ReimagePackage[.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	acprotect
static1/unpack003/$PLUGINSDIR/AccessControl.dll	acprotect
static1/unpack003/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack007/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack009/$PLUGINSDIR/AccessControl.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	upx
static1/unpack003/$PLUGINSDIR/AccessControl.dll	upx
static1/unpack003/$PLUGINSDIR/md5dll.dll	upx
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack007/$PLUGINSDIR/md5dll.dll	upx
static1/unpack009/$PLUGINSDIR/AccessControl.dll	upx

resource
unpack001/$PLUGINSDIR/AccessControl.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/LogEx.dll
unpack003/$PLUGINSDIR/AccessControl.dll
unpack004/out.upx
unpack003/$PLUGINSDIR/ExecDos.dll
unpack003/$PLUGINSDIR/IpConfig.dll
unpack003/$PLUGINSDIR/LogEx.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/WmiInspector.dll
unpack003/$PLUGINSDIR/inetc.dll
unpack003/$PLUGINSDIR/md5dll.dll
unpack005/out.upx
unpack003/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/registry.dll
unpack003/$PLUGINSDIR/stack.dll
unpack003/$PLUGINSDIR/xml.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/WmiInspector.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack006/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/registry.dll
unpack001/$PLUGINSDIR/stack.dll
unpack001/$PLUGINSDIR/xml.dll
unpack001/LZMA.EXE
unpack007/$PLUGINSDIR/ExecDos.dll
unpack007/$PLUGINSDIR/IpConfig.dll
unpack007/$PLUGINSDIR/LogEx.dll
unpack007/$PLUGINSDIR/System.dll
unpack007/$PLUGINSDIR/UserInfo.dll
unpack007/$PLUGINSDIR/WmiInspector.dll
unpack007/$PLUGINSDIR/inetc.dll
unpack007/$PLUGINSDIR/md5dll.dll
unpack008/out.upx
unpack007/$PLUGINSDIR/nsExec.dll
unpack009/$PLUGINSDIR/AccessControl.dll
unpack009/$PLUGINSDIR/ExecDos.dll
unpack009/$PLUGINSDIR/LogEx.dll
unpack009/$PLUGINSDIR/System.dll
unpack009/$PLUGINSDIR/WmiInspector.dll
unpack009/$PLUGINSDIR/inetc.dll
unpack009/$PLUGINSDIR/nsExec.dll
unpack009/$PLUGINSDIR/registry.dll

ReimagePackage.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 4de22f65551da53a761b1e9049abfcfdeddb4f36dfd50503f4ac45a0e4f972a4
MD5 0cf8715cbdee01676d24f4f78c7b431f
SHA1 74989063fd05ffb28d0d705c583c2c6b1e9aef99
SHA512 248e107e97b2c1c1172abcadffee1497fbf8f75a0b343d983cf13410c2c74c6a7bd23f5d5ece32e76b2521b0a1543f4f6b62a4e8e407ba27ce722e2290976327
SSDEEP 196608:pSjaAQ7Z8aVC/xE4hVS930UqN2FItiZESkM8ZCLfsFrrdTM4nGgAU1Q+osH:oOAQaBvWq0QiZH18ZaIr2qG/sH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

56:d3:ff:e9:3e:11:d6:17:ce:23:29:71:e6:c6:df:30:b7:5e:ac:f8:f4:dd:2c:e2:4e:22:40:3d:1e:03:bc:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Mar 24, 2022

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

40:50:ed:4b:fb:88:5d:ac:dd:c9:18:eb:34:13:5b:a6:b3:e5:a7:2c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Mar 24, 2022

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/AccessControl.dll

SHA256 ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac
MD5 65d017ba65785b43720de6c9979a2e8c
SHA1 0aed2846e1b338077bae5a7f756c345a5c90d8a9
SHA512 31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95
SSDEEP 96:18YNfTAJj9KMMVSyPg8uxZAQ/zdVJF/mSsQwV6i8zRRxqBt/FZTIVe7/cIH8ykeO:1XwKMMfPuxJ/zb+b6fR+bZEwywQ9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 1c5fbf918928fbe5e138493c48ec906ffc746269dabacd03853822eadcf917d2
MD5 f247752013a2cf861594df72b2b1c8cc
SHA1 486808a2ca978e3dfafbc754158f48049e64841e
SHA512 4b60ca3e902088745eefd627e19255cdf13cfdec83fba620b2a9484cf9fd1c9125ee3cf7f48cc83d396eb141fa2dd0ef21bbeffcd821b8fa5ab8916866883d2b
SSDEEP 96:PA5Lt9qzN/FWQcaQukCGNSh56RwKPUoP9mbdaQD+irfJSdGdql+9VVPLKK+M1UD/:P6LTuk/NE4n1m+IQdG1KK+M4Ityw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DcryptDll.dll

IMPHASH 1daf45fd074126f5eabcc532bc3e5bf5
SHA256 b4b5772a893e56aa5382aa3f0fef7837fa471e3b3e46db70b8bc702f2037e589
MD5 4c373143ee342a75b469e0748049cd24
SHA1 d4e0e5155e78b99ec9459136acece2364bc2e935
SHA512 569f92c3ff9a6e105cf9b3806d8b696442a5679dfa5d7c9362b0649a67cbea2478ca28a5da6c3bd0edacdb634509d8584c6959a4cc13c38d596458f372832f61
SSDEEP 3072:etvFO3r5Unb7FQwdkb6ckt+bBwmhqKUuWxvt+9/dh:etvAtUn3ewWc+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

22971

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpW CreateFileA lstrlenW WriteFile ReadFile DeleteFileA GetFileSize CloseHandle lstrlenA lstrcmpA GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar LoadLibraryW InterlockedExchange GetLastError GetCurrentThreadId DecodePointer GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThread GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapAlloc RaiseException IsProcessorFeaturePresent HeapFree Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW LeaveCriticalSection FatalAppExitA EnterCriticalSection GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapSize GetModuleFileNameW HeapReAlloc SetConsoleCtrlHandler FreeLibrary RtlUnwind

user32

wsprintfW

$PLUGINSDIR/ExecDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 0deb397ca1e716bb7b15e1754e52b2ac
SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH 3f0fda09180f619ca116344bede41608
SHA256 fe2093ff4bfa1d7259c922aca1e7bb219c4d234e469942446d9e2f8086b7d720
MD5 a75e3775daac9958610ce1308e0bca3b
SHA1 d83ce354cde527c2e20fb425415f6d4795dd4cd4
SHA512 48168a91ec90df262b1e158f32b4bc2a6d6ce10022eb96d4a6f3c755b977e5c104558626adaa214bda29d7f1d246f19e2df59b9a338982aa1c623e1bdd5714c6
SSDEEP 3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalAlloc lstrcpynW GlobalFree lstrcpyW FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetCommandLineA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ProtectorUpdater.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 1ba53128ef67d7e355b2e44c90c4bfe3dddff4546ad4e9c75e249d4850250361
MD5 7aa7e8423194f3edf6d1d82ade82acb3
SHA1 a4ca6d67fc43dd742e87b4c82237cdc8b1bb22d9
SHA512 e5fc8a1b515f41f60810ec12f5e36263c889c60b06c6b94450eec910a32ba91fba74bd757d54966d657d37a5ca3c5e9bb23f58f3de4255c276e046b6f1be28bb
SSDEEP 6144:W50gUCBmByEhoO3RMMJOq2hQ8E9QcwtzH+gTBxnlimMb8GVNVOaj7g0EgVZ+p8VI:I0g9mg67h7JO9E9YzewxnlelOq8s+p86
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

76:ea:e9:c1:43:36:7e:a3:7f:d0:06:7c:87:95:3e:c1:90:63:7c:e1:af:7b:a3:16:85:ae:7b:76:52:b7:3c:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

e3:e2:f9:35:7f:36:64:a2:36:f6:1c:52:2c:50:96:6e:c4:e5:2f:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/AccessControl.dll

SHA256 ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac
MD5 65d017ba65785b43720de6c9979a2e8c
SHA1 0aed2846e1b338077bae5a7f756c345a5c90d8a9
SHA512 31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95
SSDEEP 96:18YNfTAJj9KMMVSyPg8uxZAQ/zdVJF/mSsQwV6i8zRRxqBt/FZTIVe7/cIH8ykeO:1XwKMMfPuxJ/zb+b6fR+bZEwywQ9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 1c5fbf918928fbe5e138493c48ec906ffc746269dabacd03853822eadcf917d2
MD5 f247752013a2cf861594df72b2b1c8cc
SHA1 486808a2ca978e3dfafbc754158f48049e64841e
SHA512 4b60ca3e902088745eefd627e19255cdf13cfdec83fba620b2a9484cf9fd1c9125ee3cf7f48cc83d396eb141fa2dd0ef21bbeffcd821b8fa5ab8916866883d2b
SSDEEP 96:PA5Lt9qzN/FWQcaQukCGNSh56RwKPUoP9mbdaQD+irfJSdGdql+9VVPLKK+M1UD/:P6LTuk/NE4n1m+IQdG1KK+M4Ityw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 0deb397ca1e716bb7b15e1754e52b2ac
SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH 3f0fda09180f619ca116344bede41608
SHA256 fe2093ff4bfa1d7259c922aca1e7bb219c4d234e469942446d9e2f8086b7d720
MD5 a75e3775daac9958610ce1308e0bca3b
SHA1 d83ce354cde527c2e20fb425415f6d4795dd4cd4
SHA512 48168a91ec90df262b1e158f32b4bc2a6d6ce10022eb96d4a6f3c755b977e5c104558626adaa214bda29d7f1d246f19e2df59b9a338982aa1c623e1bdd5714c6
SSDEEP 3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalAlloc lstrcpynW GlobalFree lstrcpyW FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetCommandLineA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WmiInspector.dll

