml
$1/VS/VSCore/latest/64/cfwids.inf
$1/VS/VSCore/latest/64/guids.xml
$1/VS/VSCore/latest/64/mfeaack.inf
$1/VS/VSCore/latest/64/mfeaacsk.inf
$1/VS/VSCore/latest/64/mfeavfk.inf
$1/VS/VSCore/latest/64/mfebopk.inf
$1/VS/VSCore/latest/64/mfeclftk.inf
$1/VS/VSCore/latest/64/mfedisk.inf
$1/VS/VSCore/latest/64/mfeelamk.inf
$1/VS/VSCore/latest/64/mfefirek.inf
$1/VS/VSCore/latest/64/mfehck.inf
$1/VS/VSCore/latest/64/mfehidin.exe
.exe windows:5 windows x64 arch:x64

fd1b976ad30b27d287a57d9c833435c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BUILD_956429\BUILD\SYSCore\amd64rel\mfehidin.pdb

Imports

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupDefaultQueueCallbackW
SetupInitDefaultQueueCallbackEx
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW
SetupFindNextLine
SetupCopyOEMInfW

psapi

GetModuleFileNameExW

kernel32

FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileAttributesExA
GetTempFileNameA
GetTempPathA
GetCurrentDirectoryA
CreateFileA
CreateDirectoryW
SetFilePointer
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetCurrentDirectoryW
GetLocalTime
GetEnvironmentVariableW
CreateThread
LoadLibraryA
RaiseException
MultiByteToWideChar
SetErrorMode
GetStdHandle
SetEndOfFile
SetEnvironmentVariableW
MoveFileW
CopyFileExW
CreateEventW
SetEvent
SetFilePointerEx
GetSystemInfo
QueryDosDeviceW
GetLogicalDriveStringsW
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
IsBadReadPtr
DebugBreak
TransactNamedPipe
SetNamedPipeHandleState
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
HeapAlloc
RtlPcToFileHeader
GetFileType
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteFileA
GetVersionExW
HeapReAlloc
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
HeapCreate
ExitProcess
GetModuleFileNameA
OutputDebugStringA
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetProcessHeap
SetStdHandle
SetHandleCount
GetStartupInfoW
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
LCMapStringW
GetStringTypeW
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
CompareStringW
SetEnvironmentVariableA
ReadFile
FlushFileBuffers
GetCurrentProcessId
SetConsoleCtrlHandler
GetCommandLineW
CreateMutexW
FindResourceW
LoadResource
SizeofResource
LockResource
GetTempPathW
WriteFile
ReleaseMutex
DeleteCriticalSection
EnterCriticalSection
GetModuleHandleExW
LeaveCriticalSection
GetExitCodeProcess
InitializeCriticalSection
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
GetCurrentProcess
DeviceIoControl
GetSystemWow64DirectoryW
GetSystemDirectoryW
GetModuleHandleW
CreateFileW
WaitNamedPipeW
OpenProcess
TerminateProcess
CreateProcessW
WaitForSingleObject
CloseHandle
Sleep
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
GetFullPathNameW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
SetLastError
VirtualProtect
DecodePointer

user32

wsprintfW

advapi32

GetExplicitEntriesFromAclW
QueryServiceConfig2W
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptGetProvParam
CryptReleaseContext
StartTraceW
EnableTrace
QueryAllTracesW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
EqualSid
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
GetSidIdentifierAuthority
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeleteService
ChangeServiceConfig2W
CreateServiceW
ChangeServiceConfigW
ControlService
RegQueryInfoKeyW
RegEnumKeyExW
RegFlushKey
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegSetValueExW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
QueryServiceConfigW
QueryServiceStatus
StartServiceW
RegCreateKeyW
RegSetValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
TraceEvent
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorDacl
EnumerateTraceGuids
ControlTraceW
IsValidSid

shell32

SHGetFolderPathW

shlwapi

SHDeleteKeyW
SHSetValueW
wnsprintfW
SHGetValueW

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoCreateGuid
StringFromCLSID
StringFromGUID2