IMPHASH 7f0e53ce204644197ed8a4abb8792a26
SHA256 26c8981d7e3cd8093c40bb7da0c045e89f6dfc1a0888efaac9e22a555d763142
MD5 b757cd400e19c6722e721e27a6db1cfd
SHA1 2e07f3a7b036c3c263049af483721f88ecdb2c53
SHA512 9e4675f380d7b79ac0c2f59c8b38663710798f8ee19233aabbd9f5ba81b74901c4f7c0e3d982ccca640ca240b631f889daad27160d3456ed7bb66ffe68e29e72
SSDEEP 1536:0o0RUqYnecKBiygONayX2PYnyBN1yksAPvTbhKJB:0/LZiCwyCVPnhM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\REI_WS2\NsisPlugins\WmiInspector\Release\WmiInspector.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar FlushFileBuffers CloseHandle CreateFileW GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle GetLastError lstrlenA LocalFree GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc RtlUnwind EncodePointer RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleFileNameW HeapSize IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LoadLibraryW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocStringByteLen VariantClear SysStringLen SysAllocString

$PLUGINSDIR/inetc.dll

IMPHASH 86cdacc6fa5e3ff4938d358350751516
SHA256 9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2
MD5 5da9df435ff20853a2c45026e7681cef
SHA1 39b1d70a7a03e7c791cb21a53d82fd949706a4b4
SHA512 4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f
SSDEEP 768:FRci+9MscTJMR2+d8heiwhSruaFajMGbJDVVG08:Fg9sTJv+AVwhl25ci
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcstol _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul wcsstr wcschr memset _chkesp

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW CreateFileW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
MD5 7059f133ea2316b9e7e39094a52a8c34
SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 1d4c3b4184538309e9572bd9e8bf2bb3e5b996592169da9bac3488d41672cfcb
MD5 d9c765fe2f48c840178b2466c1080f15
SHA1 98d4d7a8611b82a08a616e7fb1d41f0043b7c7d0
SHA512 39214f9fc8ae01772e5a7d6dedd8f1b3869d45260a7512899847dbd18a2687726896077e3a45fb7b2e1ec4d15ef5bd48d2964e10ad233d38bf02fd0f21cf9e5f
SSDEEP 96:8wViSwBT9Cg0Dvxn6GuKM9sh1gdrN9+oB7FT9nGogZcko5Nt4A:8XSACgRK8hlHZkKQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4580

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/stack.dll

IMPHASH 454e327924e76e3c69e4915b2b6f1a25
SHA256 732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9
MD5 867af9bea8b24c78736bf8d0fdb5a78e
SHA1 05839fad98aa2bcd9f6ecb22de4816e0c75bf97d
SHA512 b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b
SSDEEP 192:83fHQmgb2DOJi22H/+zNXdA5uv4bunXuDYuzumJucuVuXfugutbHvr:83fwVriWAWiQXWYKPRGaHubH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/xml.dll

IMPHASH 5bbd63919e9f724979e2ebcc7e04a7e6
SHA256 d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7
MD5 ebce8f5e440e0be57665e1e58dfb7425
SHA1 573dc1abd2b03512f390f569058fd2cf1d02ce91
SHA512 4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85
SSDEEP 3072:Slq7cnzRLdesQbC7ojAqmiGxKUQ8hJgWWHFbit4Gs43YSIFWt:SlYcnzRL8BbwojAzRRQ8hJxahif5wE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

80398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WmiInspector.dll

IMPHASH 7f0e53ce204644197ed8a4abb8792a26
SHA256 26c8981d7e3cd8093c40bb7da0c045e89f6dfc1a0888efaac9e22a555d763142
MD5 b757cd400e19c6722e721e27a6db1cfd
SHA1 2e07f3a7b036c3c263049af483721f88ecdb2c53
SHA512 9e4675f380d7b79ac0c2f59c8b38663710798f8ee19233aabbd9f5ba81b74901c4f7c0e3d982ccca640ca240b631f889daad27160d3456ed7bb66ffe68e29e72
SSDEEP 1536:0o0RUqYnecKBiygONayX2PYnyBN1yksAPvTbhKJB:0/LZiCwyCVPnhM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\REI_WS2\NsisPlugins\WmiInspector\Release\WmiInspector.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar FlushFileBuffers CloseHandle CreateFileW GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle GetLastError lstrlenA LocalFree GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc RtlUnwind EncodePointer RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleFileNameW HeapSize IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LoadLibraryW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocStringByteLen VariantClear SysStringLen SysAllocString

$PLUGINSDIR/inetc.dll

IMPHASH 86cdacc6fa5e3ff4938d358350751516
SHA256 9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2
MD5 5da9df435ff20853a2c45026e7681cef
SHA1 39b1d70a7a03e7c791cb21a53d82fd949706a4b4
SHA512 4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f
SSDEEP 768:FRci+9MscTJMR2+d8heiwhSruaFajMGbJDVVG08:Fg9sTJv+AVwhl25ci
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcstol _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul wcsstr wcschr memset _chkesp

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW CreateFileW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/installer-164x314.bmp

SHA256 d8ea979f58825c0e2f4c7b1a0ea0effc1570e580ca30cb15c92d38041f14d563
MD5 68436d57a2d46cbc9302b1925359e054
SHA1 c89d42a4cd24e77745e1dfbd7deb9a1d4ec42636
SHA512 42e70d0215771659142cbe1213704f41e39e9eff72d39a692c213baeeeb6cbaef31c4803da607f8114a22b1c99b2d44038ff3fa6b7507f88c74354d678a296b6
SSDEEP 1536:7bzvsXZMpw1RNCJIzccdjPXBBvq35lNN2RLrDww2A:1D35MRLN
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/md5dll.dll

SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
MD5 7059f133ea2316b9e7e39094a52a8c34
SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 1d4c3b4184538309e9572bd9e8bf2bb3e5b996592169da9bac3488d41672cfcb
MD5 d9c765fe2f48c840178b2466c1080f15
SHA1 98d4d7a8611b82a08a616e7fb1d41f0043b7c7d0
SHA512 39214f9fc8ae01772e5a7d6dedd8f1b3869d45260a7512899847dbd18a2687726896077e3a45fb7b2e1ec4d15ef5bd48d2964e10ad233d38bf02fd0f21cf9e5f
SSDEEP 96:8wViSwBT9Cg0Dvxn6GuKM9sh1gdrN9+oB7FT9nGogZcko5Nt4A:8XSACgRK8hlHZkKQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4580

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 e7e5bbfd8c8ad303753ecfda840180b586c336e4ab5aacc6b0adea1c3ef0188a
MD5 ae1a4753df5fc34780602bcac675a8a5
SHA1 3e30c7bbbb25d6b4141fe405fc7862e04868b220
SHA512 b70920c7fe7938fc56badc133a175c80684d0041b1980c0941cfe3781e568a9aaa611670395b0bd7786e5309eb9bfbef5a5f90d9b0b4cdc00aac31c9037fda83
SSDEEP 384:WqlqXPJHv0+BzDaI+tOyBjogH5LaIe99499499GA/Fxq0inD9gFe:jQZ0+BzDantbN5ZFe99499499GA/FQGw
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/stack.dll

IMPHASH 454e327924e76e3c69e4915b2b6f1a25
SHA256 732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9
MD5 867af9bea8b24c78736bf8d0fdb5a78e
SHA1 05839fad98aa2bcd9f6ecb22de4816e0c75bf97d
SHA512 b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b
SSDEEP 192:83fHQmgb2DOJi22H/+zNXdA5uv4bunXuDYuzumJucuVuXfugutbHvr:83fwVriWAWiQXWYKPRGaHubH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/xml.dll

IMPHASH 5bbd63919e9f724979e2ebcc7e04a7e6
SHA256 d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7
MD5 ebce8f5e440e0be57665e1e58dfb7425
SHA1 573dc1abd2b03512f390f569058fd2cf1d02ce91
SHA512 4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85
SSDEEP 3072:Slq7cnzRLdesQbC7ojAqmiGxKUQ8hJgWWHFbit4Gs43YSIFWt:SlYcnzRL8BbwojAzRRQ8hJxahif5wE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

80398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_111_/rei/AV/HBEDV.KEY

SHA256 06687dc8125a73f37731248d40a45e2cb60d9e2511e8d06a7dd67258f0f98d8b
MD5 08c9b7772005e23a631b8ad679c8ffdf
SHA1 0859afbfbf5067c3c5f9890e3adc0bbde201ec72
SHA512 17019f26449443ace51ec26b12978557938e030a8d4231d7c12f6ab9e72be0e85ccac6d535845d612a8fb43e678c71e7efc5cc0e214666be37eef8a7d1d07ec9
MD5 SHA1 SHA512

$_111_/rei/AV/avupdate.exe

IMPHASH e58710a4528929cb3aabc1bca18ab56d
SHA256 b79090f3cccdab75bc50ee510085d8336ad9e450ab60dd01904d8e385d20e0aa
MD5 958888671739461088d511d81c17c9dc
SHA1 8f924a6e861282adc82675834cbf4c852a32ea5e
SHA512 9c8a8f591371f20c655107521532da0e409363959e3cfb428ff9c1fc2492b6891fa1b32e24e831323b56ea42a79f7d77204cd14eb313e59f4fe1f143dc9b0c09
SSDEEP 49152:naYoOk994c/tZ/0+xfXxTJpaPbzKz9lWv:n6OVeZ/0+xfXd0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

e7:c1:51:09:f3:8b:81:6c:eb:c4:42:be:45:5f:6c:ad:48:c4:43:8a:32:0f:e2:b0:ae:10:d7:09:a3:6c:f3:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 5, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

1

Major OS version

5

Entry point

1443444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\release\avupdate\RELEASE\win32\updater\avupdate.pdb

ws2_32

inet_addr WSASend WSARecv ntohl shutdown gethostbyname gethostname ioctlsocket listen accept sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup

shell32

SHGetFolderPathW CommandLineToArgvW

mpr

WNetCancelConnection2W WNetAddConnection2W

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation

advapi32

CryptReleaseContext OpenProcessToken GetTokenInformation LookupAccountSidW CryptAcquireContextA SetThreadToken DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptGenRandom GetUserNameW CryptAcquireContextW ReportEventA RegisterEventSourceA RegSetValueExW RegCreateKeyW ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExW RegOpenKeyExW RegCloseKey

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

kernel32

CancelIo DeviceIoControl SetFilePointer GetFileInformationByHandle DeleteFileW SetStdHandle LoadLibraryExW SetErrorMode RemoveDirectoryW FindNextFileW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime GetFullPathNameW GetDriveTypeW GetDriveTypeA GetCurrentDirectoryW SetCurrentDirectoryW CreateEventA GetFileAttributesExW GetEnvironmentVariableW SetEnvironmentVariableW SetEvent ReleaseMutex GetHandleInformation GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW TlsFree ReleaseSemaphore CreateSemaphoreA CreateMutexA CreateFileA GetVersionExA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA EncodePointer IsDebuggerPresent FlushConsoleInputBuffer GlobalMemoryStatus QueryPerformanceCounter FindClose IsProcessorFeaturePresent DecodePointer FindFirstFileW GetLastError GetLocaleInfoW GetCurrentThreadId MoveFileExW LocalFree FormatMessageW CreateFileW ReadFile CloseHandle SetHandleInformation CreateNamedPipeW GetOverlappedResult ResetEvent WaitForSingleObject CreateEventW TerminateProcess GetExitCodeProcess CreateProcessW FreeLibrary GetProcAddress GlobalFree LoadLibraryW GetCurrentProcessId OpenProcess GlobalAlloc GetComputerNameW GetVersionExW GetModuleFileNameW GetModuleHandleW GetCurrentProcess GetSystemDirectoryW GetWindowsDirectoryW LoadLibraryA TlsAlloc TlsSetValue MultiByteToWideChar SetLastError FormatMessageA GetTickCount InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep SleepEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA VerSetConditionMask GetSystemDirectoryA GetModuleHandleA VerifyVersionInfoA GetTimeZoneInformation WideCharToMultiByte GetACP GetOEMCP GetConsoleScreenBufferInfo GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW GetSystemTime SystemTimeToFileTime WriteFile

msvcr120

_lseek _read _write abort _exit _vsnprintf raise _filelength _setmode setvbuf _open _stat64i32 strcmp _strnicmp _chsize _wstat64i32 _fileno _stricmp _getch modf _environ _wenviron _strtoi64 __doserrno _endthreadex _isatty _except1 _XcptFilter _amsg_exit __getmainargs __set_app_type _cexit _configthreadlocale __setusermatherr _initterm_e _initterm __initenv _fmode _commode _except_handler4_common _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _lock _unlock _calloc_crt __dllonexit _onexit ?terminate@@YAXXZ __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _strdup _wsopen __iob_func exit fprintf signal memset fwprintf printf sprintf wcsstr _wcsicmp wcsrchr rand srand _wtoi _time64 free malloc fclose _wfopen calloc swscanf strchr _errno strerror memcpy _swprintf strncmp wcsncpy _wcsupr _wopen _close mbstowcs _wsplitpath isprint strncpy wcsncmp strstr sscanf realloc feof ferror fopen fread memmove wcsspn iswctype wcsncat perror _snprintf _snwprintf strrchr fseek __sys_nerr fgets fputs qsort strtoll tolower ftell isalpha isxdigit strpbrk fwrite strtol strtoul isdigit fputc isspace memchr fflush isalnum _gmtime64 _beginthreadex atoi _lseeki64 _fstat64 _getpid getenv _stat64 isupper toupper islower isgraph wcstombs fgetc remove rename strftime _localtime64 strtok _vacopy _waccess _gmtime64_s _localtime64_s _mktime64 wcschr _wchmod _wunlink _wrename

$_111_/rei/AV/avupdate_msg.avr

SHA256 364d8da3beee8d61f2f567de842613cd535554ab0e86f1cbf7adcb51282176af
MD5 7e27ff07b8e04a923f8ffca441927b3a
SHA1 ee284846d530684b7d75f1276e36e3e34c87727a
SHA512 01e5e27b2c53eb4333fe4c416c36028886b04a0d5ac18b3d03a7be31f734d5f03aca7cf488bd1218fbbfe94f5a0db3e089c980dd9736f8add7421f37461dbf9e
SSDEEP 192:ZC2BcfnCqc+9/6uka9rFMYuHZhxZu+pBn:ZCdv9eHjTpBn
MD5 SHA1 SHA512 SSDEEP

$_111_/rei/AV/cacert.crt

SHA256 7f7cea1aa7618268eee3f040e47aeb11797d136fbc7aedabf17486309da68dc1
MD5 f7e2d18dc9cbb4c697c83c59e2e8f0ef
SHA1 391cf230bd9701445b9cebcd51e2ff3e19d5aa4c
SHA512 f67b3dbbdd6da2ce031addc0a10bece4c95d28ad21f6ad8bce31adf2c1da555fb0a39ed5f865eccfcd5ffc0bf8cee126f63810e7ca97adeb3bc3b4865a932fb4
SSDEEP 192:Hlv09wfnXhNZrXxfuLjQARgRKUE/XYJnsWhBIBYPYwgE:Hlv3/XhN9hGLUARgSI55hUmp
MD5 SHA1 SHA512 SSDEEP

$_111_/rei/AV/msvcr120.dll

IMPHASH aa8d086deb6960b10f8791df466a5610
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 15, 2024

PE Signature issue

Digest

3f:08:90:50:77:63:e4:04:ba:19:2c:b1:94:32:e7:d0:82:51:35:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 5, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

72260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr120.i386.pdb

kernel32

EncodePointer DecodePointer RaiseException GetLastError ExitProcess GetModuleHandleW GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCommandLineW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetModuleFileNameA SetLastError GetCurrentThread GetModuleFileNameW IsProcessorFeaturePresent GetStdHandle WriteFile FindClose FindFirstFileExA FindNextFileA FindFirstFileExW FindNextFileW CloseHandle CreateThread ExitThread ResumeThread LoadLibraryExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode Beep Sleep GetFullPathNameA GetCurrentProcessId GetFileAttributesExW SetFileAttributesW GetFullPathNameW CreateDirectoryW MoveFileExW RemoveDirectoryW GetDriveTypeW DeleteFileW SetEnvironmentVariableA SetCurrentDirectoryA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SetEnvironmentVariableW WaitForSingleObject GetExitCodeProcess CreateProcessA FreeLibrary LoadLibraryExA CreateProcessW ReadFile GetTempPathA GetTempPathW DuplicateHandle GetCurrentProcess GetSystemTimeAsFileTime GetTimeZoneInformation GetLocalTime LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime SetLocalTime InterlockedPopEntrySList InterlockedFlushSList QueryDepthSList InterlockedPushEntrySList CreateTimerQueue SetEvent WaitForSingleObjectEx UnregisterWait TlsGetValue SignalObjectAndWait TlsSetValue SetThreadPriority ChangeTimerQueueTimer CreateTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject GetLogicalProcessorInformation RtlCaptureStackBackTrace GetThreadPriority GetProcessAffinityMask SetThreadAffinityMask TlsAlloc DeleteTimerQueueTimer TlsFree SwitchToThread TryEnterCriticalSection SetProcessAffinityMask VirtualFree GetVersionExW VirtualAlloc VirtualProtect InitializeSListHead ReleaseSemaphore UnregisterWaitEx LoadLibraryW OutputDebugStringW FreeLibraryAndExitThread GetModuleHandleA GetThreadTimes CreateEventW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind HeapFree HeapAlloc GetProcessHeap HeapReAlloc HeapSize HeapQueryInformation HeapValidate HeapCompact HeapWalk GetSystemInfo VirtualQuery GetFileType GetStartupInfoW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe CreateFileW GetConsoleMode ReadConsoleW GetConsoleCP SetFilePointerEx FlushFileBuffers CreatePipe SetStdHandle GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ReadConsoleInputW WriteConsoleW SetEndOfFile LockFileEx UnlockFileEx IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess GetTickCount CreateSemaphoreW SetConsoleCtrlHandler QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringA