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysStringLen
VarBstrCat
SysAllocStringLen
VariantInit
GetErrorInfo
VariantClear
SysFreeString

rpcrt4

UuidFromStringW
UuidCreate

Sections

.text
Size: 807KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bldvar
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/VSCore/latest/64/mfehidk.inf
$1/VS/VSCore/latest/64/mfenlfk.inf
$1/VS/VSCore/latest/64/mfeplk.inf
$1/VS/VSCore/latest/64/mferkdet.inf
$1/VS/VSCore/latest/64/mfetdi2k.inf
$1/VS/VSCore/latest/64/mfewfpk.inf
$1/VS/VSCore/latest/64/wss.xml
$1/VS/casper.bat
$1/VS/casper64.bat
$1/VS/filelist.txt
$1/VS/flist11.txt
$1/VS/flist12.txt
$1/VS/flist14.txt
$1/VS/flist16.txt
$1/VS/lockdown.reg
$1/VS/master.ini
$1/VS/mcvs.ini
$1/VS/mcvs10.ini
$1/VS/mcvs11.ini
$1/VS/mcvs12.ini
$1/VS/mcvs13.ini
$1/VS/mcvs14.ini
$1/VS/mcvs16.ini
$1/VS/mcvs9.ini
$1/VS/mcvsoins.dll
.dll windows:6 windows x86 arch:x86

5492ab88a0bf60da32b538518009bc92

Code Sign

63:85:a6:08:fb:d8:58:eb:44:71:a0:22:cc:e7:6b:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/08/2016, 00:00

Not After

21/07/2019, 23:59

Subject

CN=McAfee\, Inc.,OU=Engineering,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

80:da:e2:16:e6:08:94:60:d8:8f:a1:a3:48:61:91:eb:14:5d:d2:b8:b1:9f:dc:71:9a:5b:ca:9a:28:59:02:34
Signer

Actual PE Digest

80:da:e2:16:e6:08:94:60:d8:8f:a1:a3:48:61:91:eb:14:5d:d2:b8:b1:9f:dc:71:9a:5b:ca:9a:28:59:02:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\BuildEngineSpace\Temp\e22c8013-6a61-4d99-8e83-e66c2d3030d9\build\Win32\Release\mcvsoins.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

GetTickCount
GetExitCodeProcess
CreateProcessW
GetModuleHandleW
GetProcAddress
LocalAlloc
LocalFree
lstrlenW
VerSetConditionMask
GetCurrentProcess
GetCurrentProcessId
VerifyVersionInfoW
GetSystemDirectoryW
LoadLibraryExW
OpenEventW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
VirtualQuery
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
GetLastError
RaiseException
DecodePointer
GetProcessHeap
HeapSize
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
HeapReAlloc
HeapAlloc
HeapDestroy
FreeLibrary
WideCharToMultiByte
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
SetFilePointer
WriteFile
OutputDebugStringW
ReleaseMutex
CreateMutexW
GetCurrentThreadId
GetLocalTime
FindResourceExW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
EncodePointer
SetEndOfFile
MultiByteToWideChar
GetStringTypeW
FormatMessageW
QueryPerformanceCounter
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
InitializeSListHead
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetACP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
ReadFile
ReadConsoleW
WritePrivateProfileStringW
WritePrivateProfileStructW
GetCurrentDirectoryW
CreateDirectoryW

advapi32

TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExA
RegSetValueExA
RegSetValueExW
RegSetKeySecurity
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegNotifyChangeKeyValue
RegGetKeySecurity
RegFlushKey
RegEnumKeyExW
RegEnumKeyExA
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
FreeSid
RegisterTraceGuidsW

shell32

SHGetFolderPathW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CLSIDFromString
StringFromGUID2

shlwapi

SHDeleteKeyW
PathRemoveFileSpecW
PathAppendW

Exports

Exports

CSISAllocateMemory
CSISAttachSettingHooks
CSISPreInstallHook
CSISStartSoftwareHook
OnFreeLibrary
PreInstall
StartApplication
_CSISAllocateMemory@8
_CSISAttachSettingHooks@36
_CSISPreInstallHook@4
_CSISStartSoftwareHook@4

Sections

.text
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/VS/project.info
$1/VS/reglist.txt
$1/VS/rlist11.txt
$1/VS/rlist12.txt
$1/VS/rlist12_64.txt
$1/VS/rlist13.txt
$1/VS/rlist14.txt
$1/VS/rlist16.txt
$1/VS/vscore.bat
$1/VS/vscore64.bat
$1/VS/vscore64wss.bat
$1/VS/vscorewss.bat
$1/VUL/RegKeyList1.txt
$1/VUL/vul.ini
$1/VUL/vul1.ini
$1/VsCleanUP.wse
$1/WPS/RegKeyList.txt
$1/WPS/drivers/22.6/x64/mc-sec-installer.exe
.exe windows:6 windows x64 arch:x64

9f9a361806f030c8f794019ee6d4bfe1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\workspace\finch_SDK_Goldfinch_Build_master\_sdk\x64Release\mc-sec-installer.pdb

Imports

kernel32

IsDebuggerPresent
GetCurrentProcess
CreateFileW
GetCurrentThread
GetDriveTypeW
InstallELAMCertificateInfo
CopyFileW
SetDefaultDllDirectories
MultiByteToWideChar
LoadLibraryExA
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
GetVolumeNameForVolumeMountPointW
ReleaseMutex
GetCurrentThreadId
GetFileAttributesW
WaitForSingleObject
FindClose
GetModuleHandleExW
ReleaseSemaphore
FindNextFileW
SetLastError
HeapFree
CreateSemaphoreExW
FindFirstFileW
GetLogicalDrives
GetVolumeInformationW
DeleteFileW
GetModuleFileNameA
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
FindFirstFileExW
GetFileAttributesExW
GetFinalPathNameByHandleW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
LocalFree
FormatMessageA
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
RtlUnwind

advapi32

OpenSCManagerW
OpenThreadToken
OpenServiceW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
RegCloseKey
CloseServiceHandle
TraceMessage
ChangeServiceConfig2W
RegCreateKeyExW
DeleteService
ControlService
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExW
RegGetValueW
RegCreateKeyW

fltlib

FilterConnectCommunicationPort
FilterUnload
FilterSendMessage

setupapi

SetupGetLineTextW
SetupOpenInfFileW
SetupGetTargetPathW

Sections

.text
Size: 501KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/WPS/drivers/22.6/x64/mc-sec-kernel.dll
.dll windows:6 windows x64 arch:x64

d907c1a13487205564ddfdc0705664c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\finch_SDK_Goldfinch_Build_master\_sdk\x64Release\mc-sec-kernel.pdb

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtOpenFile
NtQueryInformationProcess
NtQuerySystemInformation

kernel32

GetLastError
LocalAlloc
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
FormatMessageW
LocalFree
GetCurrentProcess
GetVolumeNameForVolumeMountPointW
WaitForSingleObject
GetVolumePathNameW
GetModuleHandleExW
ReleaseSemaphore
SetLastError
LoadLibraryW
FreeLibrary
HeapFree
CreateSemaphoreExW
GetFinalPathNameByHandleW
ReleaseMutex
CreateFileW
GetModuleFileNameA
WriteConsoleW
GetConsoleMode
SleepEx
CancelIo
GetFileInformationByHandleEx
GetModuleFileNameW
WaitForMultipleObjectsEx
OpenProcess
CreateEventW
SetEvent
ResetEvent
OpenThread
UnmapViewOfFile
MapViewOfFile
GetConsoleOutputCP
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetFileInformationByHandle
QueryFullProcessImageNameW
K32GetMappedFileNameW
GetVolumeInformationByHandleW
WriteFile
GetCurrentThreadId
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
FormatMessageA
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetACP
SetFilePointerEx
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeThread
GetNativeSystemInfo
LCMapStringEx
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
InterlockedFlushSList
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
HeapReAlloc
GetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
IsValidCodePage