$I10_OUTPUT ??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z ??0SchedulerPolicy@Concurrency@@QAA@IZZ ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z ??0SchedulerPolicy@Concurrency@@QAE@XZ ??0_Cancellation_beacon@details@Concurrency@@QAE@XZ ??0_Condition_variable@details@Concurrency@@QAE@XZ ??0_Context@details@Concurrency@@QAE@PAVContext@2@@Z ??0_Interruption_exception@details@Concurrency@@QAE@PBD@Z ??0_Interruption_exception@details@Concurrency@@QAE@XZ ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_ReentrantLock@details@Concurrency@@QAE@XZ ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z ??0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@XZ ??0_Timer@details@Concurrency@@IAE@I_N@Z ??0__non_rtti_object@std@@QAE@ABV01@@Z ??0__non_rtti_object@std@@QAE@PBD@Z ??0bad_cast@std@@AAE@PBQBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@XZ ??0bad_typeid@std@@QAE@ABV01@@Z ??0bad_typeid@std@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@XZ ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z ??0context_unblock_unbalanced@Concurrency@@QAE@XZ ??0critical_section@Concurrency@@QAE@XZ ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z ??0default_scheduler_exists@Concurrency@@QAE@XZ ??0event@Concurrency@@QAE@XZ ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@XZ ??0improper_lock@Concurrency@@QAE@PBD@Z ??0improper_lock@Concurrency@@QAE@XZ ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_attach@Concurrency@@QAE@XZ ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_detach@Concurrency@@QAE@XZ ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z ??0improper_scheduler_reference@Concurrency@@QAE@XZ ??0invalid_link_target@Concurrency@@QAE@PBD@Z ??0invalid_link_target@Concurrency@@QAE@XZ ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ ??0invalid_operation@Concurrency@@QAE@PBD@Z ??0invalid_operation@Concurrency@@QAE@XZ ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ ??0message_not_found@Concurrency@@QAE@PBD@Z ??0message_not_found@Concurrency@@QAE@XZ ??0missing_wait@Concurrency@@QAE@PBD@Z ??0missing_wait@Concurrency@@QAE@XZ ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ ??0operation_timed_out@Concurrency@@QAE@PBD@Z ??0operation_timed_out@Concurrency@@QAE@XZ ??0reader_writer_lock@Concurrency@@QAE@XZ ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z ??0scheduler_not_attached@Concurrency@@QAE@XZ ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@J@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0task_canceled@Concurrency@@QAE@PBD@Z ??0task_canceled@Concurrency@@QAE@XZ ??0unsupported_os@Concurrency@@QAE@PBD@Z ??0unsupported_os@Concurrency@@QAE@XZ ??1SchedulerPolicy@Concurrency@@QAE@XZ ??1_Cancellation_beacon@details@Concurrency@@QAE@XZ ??1_Condition_variable@details@Concurrency@@QAE@XZ ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_SpinLock@details@Concurrency@@QAE@XZ ??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ ??1_TaskCollection@details@Concurrency@@QAE@XZ ??1_Timer@details@Concurrency@@MAE@XZ ??1__non_rtti_object@std@@UAE@XZ ??1bad_cast@std@@UAE@XZ ??1bad_typeid@std@@UAE@XZ ??1critical_section@Concurrency@@QAE@XZ ??1event@Concurrency@@QAE@XZ ??1exception@std@@UAE@XZ ??1reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??2@YAPAXIHPBDH@Z ??3@YAXPAX@Z ??3@YAXPAXHPBDH@Z ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z ??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z ??4bad_cast@std@@QAEAAV01@ABV01@@Z ??4bad_typeid@std@@QAEAAV01@ABV01@@Z ??4exception@std@@QAEAAV01@ABV01@@Z ??8type_info@@QBE_NABV0@@Z ??9type_info@@QBE_NABV0@@Z ??_7__non_rtti_object@std@@6B@ ??_7bad_cast@std@@6B@ ??_7bad_typeid@std@@6B@ ??_7exception@std@@6B@ ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ ??_F_Context@details@Concurrency@@QAEXXZ ??_F_Scheduler@details@Concurrency@@QAEXXZ ??_Fbad_cast@std@@QAEXXZ ??_Fbad_typeid@std@@QAEXXZ ??_U@YAPAXI@Z ??_U@YAPAXIHPBDH@Z ??_V@YAXPAX@Z ??_V@YAXPAXHPBDH@Z ?Alloc@Concurrency@@YAPAXI@Z ?Block@Context@Concurrency@@SAXXZ ?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ ?CurrentContext@Context@Concurrency@@SAPAV12@XZ ?Detach@CurrentScheduler@Concurrency@@SAXXZ ?DisableTracing@Concurrency@@YAJXZ ?EnableTracing@Concurrency@@YAJXZ ?Free@Concurrency@@YAXPAX@Z ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?GetExecutionContextId@Concurrency@@YAIXZ ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z ?GetProcessorCount@Concurrency@@YAIXZ ?GetProcessorNodeCount@Concurrency@@YAIXZ ?GetSchedulerId@Concurrency@@YAIXZ ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ ?Id@Context@Concurrency@@SAIXZ ?Id@CurrentScheduler@Concurrency@@SAIXZ ?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ ?Log2@details@Concurrency@@YAKI@Z ?Oversubscribe@Context@Concurrency@@SAX_N@Z ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ ?ScheduleGroupId@Context@Concurrency@@SAIXZ ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z ?VirtualProcessorId@Context@Concurrency@@SAIXZ ?Yield@Context@Concurrency@@SAXXZ ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ ?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ ?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ ?_Copy_str@exception@std@@AAEXPBD@Z ?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ ?_Current_node@location@Concurrency@@SA?AV12@XZ ?_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ ?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ ?_GetConcurrency@details@Concurrency@@YAIXZ ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ ?_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ ?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ ?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z ?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_Reference@_Scheduler@details@Concurrency@@QAEIXZ ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_Scheduler@details@Concurrency@@QAEIXZ ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z ?_SetUnobservedExceptionHandler@details@Concurrency@@YAXP6AXXZ@Z ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ ?_SpinYield@Context@Concurrency@@SAXXZ ?_Start@_Timer@details@Concurrency@@IAEXXZ ?_Stop@_Timer@details@Concurrency@@IAEXXZ ?_Tidy@exception@std@@AAEXXZ ?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ ?_Type_info_dtor@type_info@@CAXPAV1@@Z ?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z ?_UnderlyingYield@details@Concurrency@@YAXXZ ?_ValidateExecute@@YAHP6GHXZ@Z ?_ValidateRead@@YAHPBXI@Z ?_ValidateWrite@@YAHPAXI@Z ?_Value@_SpinCount@details@Concurrency@@SAIXZ ?_Yield@_Context@details@Concurrency@@SAXXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrCompare@@YA_NPBX0@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrSwap@@YAXPAX0@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?_inconsistency@@YAXXZ ?_invalid_parameter@@YAXPBG00II@Z ?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z ?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z ?_open@@YAHPBDHH@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZH@Z ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?_sopen@@YAHPBDHHH@Z ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?_wopen@@YAHPB_WHH@Z ?_wsopen@@YAHPB_WHHH@Z ?before@type_info@@QBE_NABV1@@Z ?current@location@Concurrency@@SA?AV12@XZ ?from_numa_node@location@Concurrency@@SA?AV12@G@Z ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ ?lock@critical_section@Concurrency@@QAEXXZ ?lock@reader_writer_lock@Concurrency@@QAEXXZ ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ ?name@type_info@@QBEPBDPAU__type_info_node@@@Z ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ ?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ ?notify_one@_Condition_variable@details@Concurrency@@QAEXXZ ?raw_name@type_info@@QBEPBDXZ ?reset@event@Concurrency@@QAEXXZ ?set@event@Concurrency@@QAEXXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z ?set_task_execution_resources@Concurrency@@YAXK@Z ?set_terminate@@YAP6AXXZH@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZH@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?swprintf@@YAHPAGIPBGZZ ?swprintf@@YAHPA_WIPB_WZZ ?terminate@@YAXXZ ?try_lock@critical_section@Concurrency@@QAE_NXZ ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ ?try_lock_for@critical_section@Concurrency@@QAE_NI@Z ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ ?unexpected@@YAXXZ ?unlock@critical_section@Concurrency@@QAEXXZ ?unlock@reader_writer_lock@Concurrency@@QAEXXZ ?vswprintf@@YAHPA_WIPB_WPAD@Z ?wait@Concurrency@@YAXI@Z ?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z ?wait@event@Concurrency@@QAEII@Z ?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z ?what@exception@std@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CRT_RTC_INIT _CRT_RTC_INITW _Cbuild _CreateFrameInfo _CxxThrowException _EH_prolog _FCbuild _FindAndUnlinkFrame _Getdays _Getmonths _Gettnames _HUGE _IsExceptionObjectToBeDestroyed _LCbuild _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime _XcptFilter __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CppXcptFilter __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD __STRINGTOLD_L __TypeMatch ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func ___mb_cur_max_l_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __clean_type_info_names_internal __control87_2 __create_locale __crtCompareStringA __crtCompareStringEx __crtCompareStringW __crtCreateEventExW __crtCreateSemaphoreExW __crtCreateSymbolicLinkW __crtEnumSystemLocalesEx __crtFlsAlloc __crtFlsFree __crtFlsGetValue __crtFlsSetValue __crtGetDateFormatEx __crtGetFileInformationByHandleEx __crtGetLocaleInfoEx __crtGetShowWindowMode __crtGetTickCount64 __crtGetTimeFormatEx __crtGetUserDefaultLocaleName __crtInitializeCriticalSectionEx __crtIsPackagedApp __crtIsValidLocaleName __crtLCMapStringA __crtLCMapStringEx __crtLCMapStringW __crtSetFileInformationByHandle __crtSetThreadStackGuarantee __crtSetUnhandledExceptionFilter __crtSleep __crtTerminateProcess __crtUnhandledException __daylight __dllonexit __doserrno __dstbias __fpecode __free_locale __get_current_locale __get_flsindex __get_tlsindex __getmainargs __initenv __iob_func __isascii __iscsym __iscsymf __iswcsym __iswcsymf __lconv __lconv_init __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__commode __p__daylight __p__dstbias __p__environ __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__wpgmptr __pctype_func __pioinfo __pwctype_func __pxcptinfoptrs __report_gsfailure __set_app_type __setlc_active __setusermatherr __strncnt __swprintf_l __sys_errlist __sys_nerr __threadhandle __threadid __timezone __toascii __tzname __unDName __unDNameEx __unDNameHelper __uncaught_exception __unguarded_readlc_active __vswprintf_l __wargv __wcserror __wcserror_s __wcsncnt __wgetmainargs __winitenv _abnormal_termination _abs64 _access _access_s _acmdln _aligned_free _aligned_malloc _aligned_msize _aligned_offset_malloc _aligned_offset_realloc _aligned_offset_recalloc _aligned_realloc _aligned_recalloc _amsg_exit _assert _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _beep _beginthread _beginthreadex _byteswap_uint64 _byteswap_ulong _byteswap_ushort _c_exit _cabs _callnewh _calloc_crt _cexit _cgets _cgets_s _cgetws _cgetws_s _chdir _chdrive _chgsign _chgsignf _chkesp _chmod _chsize _chsize_s _clearfp _close _commit _commode _configthreadlocale _control87 _controlfp _controlfp_s _copysign _copysignf _cprintf _cprintf_l _cprintf_p _cprintf_p_l _cprintf_s _cprintf_s_l _cputs _cputws _creat _create_locale _crt_debugger_hook _cscanf _cscanf_l _cscanf_s _cscanf_s_l _ctime32 _ctime32_s _ctime64 _ctime64_s _cwait _cwprintf _cwprintf_l _cwprintf_p _cwprintf_p_l _cwprintf_s _cwprintf_s_l _cwscanf _cwscanf_l _cwscanf_s _cwscanf_s_l _daylight _dclass _difftime32 _difftime64 _dosmaperr _dpcomp _dsign _dstbias _dtest _dup _dup2 _dupenv_s _ecvt _ecvt_s _endthread _endthreadex _environ _eof _errno _except1 _except_handler2 _except_handler3 _except_handler4_common _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fclose_nolock _fcloseall _fcvt _fcvt_s _fdclass _fdopen _fdpcomp _fdsign _fdtest _fflush_nolock _fgetchar _fgetwc_nolock _fgetwchar _filbuf _filelength _filelengthi64 _fileno _findclose _findfirst32 _findfirst32i64 _findfirst64 _findfirst64i32 _findnext32 _findnext32i64 _findnext64 _findnext64i32 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _free_locale _freea _freea_s _freefls _fscanf_l _fscanf_s_l _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _fstat32 _fstat32i64 _fstat64 _fstat64i32 _ftell_nolock _ftelli64 _ftelli64_nolock _ftime32 _ftime32_s _ftime64 _ftime64_s _ftol _fullpath _futime32 _futime64 _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwrite_nolock _fwscanf_l _fwscanf_s_l _gcvt _gcvt_s _get_current_locale _get_daylight _get_doserrno _get_dstbias _get_errno _get_fmode _get_heap_handle _get_invalid_parameter_handler _get_osfhandle _get_output_format _get_pgmptr _get_printf_count_output _get_purecall_handler _get_terminate _get_timezone _get_tzname _get_unexpected _get_wpgmptr _getc_nolock _getch _getch_nolock _getche _getche_nolock _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getptd _getsystime _getw _getwch _getwch_nolock _getwche _getwche_nolock _getws _getws_s _global_unwind2 _gmtime32 _gmtime32_s _gmtime64 _gmtime64_s _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _hypotf _i64toa _i64toa_s _i64tow _i64tow_s _initptd _initterm _initterm_e _inp _inpd _inpw _invalid_parameter _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _iob _isalnum_l _isalpha_l _isatty _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _isnan _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _itoa _itoa_s _itow _itow_s _j0 _j1 _jn _kbhit _ldclass _ldpcomp _ldsign _ldtest _lfind _lfind_s _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _loaddll _local_unwind2 _local_unwind4 _localtime32 _localtime32_s _localtime64 _localtime64_s _lock _lock_file _locking _logb _longjmpex _lrotl _lrotr _lsearch _lsearch_s _lseek _lseeki64 _ltoa _ltoa_s _ltow _ltow_s _makepath _makepath_s _malloc_crt _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mbctype _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l _memccpy _memicmp _memicmp_l _mkdir _mkgmtime32 _mkgmtime64 _mktemp _mktemp_s _mktime32 _mktime64 _msize _nextafter _onexit _open _open_osfhandle _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _printf_l _printf_p _printf_p_l _printf_s_l _purecall _putch _putch_nolock _putenv _putenv_s _putw _putwch _putwch_nolock _putws _pwctype _read _realloc_crt _recalloc _recalloc_crt _resetstkoflw _rmdir _rmtmp _rotl _rotl64 _rotr _rotr64 _scalb _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _searchenv _searchenv_s _seh_longjmp_unwind _seh_longjmp_unwind4 _set_SSE2_enable _set_abort_behavior _set_controlfp _set_doserrno _set_errno _set_error_mode _set_fmode _set_invalid_parameter_handler _set_malloc_crt_max_wait _set_output_format _set_printf_count_output _set_purecall_handler _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sopen _sopen_s _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _splitpath_s _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _stat32 _stat32i64 _stat64 _stat64i32 _statusfp _statusfp2 _strcoll_l _strdate _strdate_s _strdup _strerror _strerror_s _strftime_l _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strtime _strtime_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _swab _swprintf _swprintf_c _swprintf_c_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _sys_errlist _sys_nerr _tell _telli64 _tempnam _time32 _time64 _timezone _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _tzname _tzset _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _umask _umask_s _ungetc_nolock _ungetch _ungetch_nolock _ungetwc_nolock _ungetwch _ungetwch_nolock _unlink _unloaddll _unlock _unlock_file _utime32 _utime64 _vacopy _vcprintf _vcprintf_l _vcprintf_p _vcprintf_p_l _vcprintf_s _vcprintf_s_l _vcwprintf _vcwprintf_l _vcwprintf_p _vcwprintf_p_l _vcwprintf_s _vcwprintf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _waccess _waccess_s _wasctime _wasctime_s _wassert _wchdir _wchmod _wcmdln _wcreat _wcreate_locale _wcscoll_l _wcsdup _wcserror _wcserror_s _wcsftime_l _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctime32 _wctime32_s _wctime64 _wctime64_s _wctomb_l _wctomb_s_l _wctype _wdupenv_s _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst32 _wfindfirst32i64 _wfindfirst64 _wfindfirst64i32 _wfindnext32 _wfindnext32i64 _wfindnext64 _wfindnext64i32 _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _wgetenv_s _wmakepath _wmakepath_s _wmkdir _wmktemp _wmktemp_s _wopen _wperror _wpgmptr _wpopen _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wputenv _wputenv_s _wremove _wrename _write _wrmdir _wscanf_l _wscanf_s_l _wsearchenv _wsearchenv_s _wsetlocale _wsopen _wsopen_s _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wsplitpath_s _wstat32 _wstat32i64 _wstat64 _wstat64i32 _wstrdate _wstrdate_s _wstrtime _wstrtime_s _wsystem _wtempnam _wtmpnam _wtmpnam_s _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l _wunlink _wutime32 _wutime64 _y0 _y1 _yn abort abs acos acosh acoshf acoshl asctime asctime_s asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl atexit atof atoi atol atoll bsearch bsearch_s btowc cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl calloc carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clearerr clearerr_s clock clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl div erf erfc erfcf erfcl erff erfl exit exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fclose fdim fdimf fdiml feclearexcept fegetenv fegetexceptflag fegetround feholdexcept feof feraiseexcept ferror fesetenv fesetexceptflag fesetround fetestexcept feupdateenv fflush fgetc fgetpos fgets fgetwc fgetws floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fopen fopen_s fprintf fprintf_s fputc fputs fputwc fputws fread fread_s free freopen freopen_s frexp fscanf fscanf_s fseek fsetpos ftell fwprintf fwprintf_s fwrite fwscanf fwscanf_s getc getchar getenv getenv_s gets gets_s getwc getwchar ilogb ilogbf ilogbl imaxabs imaxdiv is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv lgamma lgammaf lgammal llabs lldiv llrint llrintf llrintl llround llroundf llroundl localeconv log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl longjmp lrint lrintf lrintl lround lroundf lroundl malloc mblen mbrlen mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml perror pow printf printf_s putc putchar puts putwc putwchar qsort qsort_s raise rand rand_s realloc remainder remainderf remainderl remove remquo remquof remquol rename rewind rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl scanf scanf_s setbuf setlocale setvbuf signal sin sinh sprintf sprintf_s sqrt srand sscanf sscanf_s strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strerror_s strftime strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strrchr strspn strstr strtod strtof strtoimax strtok strtok_s strtol strtold strtoll strtoul strtoull strtoumax strxfrm swprintf_s swscanf swscanf_s system tan tanh tgamma tgammaf tgammal tmpfile tmpfile_s tmpnam tmpnam_s tolower toupper towctrans towlower towupper trunc truncf truncl ungetc ungetwc vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wcrtomb wcrtomb_s wcscat wcscat_s wcschr wcscmp wcscoll wcscpy wcscpy_s wcscspn wcsftime wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsrchr wcsrtombs wcsrtombs_s wcsspn wcsstr wcstod wcstof wcstoimax wcstok wcstok_s wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wcsxfrm wctob wctomb wctomb_s wctrans wctype wmemcpy_s wmemmove_s wprintf wprintf_s wscanf wscanf_s

$_111_/rei/AV/productname.dat

SHA256 b80a0407aa9b16908e2b65d5f44ee6f759457117d18a2e1e6d10af777de7c2eb
MD5 78b8e6e073c748138c484aa496694ee5
SHA1 05f84a5178b2b9aa840dd3bcb2869602a8da7774
SHA512 4c4e9d675d13abfc0ecf83e888b6105e1e8414d53e36916d6b1e59c899fb134bf80c153c85673279e783fb57a28c3702447b90247a1d3f8f2b126c7886540319
MD5 SHA1 SHA512

$_111_/rei/AV/savapi.exe

IMPHASH 26d95e297fed48ca7748ea1ba5037a59
SHA256 160e21c00fdc94ae159f98ca3fb5f115a919195cc973fb3555cb5a7b119b80db
MD5 186cf10badf3c21da4c920d4d9a455d7
SHA1 a73b15789e6062a3842a6a6e6f5ce275eaf2c92c
SHA512 889f4ab5ca4356fdd73c9e8d2a6158bb2e874d744058893cc2acd7be3efecd0590781dc41d29f130893c6d6f741d2c8bdf0be9f5a4bb915eb2ee8d27053bb922
SSDEEP 6144:mVKcKstEhokon3teQRzRphWJ9j9LLX6NCfQiRajLniTOTvX05tyMX4ja1y6VDsQW:mVpKBhokU3tlRzRphWJ9JyYOTvX058j/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

68:5c:e8:54:d1:df:f5:a3:21:2a:ff:45:27:84:08:88:0b:0a:19:17:fd:4b:9a:1a:90:ec:ad:1e:35:a1:de:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 10, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