fltlib

FilterSendMessage
FilterConnectCommunicationPort
FilterGetMessage

advapi32

RegisterTraceGuidsW
CloseServiceHandle
OpenSCManagerW
ControlService
StartServiceW
OpenServiceW
QueryServiceStatusEx
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
TraceMessage

rpcrt4

UuidFromStringW

dbghelp

ImageNtHeader

Exports

Exports

mfesec_get_cache_api
mfesec_get_control_api
mfesec_get_scanner_api
mfesec_get_secured_api
mfesec_get_stealth_io_api
mfesec_initialize
mfesec_release_cache_api
mfesec_release_control_api
mfesec_release_scanner_api
mfesec_release_secured_api
mfesec_release_stealth_io_api

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/WPS/drivers/22.6/x64/mc-sec-unprotector.exe
.exe windows:6 windows x64 arch:x64

46e02cb2ae8c872cb31a5f468f92796f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\B\T\3cba438f-d177-4426-9b38-0008ccd24f19\UBF_1\build\x64\Release\mc-sec-unprotector.pdb

Imports

kernel32

FreeLibrary
SetEndOfFile
GetCurrentProcessId
GetProcAddress
InstallELAMCertificateInfo
CloseHandle
LoadLibraryA
SetEvent
CreateFileA
GetLastError
GetCurrentThreadId
WaitForSingleObject
CreateEventA
OpenEventA
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
WideCharToMultiByte
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
WaitForSingleObjectEx
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
RtlUnwind

advapi32

CreateServiceA
StartServiceCtrlDispatcherA
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
ChangeServiceConfig2A
OpenServiceA

Sections

.text
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/WPS/drivers/22.6/x64/mfeelam.cat
$1/WPS/drivers/22.6/x64/mfeelam.inf
$1/WPS/drivers/22.6/x64/mfeelam.sys
.sys windows:10 windows x64 arch:x64

2b0f9e7fc89b2ec3f03107852730df4c

Code Sign

33:00:00:04:45:1c:57:99:61:a7:a9:78:10:00:00:00:00:04:45
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:26

Not After

01/09/2022, 18:26

Subject

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:00:1e:d1:ce:67:2c:54:02:3c:b9:54:21:04:14:57:30:91:58:de:dd:ad:ba:da:33:23:82:e8:24:54:f7:df
Signer

Actual PE Digest

65:00:1e:d1:ce:67:2c:54:02:3c:b9:54:21:04:14:57:30:91:58:de:dd:ad:ba:da:33:23:82:e8:24:54:f7:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\finch_SDK_Goldfinch_Build_master\_sdk\x64Release\mfeelam.pdb

Imports

ntoskrnl.exe

InitSafeBootMode
IoUnregisterBootDriverCallback
RtlCopyUnicodeString
DbgPrintEx
IoRegisterBootDriverCallback

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 562B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/WPS/drivers/22.6/x64/mfesec.cat
$1/WPS/drivers/22.6/x64/mfesec.inf
$1/WPS/drivers/22.6/x64/mfesec.sys
.sys windows:10 windows x64 arch:x64

6834ae0b62218f7e729bbdada1e846d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\finch_SDK_Goldfinch_Build_master\_sdk\x64Release\mfesec.pdb