1

Major OS version

5

Entry point

273309

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\release\savapi\RELEASE\win32\src\savapi.pdb

ws2_32

getaddrinfo htons freeaddrinfo ntohl send recv inet_addr getsockname ioctlsocket socket shutdown select listen connect closesocket bind accept __WSAFDIsSet WSASend WSARecv ntohs WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError setsockopt

shlwapi

PathCanonicalizeW

kernel32

DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIo SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId GetTempPathW GetModuleFileNameW SetLastError CreateHardLinkW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW Sleep GetTickCount GetStdHandle GetConsoleScreenBufferInfo GetSystemInfo MapViewOfFile UnmapViewOfFile CreateEventA InitializeCriticalSection EnterCriticalSection WriteFile DeleteCriticalSection ReleaseMutex SetHandleInformation GetCurrentProcess GetSystemTimeAsFileTime FindClose FindFirstFileW GetFileAttributesExW GetFileInformationByHandle GetFileType GetFullPathNameW LocalFree ConnectNamedPipe DeleteFileW SetFilePointer GetOverlappedResult DeviceIoControl MoveFileExW LockFile LockFileEx UnlockFile UnlockFileEx PeekNamedPipe CreateDirectoryW FindNextFileW RemoveDirectoryW SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW CreateMutexA GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA ReleaseSemaphore CreateSemaphoreA TlsSetValue GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW TlsAlloc TlsFree GlobalFree CreateFileMappingA GetExitCodeProcess TerminateProcess GetVersionExA LoadLibraryA ReadFile CreateFileW SetConsoleCtrlHandler GetLastError SetStdHandle CloseHandle EncodePointer IsDebuggerPresent IsProcessorFeaturePresent DecodePointer QueryPerformanceCounter LeaveCriticalSection

shell32

CommandLineToArgvW

advapi32

RegOpenKeyExW RegSetValueExW RegDeleteKeyW RegCreateKeyW RegCloseKey GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus OpenServiceW ReportEventW RegisterEventSourceW OpenSCManagerW DeleteService DeregisterEventSource CloseServiceHandle ControlService CreateServiceW ChangeServiceConfig2W

msvcr120

_filelength _lseek _read _wsopen _except_handler4_common _XcptFilter _amsg_exit __getmainargs __set_app_type exit _exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm __initenv _fmode _commode _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _vsnprintf _lock _unlock _calloc_crt __dllonexit _onexit ?terminate@@YAXXZ __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _getpid _strdup _unlink _getch _mktemp _strnicmp free memset printf _wchdir __iob_func fprintf isalpha isdigit strncmp memcpy strchr malloc tolower _errno strtoul memchr toupper wcstok strrchr _vacopy memmove strncpy realloc _time64 _waccess calloc _close _snprintf strftime _gmtime64_s _localtime64_s _mktime64 wcschr _snwprintf atoi _strtoi64 wcsncmp islower modf strerror __doserrno _beginthreadex _endthreadex _environ _wenviron _isatty

$_111_/rei/AV/savapi_restart.exe

IMPHASH ab18d420b4b97a02943bd01dafa51768
SHA256 8ad0bd4f7f1f9f425194b920227c59b823fcc2a1866eb9c5ecf0f4859449e0b0
MD5 0b2b9ae877cd1e83459b3512163ffb6e
SHA1 32ab9c28724b46a6b5da45da0a58689fa9c3a3e5
SHA512 587839e7e2ffeb27723c75edb8dda924237b2fcc5dea00831ffcf976c6e3846afc2a5a0a4d102b878b39f794edc028f01dbf4b3c8264390be249d8143afc8c5f
SSDEEP 384:P0qoMbrzXAW9Yr9IVNv6ivRKrAu8MUBB5JNNzFwhhiE:PXoM8r+F9JJu83whz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

2c:ab:e3:b3:e7:ab:30:a1:69:c1:29:3b:5f:57:3a:1c:b7:a0:e9:93:77:b5:45:f8:c1:bc:ba:ba:ff:c4:d5:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jan 16, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

1f:eb:54:56:b9:e0:c2:c6:83:57:c4:29:75:b9:82:24

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 12, 2016 - Oct 12, 2019

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

1

Major OS version

5

Entry point

8089

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\release\savapi\RELEASE\win32\utils\forupdater\savapi_restart\savapi_restart.pdb

$_111_/rei/AV/savapi_stub.exe

IMPHASH 0db532abe0984e99866008e5b84ceb8e
SHA256 1b35cb85eac1b52b237443d4a157453c7beef3b785fcc8a1301095b83634a839
MD5 90534b36ef7a3ca321578af5b06d08ca
SHA1 77e436bcce2e5c1c918bd7b11be1f56b142a542b
SHA512 b42bd6a8f94f6160a0ac3a14f995701ca10603da5bbbce375baa492c062c238da6861462c8d871139337f27fbe3828a12a766d6775dabf4c54651efb89de910e
SSDEEP 1536:6t8/zfVKQYIEXxR4UKePN7F61q/HXiGyogF9XgPQDDsQ8cNJcxHBmghc:6t8/zfV/HuR4UP541uHXiGyxXjDsQ8cn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

9e:a7:a9:03:9d:be:64:1f:6e:c0:9e:f7:63:f7:b1:9f:c6:d6:f6:53:ef:28:cd:4e:64:29:ff:db:7a:44:79:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jan 12, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

39:cf:93:7c:f8:90:9f:05:79:33:00:de:20:b4:e4:5f

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2016 - May 17, 2018

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

1

Major OS version

5

Entry point

55885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\release\savapi\RELEASE\win32\utils\forupdater\savapi_stub\savapi_stub.pdb

ws2_32

ntohl WSACleanup WSAStartup WSAGetLastError gethostbyname gethostname

kernel32

IsProcessorFeaturePresent DecodePointer UnlockFileEx UnlockFile QueryPerformanceCounter IsDebuggerPresent EncodePointer SetLastError GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW GetStdHandle CloseHandle GetHandleInformation SetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject GetExitCodeProcess CreateProcessW TlsAlloc TlsFree FormatMessageA FindClose FindFirstFileW GetFileAttributesExW GetFileInformationByHandle GetFileType GetFullPathNameW LocalFree GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW SetEvent ReleaseMutex CreateEventA SetFilePointer WriteFile GetOverlappedResult CancelIo Sleep GetSystemTimeAsFileTime SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore ResetEvent TerminateProcess CreateFileA CreatePipe CreateNamedPipeA GetVersionExA GetProcAddress LockFileEx LockFile LoadLibraryA

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey RegCreateKeyW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RevertToSelf ImpersonateLoggedOnUser CreateProcessAsUserW RegSetValueExW

msvcr120

_cexit _configthreadlocale __setusermatherr _exit exit _initterm_e _initterm __initenv _fmode _commode _vsnprintf _lock _unlock _calloc_crt __dllonexit _onexit _crt_debugger_hook __crtUnhandledException __crtTerminateProcess ?terminate@@YAXXZ __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _except_handler4_common _stricmp _strnicmp _getpid __iob_func fprintf free malloc memset _vacopy isalpha toupper tolower memmove strncpy _errno realloc memcpy _time64 _waccess printf _snprintf strchr strftime _gmtime64_s _localtime64_s _mktime64 memchr isspace wcschr getenv strerror wcsncmp _close islower isdigit strncmp modf atoi _XcptFilter _amsg_exit __getmainargs __set_app_type

$_111_/rei/About.txt

SHA256 6fd8197a1de7a48e1b985b2be03c4eaf24b6bfc29540ec14363a418429186857
MD5 bc879d71e982aa909049c6a4c17cdbe8
SHA1 c3357c558e7497e0ef2c7ca9717fc37b052cb5e2
SHA512 1baccb3b51aaf3233831a2938a1d56294fb84f04d1e73f7e63d54d44834e6324feea466fba8d5558c0e5a7bc1ab8090c2b394ac40caf2dee9ce208b808f56742
MD5 SHA1 SHA512

$_111_/rei/SupportInfoTool.ini

SHA256 1cc5709ae95e72de80a031d97fd77b53892117e9df0d5be7b5f4320c30712e89
MD5 f19429daa43306861ee68d97e930e6d3
SHA1 669bfeb2373a579dcdbfb5bdd95a91fefe70bccb
SHA512 913056cccb6e1b17f9ddf21094b8a2555c68223135fb65717d367bd0a1fd301f7aa60a881c69081ed3d6fd93cca636d8dafbed7a4b2593103301395d3bd16c7f
MD5 SHA1 SHA512

$_111_/rei/rpe1.rei

SHA256 b2df6723fe215d423b97d49575218c2e73f4c7e2f9592812f4ec1ae458c4961a
MD5 b4944625cb0bbff48a153f9f36179361
SHA1 1c8a3c8ab2536204f55373f7e7ad117c7ba9c4f3
SHA512 93fc3b439545a5303eee42658c0f66cc1f98b4431977d732c3667277e27d798f33230d4100334251be7a922923ba3b90925fa344a1a18e3a9a2ed77c260cf582
SSDEEP 768:WhehPZtyMMnCLGQMrEhLxkdCbGJekoz7vjvY/3MRnC:Wh8YMTSrEJLb8ojvY/3GC
MD5 SHA1 SHA512 SSDEEP

$_238_/ReimageApp.exe

IMPHASH 22433d42e8611035fd3f1fcdbb9659d9
SHA256 037a67a221096c076d162d5f0f3ad5720ed0d49308d041dea235c5785a557565
MD5 88d21bbe0c15959cd71274ed6198804e
SHA1 eeca578e046963b359c9a124fe993347ce5b2fb3
SHA512 66e4bf84706c69e49526529643911d92aa6be19fc7839c27e07b4d38fcf6648744b738ecb2e26adf83f9132c9a73bf734b4986ef21831224f8151f6b3be53e82
SSDEEP 6144:Ct9sJVfWW5ynm39t9TRHdAsleXH/un3R3DN:lVeW5y6t99HfQ/unBTN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

bc:d3:73:bb:62:2b:3a:73:c5:e8:e2:75:6e:4d:9e:16:53:6e:86:e6:53:58:0b:55:c6:d4:6c:32:2e:c9:8b:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