Imports

fltmgr.sys

FltCreateCommunicationPort
FltCloseCommunicationPort
FltCloseClientPort
FltSendMessage
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltCancellableWaitForSingleObject
FltCreateSectionForDataScan
FltCloseSectionForDataScan
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltDeleteInstanceContext
FltDeleteStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltGetSectionContext
FltReleaseContext
FltObjectReference
FltObjectDereference
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltAllocateCallbackData
FltFreeCallbackData
FltFindExtraCreateParameter
FltGetEcpListFromCallbackData
FltIsEcpFromUserMode
FltCreateFileEx2
FltQueryInformationFile
FltSetInformationFile
FltClose
FltGetVolumeFromName
FltGetVolumeInstanceFromName
FltGetVolumeFromFileObject
FltGetVolumeGuidName
FltRegisterForDataScan
FltIsDirectory
FltCancelFileOpen

ntoskrnl.exe

MmGetSystemRoutineAddress
ExAllocatePoolWithTag
RtlCompareMemory
KeAcquireGuardedMutex
KeReleaseGuardedMutex
ExFreePoolWithTag
FsRtlQueryKernelEaFile
FsRtlSetKernelEaFile
__C_specific_handler
KeInitializeGuardedMutex
IoGetCurrentProcess
ObfReferenceObject
KeQueryUnbiasedInterruptTime
ObfDereferenceObject
PsGetCurrentProcessId
KeInitializeEvent
PsGetProcessCreateTimeQuadPart
PsGetThreadId
PsGetThreadProcessId
KeStackAttachProcess
KeUnstackDetachProcess
IoThreadToProcess
ObOpenObjectByPointer
MmSectionObjectType
RtlInitUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
CmUnRegisterCallback
CmRegisterCallbackEx
IoWMIRegistrationControl
PsSetCreateProcessNotifyRoutineEx
IoQueryFullDriverPath
IoGetStackLimits
KeSetEvent
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlEnumerateGenericTable
RtlGetElementGenericTable
RtlIsGenericTableEmpty
PsLookupProcessByProcessId
PsProcessType
RtlCompareUnicodeString
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
RtlEnumerateGenericTableWithoutSplaying
RtlPrefixUnicodeString
ObQueryNameString
ZwClose
KeWaitForSingleObject
ObReferenceObjectByHandle
ZwOpenFile
IoFileObjectType

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/WPS/master.ini
$1/WPS/wps.ini
$1/WPS/wps100.ini
$1/ja_EULA.txt
$1/master.ini
$1/mccertupd.exe
.exe windows:6 windows x86 arch:x86

f37bddbbf5627237eb89a35d82621e0c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:aa:59:dd:71:8c:fb:de:16:3a:b8:21
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/02/2019, 19:41

Not After

26/02/2022, 19:10

Subject

CN=McAfee\, LLC,O=McAfee\, LLC,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:a3:c3:d3:ab:0c:3e:95:36:c5:06:ae
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

26/02/2019, 19:10

Not After

26/02/2022, 19:10

Subject

CN=McAfee\, LLC,O=McAfee\, LLC,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:50:45:dd:95:bb:32:cd:8d:eb:25:48:05:f3:da:54:5b:88:9c:38:d7:21:34:d5:7e:77:fe:75:9b:cb:8b:7e
Signer

Actual PE Digest

74:50:45:dd:95:bb:32:cd:8d:eb:25:48:05:f3:da:54:5b:88:9c:38:d7:21:34:d5:7e:77:fe:75:9b:cb:8b:7e

Digest Algorithm

sha256

PE Digest Matches

true

fa:59:e4:34:b3:e6:31:5c:ed:27:45:66:e5:04:8c:99:f9:e0:35:bf
Signer

Actual PE Digest

fa:59:e4:34:b3:e6:31:5c:ed:27:45:66:e5:04:8c:99:f9:e0:35:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\B\T\a0de46fc-e5d5-41c1-8b01-72792ad5c9dd\UBF_1\build\Win32\Release\McCertUpd.pdb

Imports

wintrust

WinVerifyTrust

kernel32

TlsAlloc
GetCurrentDirectoryW
OutputDebugStringW
GetLastError
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
LocalAlloc
FormatMessageA
LocalFree
DecodePointer
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
SetLastError
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
FindClose
FindFirstFileW
RemoveDirectoryW
WaitForSingleObject
ReleaseMutex
WriteFile
CreateFileW
SetFilePointer
GetFileAttributesW
CreateMutexW
GetLocalTime
GetModuleHandleExW
GetSystemInfo
VirtualProtect
LoadLibraryExA
IsDebuggerPresent
EncodePointer
FormatMessageW
CreateEventW
Sleep
SetEndOfFile
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
MultiByteToWideChar
GetStringTypeW
LCMapStringW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
ExitProcess
GetStdHandle
GetACP
GetFileType
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
ReadFile
ReadConsoleW
CreateDirectoryW
WritePrivateProfileStructW
WritePrivateProfileStringW
lstrlenW
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/mccleanup.exe
.exe windows:6 windows x86 arch:x86

c0c8d102ee9d77fc47d7102011433374

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\B\T\3cba438f-d177-4426-9b38-0008ccd24f19\build\Win32\Release\mccleanup.pdb

Imports

wintrust

WinVerifyTrust

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertGetSubjectCertificateFromStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CryptDecodeObject

advapi32

EventWriteTransfer
EventRegister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
TraceEvent
EventUnregister
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
ChangeServiceConfig2A
CloseServiceHandle
CreateServiceA
OpenSCManagerA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegDeleteValueA
RegDeleteValueW
RegQueryInfoKeyA
ControlService
DeleteService
OpenServiceA
QueryServiceConfigA
QueryServiceStatusEx
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
RegDeleteKeyA
RegGetKeySecurity
RegSetKeySecurity
QueryServiceStatus
StartServiceA
CreateProcessAsUserA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegGetValueA
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegFlushKey
RegNotifyChangeKeyValue
RegSetValueExW

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
VerSetConditionMask
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GetDriveTypeA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
GetLogicalDriveStringsA
VerifyVersionInfoA
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
GetPrivateProfileSectionA
GetFileSizeEx
GetCurrentProcess
GetModuleHandleA
SetStdHandle
CreateFileA
SetFilePointer
WriteFile
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
EnumSystemLocalesW
GetUserDefaultLCID
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
OpenEventA
Sleep
ProcessIdToSessionId
OpenProcess
GetVersionExA
InstallELAMCertificateInfo
IsWow64Process
GetModuleFileNameA
LocalAlloc
LocalFree
IsValidLocale
MultiByteToWideChar
FreeConsole
GetProcessHeap
LCMapStringW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetModuleFileNameExW
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
CreateDirectoryW
DeleteFileA
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetShortPathNameW
GetTempFileNameW
ReadFile
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
GetExitCodeProcess
HeapSize
GetTickCount
GetVersionExW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
CopyFileW
MoveFileA
MoveFileExA
MoveFileExW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetCommandLineW
GetCommandLineA
GetStdHandle
ExitProcess
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetFileType
SetNamedPipeHandleState
WritePrivateProfileStructW
VirtualAlloc
TlsFree
SetLastError
TlsSetValue
GetModuleHandleW
lstrlenW
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
RtlUnwind
InitializeSListHead
GetModuleHandleExW
HeapFree
LoadLibraryW
CreateFileW
DeviceIoControl
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetStartupInfoW
IsDebuggerPresent
QueryFullProcessImageNameW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateThread
GetWindowsDirectoryW
GlobalFindAtomW
SystemTimeToFileTime
SetEnvironmentVariableW
WriteConsoleW
ResetEvent
GetCPInfo
Process32FirstW
Process32NextW
GetFullPathNameW
FormatMessageA
LockFileEx
UnlockFileEx
GlobalAddAtomW
MoveFileW
ReplaceFileW
LCMapStringEx
GetTempFileNameA
EncodePointer
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
GetLocalTime
FormatMessageW
CreateProcessA
WritePrivateProfileStringW
GetLocaleInfoW
WaitNamedPipeA
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
QueryPerformanceCounter
QueryPerformanceFrequency
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
IsProcessorFeaturePresent
FindFirstFileExW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
GetStringTypeW
GetSystemTimeAsFileTime