53:d4:39:c0:87:a5:c8:de:5a:23:8e:d0:04:e7:e2:45:05:ca:61:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

36876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\REI_WS2\Production2\Release\x64\ReimageApp.pdb

user32

GetMessageW PostQuitMessage DefWindowProcW TrackPopupMenu SetForegroundWindow InsertMenuW CreatePopupMenu GetCursorPos SetTimer CreateWindowExW RegisterClassExW LoadCursorW LoadIconW TranslateAcceleratorW LoadAcceleratorsW TranslateMessage DispatchMessageW LoadStringW

shell32

Shell_NotifyIconW ShellExecuteW

kernel32

UnhandledExceptionFilter CreateFileW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection CloseHandle CreateThread WaitForSingleObject HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetFileAttributesW OpenMutexW Sleep GetCommandLineW GetVersionExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar GetStdHandle WriteFile GetACP GetFileType CompareStringW LCMapStringW

LZMA.EXE

IMPHASH 1c97b14bd77b27568e0f4c0abc6f72d9
SHA256 871361690289c50c81a6e38c28914121adceab3ff0ba93d043f1cc4e59635955
MD5 a59ab79ec748d1da70e326b49b8aa820
SHA1 145d254525c6b41251733953e3d4e00e3370f0fd
SHA512 5cd4fdfe9e20151313814551a36ab0aab8881fc1b12b5c41e0ccd64d6f4980e908b3493efd569964ce63290853785c10b151285ab19b37c7d3a411b5461275b9
SSDEEP 3072:Ur137PRFe+slrgElrn5LChpeBADQ/PFJJiTi:gFFylrg4rnIfeiD+FJAT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

88428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

REI_AVIRA.exe

IMPHASH d40df78da8afbdc0322a53eff9124f67
SHA256 4698054a5a201da038094f35570f6b0578762011c05280d051ce5e2bae93ea63
MD5 e4b2b602254861bc3fa50ea2701643c0
SHA1 5a95b91edba79f28940ddf9aa17fd83150c8685b
SHA512 c0c31e9d7c5b5c18b132baf34e913f5383dd199a1d9dee1d1870bb6aec04a654dfc011ef39dfc2cc52d6b8d6eea62adea93c086367dad27e3b8e9c3fb5173a43
SSDEEP 49152:h+O+N9E+9Ez9QC7/R9p4wJe/AuuoBKK8wyj:h+O+NqNz9QC7/TOwJe/AuuoBb8h
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

71:06:02:83:29:e0:aa:e5:73:e4:ba:cf:5a:6d:49:fa:1f:97:de:ad:1a:c3:52:28:c6:a4:74:af:e6:30:ce:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a2:d2:2b:f9:f7:73:49:db:54:41:b5:60:2a:3d:f6:3f:64:1a:b4:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

1274699

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\REI_WS2\Production2\Release\Win32\REI_AVIRA.pdb

kernel32

GetACP ExitProcess GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency VirtualQuery VirtualAlloc LCMapStringW GetConsoleCP GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread HeapQueryInformation RtlUnwind OutputDebugStringW GetSystemInfo GetConsoleMode GetTimeZoneInformation ReadConsoleW SetFilePointerEx FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStringTypeW SetEnvironmentVariableW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetTempFileNameW Sleep SearchPathW GetProfileIntW GetTickCount GetTempPathW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryW FindResourceExW lstrcpyW VirtualProtect GetUserDefaultUILanguage GetCurrentDirectoryW GlobalFindAtomW FreeResource GetSystemDirectoryW EncodePointer SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime GlobalDeleteAtom ResumeThread SetThreadPriority GetCurrentThreadId WaitForSingleObject lstrcmpW GlobalFlags FreeLibrary lstrcmpiW LoadLibraryA LoadLibraryExW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose CreateFileW GlobalAddAtomW FileTimeToSystemTime GlobalGetAtomNameW lstrcmpA GetCurrentProcessId LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CompareStringW GetModuleHandleA DeleteCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RaiseException DecodePointer OutputDebugStringA SetLastError CopyFileW FormatMessageW MulDiv LocalFree GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc InitializeCriticalSectionAndSpinCount GetCurrentProcess LoadLibraryW GetModuleFileNameW SizeofResource CloseHandle SetEvent GetLastError CreateEventW GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetVersionExW FindResourceW LoadResource LockResource GetCommandLineW WriteConsoleW

user32

IsRectEmpty DrawFocusRect WindowFromPoint ReleaseCapture SetCapture GetNextDlgGroupItem GetMenuDefaultItem CreatePopupMenu LoadImageW TrackMouseEvent IntersectRect MapDialogRect GetAsyncKeyState OffsetRect SetRectEmpty SendDlgItemMessageA InflateRect GetMenuItemInfoW DestroyMenu GetNextDlgTabItem EndDialog CreateDialogIndirectParamW InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups SystemParametersInfoW CopyImage FillRect GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW GetTopWindow GetClassLongW EqualRect CopyRect MapWindowPoints ScreenToClient AdjustWindowRectEx GetClientRect RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow EndPaint BeginPaint GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem SetForegroundWindow IsIconic PostQuitMessage PostMessageW IsDialogMessageW SetWindowLongW GetIconInfo MessageBeep EnableScrollBar WaitMessage wsprintfW GetMenuStringW GetMenuState GetSubMenu CheckDlgButton GetDlgItem SetWindowPos MoveWindow ShowWindow IsWindow GetScrollPos SetScrollPos SetFocus CallNextHookEx SetWindowsHookExW HideCaret InvertRect NotifyWinEvent MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos DrawIconEx GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu UnhookWindowsHookEx GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush LoadCursorW SendMessageW EnableWindow IsWindowEnabled MessageBoxW GetWindowLongW GetParent GetWindowThreadProcessId GetLastActivePopup GetWindowTextW GetWindowTextLengthW DestroyIcon CharUpperW GetDlgCtrlID GetFocus SetWindowTextW GetWindowRect ClientToScreen PtInRect GetDesktopWindow GetClassNameW GetWindow PostThreadMessageW RealChildWindowFromPoint GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible GetActiveWindow GetKeyState ValidateRect GetCursorPos GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor GetComboBoxInfo ReuseDDElParam UnpackDDElParam InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW MonitorFromPoint UpdateLayeredWindow UnionRect DrawIcon FrameRect CopyIcon

gdi32

DeleteDC Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectW GetTextExtentPoint32W CreateSolidBrush CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW CreateRectRgn CreatePen CreateHatchBrush CreateCompatibleDC BitBlt GetObjectW SetTextColor SetBkColor CreateBitmap DeleteObject GetDeviceCaps CreateDCW CombineRgn CreatePatternBrush CopyMetaFileW

msimg32

TransparentBlt AlphaBlend

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueExW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetFileInfoW ShellExecuteW SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage DragFinish DragQueryFileW SHBrowseForFolderW SHGetDesktopFolder

shlwapi

PathStripPathW PathRemoveExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathFindExtensionW PathRemoveFileSpecW

uxtheme

GetThemeSysColor GetThemePartSize DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName IsThemeBackgroundPartiallyTransparent IsAppThemed GetWindowTheme

ole32

OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleLockRunning CreateStreamOnHGlobal RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoDisconnectObject ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc

oleaut32

VarBstrFromDate VariantChangeType VariantCopy VariantClear VariantInit SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysAllocStringLen LoadTypeLi SysFreeString

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromScan0

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

REI_SupportInfoTool.exe

IMPHASH e49487de084ca8ce60ac994542f3b43e
SHA256 3db3f8ecf4f3079182176fdfdb3c1f8c5d6bcd5ca6d18210d269f02260406295
MD5 ac11036bcc0ed4ea0e258cf7f8aff66c
SHA1 190065b5d1eb530509c87c0168ca20f194e6730a
SHA512 a99d8870da044e5182a2ec4b4a32e9de42fd79c73edf11897951636569259e3542f4ffe19281f7a676c7fc5ebecb30699dd6cd750c0e58e8e98440bfeefa08b8
SSDEEP 98304:+GD4R/FRQ9LVaxK76nDu1cS1PsZe/qVKw5KQ:+7dRQ95lf1cit6X
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

8e:f7:5f:87:7a:bd:2f:d9:29:22:58:21:40:ff:02:64:df:5c:c7:0a:ec:9d:a6:03:f1:ba:22:b6:67:88:29:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