user32

wsprintfW
WaitForInputIdle
MessageBoxA
CharNextA

shlwapi

SHDeleteKeyA
SHDeleteKeyW
PathCombineA
SHSetValueA
SHGetValueA
PathRemoveExtensionA
PathAddExtensionA
PathFileExistsA
PathRemoveFileSpecW
PathRemoveFileSpecA
PathAppendA
PathAddBackslashA
wnsprintfW
PathFileExistsW
PathFindFileNameA
PathAppendW
PathFindExtensionW
PathStripToRootW
PathRemoveBackslashA
PathStripToRootA
StrTrimA

ole32

CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoInitialize
CoInitializeSecurity
StringFromGUID2
CoInitializeEx
CLSIDFromString
CoUninitialize

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetSpecialFolderPathA
ShellExecuteExA
SHGetKnownFolderPath

oleaut32

SysFreeString
SysStringLen
VariantClear
VariantTimeToSystemTime
VariantInit
SysAllocString
SystemTimeToVariantTime
VariantChangeType
VarUdateFromDate

rpcrt4

UuidCreate

Sections

.text
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/McSplash.bmp
$PLUGINSDIR/McSplash.dll
.dll windows:4 windows x86 arch:x86

53fa9f98975931096a1fdca782458483

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:f0:ed:bf:f2:0c:b8:9b:db:3d:db:f1:9d:74:d2:1a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/09/2006, 00:00

Not After

09/10/2007, 23:59

Subject

CN=McAfee\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IIS,O=McAfee\, Inc.,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\temp\McSplash\Release\McSplash.pdb

Imports

kernel32

CreateEventA
LCMapStringW
LCMapStringA
GetStringTypeW
CreateThread
GetStringTypeA
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetCurrentThreadId
GetModuleFileNameW
WaitForSingleObject
CloseHandle
MultiByteToWideChar
SetEvent
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
WriteFile

user32

MsgWaitForMultipleObjects
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
CreateDialogParamA
UpdateWindow
ShowWindow
GetUpdateRect
BeginPaint
EndPaint
GetDesktopWindow
GetWindowRect
SetWindowPos
DestroyWindow
PostThreadMessageA
LoadImageW

gdi32

SelectObject
BitBlt
DeleteObject
GetObjectA
CreateCompatibleDC

Exports

Exports

hide
show

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3abe302b6d9a1256e6a915429af4ffd2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4Certificate

Extended Key Usages

Key Usages

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5Certificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9Signer

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 106KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 25KB - Virtual size: 24KB

375125cf54c4147129d3f93d93ac06f3

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4Certificate

Extended Key Usages

Key Usages

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5Certificate

Extended Key Usages

Key Usages

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9
Signer

11:3b:b5:54:81:39:74:1f:00:e7:8a:f0:e1:45:c3:89:02:40:8c:13:d5:61:4e:ac:63:16:4c:e4:08:23:72:d9
Signer

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 106KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 25KB - Virtual size: 24KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5
Signer

24:f0:c1:73:cd:b2:2f:52:b1:3f:e6:8d:1c:4f:1e:6c:42:27:5d:29:f7:a4:93:a1:c0:67:b9:75:d6:7b:cf:f5
Signer

.text
Size: 141KB - Virtual size: 141KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 17KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

7d:9e:98:88:d0:f9:7a:54:32:82:7a:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

13:a1:91:c0:eb:27:ae:85:ea:99:d7:29:14:b6:91:e4
Certificate

ca:c1:f1:dd:01:7e:80:f1:2b:4d:17:c1:69:6d:9b:a5
Certificate

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56
Signer

65:66:cb:a9:ab:6e:73:6c:fb:53:ca:41:21:37:27:17:63:d4:39:4d:a2:bd:17:fe:c5:eb:8a:11:fa:63:d0:56
Signer

.text
Size: 122KB - Virtual size: 122KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 6KB - Virtual size: 14KB