46:b2:35:40:52:ed:44:da:b0:91:3f:8f:b9:c6:dd:ea:55:14:33:96

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

3189524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\REI_WS2\Production2\Release\x64\REI_SupportInfoTool.pdb

secur32

GetUserNameExW

kernel32

GetDriveTypeW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime GetCurrentDirectoryW GetStdHandle GetShortPathNameW WritePrivateProfileStringW CloseHandle DuplicateHandle GetCurrentProcess GlobalAlloc GlobalFree MoveFileExW Sleep LocalFree MulDiv FormatMessageW SetEvent ResetEvent CreateEventW GetCurrentProcessId ExitProcess CreateThread OpenThread TerminateThread SuspendThread ResumeThread WaitForMultipleObjects CreateToolhelp32Snapshot Thread32First Thread32Next QueryPerformanceCounter QueryPerformanceFrequency SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile MoveFileW TerminateProcess OpenProcess FindResourceExW GetModuleFileNameW GetModuleHandleW LoadLibraryW GetCommandLineW ExpandEnvironmentStringsW FileTimeToLocalFileTime OutputDebugStringW FreeLibrary GetProcAddress FileTimeToSystemTime GetFileAttributesExW GetSystemTime GetSystemInfo GetSystemDirectoryW GetFileAttributesW SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation LoadLibraryA GetVersionExA CreateFileMappingA GetFileTime FindFirstFileA FindNextFileA MoveFileA CreateFileA GetFileAttributesA SetFileAttributesA CreateDirectoryA ReadFile DeleteFileA GetTempPathA GetCurrentDirectoryA GetFullPathNameA GetFullPathNameW FileTimeToDosDateTime GetModuleFileNameA FormatMessageA GetComputerNameA GetOEMCP GetACP TlsSetValue TlsGetValue TlsAlloc FlushFileBuffers VerifyVersionInfoW VerSetConditionMask ReleaseSemaphore GetVersionExW GetComputerNameW GetFileSize GetTempPathW lstrcpyW lstrcmpA LocalAlloc DeviceIoControl TryEnterCriticalSection AreFileApisANSI HeapCreate UnlockFileEx HeapValidate GetDiskFreeSpaceA FlushViewOfFile HeapCompact LockFileEx WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage FindFirstFileExA SetFilePointerEx ReadConsoleW GetConsoleCP EnumSystemLocalesW IsValidLocale VirtualQuery VirtualAlloc GetCommandLineA SetStdHandle HeapQueryInformation FreeLibraryAndExitThread ExitThread GetConsoleMode GetFileType RtlUnwindEx RtlPcToFileHeader GetCPInfo LCMapStringW SwitchToThread GetStringTypeW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetUserDefaultLCID RemoveDirectoryW SetFileAttributesW GetTempFileNameW GetDiskFreeSpaceW RtlUnwind GetProfileIntW VirtualProtect GetUserDefaultUILanguage GlobalFlags GlobalFindAtomW GlobalAddAtomW WriteFile CreateFileW GetTickCount GetLocalTime GetCurrentThreadId InitializeCriticalSection CreateMutexW WaitForSingleObject ReleaseMutex InitializeCriticalSectionAndSpinCount WideCharToMultiByte MultiByteToWideChar CopyFileW FindResourceW SizeofResource LockResource LoadResource GetWindowsDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer CreateDirectoryW SearchPathW WaitForSingleObjectEx CreateEventA GetModuleHandleA GetDateFormatW GetTimeFormatW GetVolumeInformationW OutputDebugStringA GetLocaleInfoW SetThreadPriority GetThreadPriority CreateSemaphoreA CreateMutexA PulseEvent SetLastError GlobalSize GlobalLock GlobalUnlock LockFile SetEndOfFile UnlockFile GetModuleHandleExW LoadLibraryExW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GetFileSizeEx TlsFree GlobalReAlloc GlobalHandle LocalReAlloc CompareStringW GlobalGetAtomNameW EncodePointer FreeResource GlobalDeleteAtom lstrcmpW

user32

RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos GetMessageTime DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW IsMenu IsChild DestroyWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsIconic GetDlgItem GetDlgCtrlID SetFocus GetKeyState GetCapture GetMenu SetMenu TrackPopupMenu UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow ValidateRect RedrawWindow ScrollWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW RemovePropW GetClientRect GetWindowRect AdjustWindowRectEx MapWindowPoints CopyRect EqualRect PtInRect SetWindowLongW GetWindowLongPtrW SetWindowLongPtrW GetClassLongPtrW GetClassNameW GetTopWindow GetWindow SetWindowsHookExW CallNextHookEx LoadIconW SetScrollInfo GetScrollInfo WinHelpW MonitorFromWindow GetMonitorInfoW MoveWindow LoadCursorW CheckDlgButton SetWindowTextW IsDialogMessageW RealChildWindowFromPoint GetMessageW TranslateMessage GetActiveWindow GetCursorPos InflateRect IntersectRect DestroyIcon DestroyMenu GetMenuItemInfoW CopyImage SendDlgItemMessageA SetRectEmpty OffsetRect PostQuitMessage CreateDialogIndirectParamW EndDialog GetNextDlgTabItem GetAsyncKeyState MapDialogRect TrackMouseEvent InvalidateRect LoadImageW ShowOwnedPopups SetCursor DeleteMenu SetTimer KillTimer GetNextDlgGroupItem SetCapture ReleaseCapture WindowFromPoint DrawFocusRect IsRectEmpty DrawIconEx GetIconInfo MessageBeep EnableScrollBar HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetMenuDefaultItem MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongPtrW SetWindowRgn SetParent OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyIcon FrameRect DrawIcon UnionRect UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetRect LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor GetWindowThreadProcessId PostThreadMessageW ShowWindow SystemParametersInfoW PostMessageA FindWindowA SendMessageW GetSysColorBrush GetDesktopWindow CharUpperW FillRect GetSysColor ScreenToClient ClientToScreen EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetLastActivePopup IsWindowEnabled EnableWindow LoadBitmapW GetParent SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus UnhookWindowsHookEx RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetWindowLongW GetWindowTextW IsWindowVisible IsWindow PostMessageW GetSystemMetrics MessageBoxW GetWindowTextLengthW

gdi32

GetSystemPaletteEntries CopyMetaFileW CreateDCW GetDeviceCaps CreateBitmap BitBlt CreateCompatibleDC CreateHatchBrush CreatePen CreatePatternBrush CreateRectRgn CreateSolidBrush DeleteObject Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign GetObjectW MoveToEx TextOutW ExtTextOutW GetTextFaceW DeleteDC SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateFontIndirectW CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextExtentPoint32W GetTextMetricsW EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle GetRgnBox OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx

advapi32

CryptGetHashParam RegDeleteKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW RegSaveKeyExW GetUserNameW RegCloseKey RegQueryValueExW AddAccessAllowedAce AllocateAndInitializeSid CryptGetUserKey CryptCreateHash CryptHashData CryptDestroyKey CryptExportKey CryptGetProvParam CryptEnumProvidersA CryptAcquireContextW CryptGenRandom CryptReleaseContext RegQueryValueExA RegSetValueExA CryptAcquireContextA RegCreateKeyExA RegOpenKeyExA GetUserNameA FreeSid RegSetValueExW RegDeleteValueW RegCreateKeyExW RegSetKeySecurity RegGetKeySecurity IsValidSid IsValidSecurityDescriptor IsValidAcl EqualSid RegEnumValueW ConvertSidToStringSidW LookupAccountNameW RegEnumKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW RegUnLoadKeyW RegLoadKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW SetFileSecurityW MakeAbsoluteSD

shell32

DragQueryFileW ShellExecuteW SHGetFolderPathW DragFinish SHBrowseForFolderW SHAppBarMessage SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetDesktopFolder SHFileOperationW

ole32

OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator OleGetClipboard CoUninitialize DoDragDrop CreateStreamOnHGlobal CoDisconnectObject StringFromGUID2 RevokeDragDrop ReleaseStgMedium OleDuplicateData CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid RegisterDragDrop CoLockObjectExternal IsAccelerator

oleaut32

VariantInit VarBstrFromDate VariantCopy VariantChangeType VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi SysAllocString SysAllocStringLen VariantClear SysFreeString

msimg32

TransparentBlt AlphaBlend

shlwapi

SHDeleteKeyW PathIsUNCW PathStripToRootW UrlUnescapeW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW StrFormatKBSizeW PathFileExistsW

uxtheme

DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed DrawThemeText

gdiplus

GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipGetImageWidth GdipDisposeImage GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdiplusStartup GdipFree GdipAlloc GdipBitmapLockBits GdipCloneImage GdiplusShutdown

dbghelp

MiniDumpWriteDump

ws2_32

send WSAGetLastError shutdown __WSAFDIsSet select inet_addr recv accept getsockname bind listen socket inet_ntoa ntohs ioctlsocket setsockopt htons connect closesocket WSAStartup gethostbyname

wininet

InternetSetOptionW InternetGetLastResponseInfoW InternetOpenA InternetCloseHandle InternetSetStatusCallbackW InternetQueryDataAvailable InternetSetFilePointer InternetOpenW InternetCanonicalizeUrlW InternetCrackUrlW FtpGetFileSize FtpCommandW FtpSetCurrentDirectoryW FtpCreateDirectoryW FtpOpenFileW FtpPutFileW InternetWriteFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetReadFile InternetConnectW

oleacc

LresultFromObject CreateStdAccessibleObject AccessibleObjectFromWindow

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

winmm

PlaySoundW

psapi

GetModuleFileNameExW

crypt32

CryptDecodeObject CryptMsgClose CryptMsgGetParam CertCloseStore CertFreeCertificateContext CryptMsgControl CertGetCertificateContextProperty CertGetSubjectCertificateFromStore CryptMsgUpdate CryptMsgOpenToDecode CryptDecryptMessage CertOpenStore CryptEncodeObject CryptEncryptMessage CertDuplicateCertificateContext CertEnumCertificatesInStore CertSetCertificateContextProperty CertNameToStrW CertCreateCertificateContext

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

generic

count=20, id=241, version=40116,

count=232, id=243, version=40116,

count=33, id=242, version=40116,

count=6, id=199, version=41118,

count=36, id=260, version=26706,

count=10, id=259, version=26706,

count=387, id=261, version=26706,

count=11, id=206, version=65501,

count=5, id=208, version=65501,

count=1, id=207, version=65501,

count=315, id=171, productName=VS2010 build 30319, version=30319,

count=8, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=260, version=27045,

count=55, id=203, version=65501,

count=1118, id=1, productName=Unmarked objects,

count=36, id=265, version=27045,

count=214, id=261, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,

Reimage.exe

IMPHASH d838112c1be96acd678110734ab66546
SHA256 a42f5b0735c4e6dec3832ef8cc7c76884cc086e7323a2d03728f261936beb325
MD5 565319f9015978e86083f9cfbe81f3c5
SHA1 9ec39e7268ff6bccb65fd29a37cff66fccc0f461
SHA512 ace0f3d19d7c2a4d2e357b9aefba35960e4513258679750d577b6f20755fe8b885b874e8f807aabf69e806ca21177c5d3dd55f9b1c001fd493a83f04532e5e75
SSDEEP 98304:Ghc5TcE4fQbvDLqVZPjBwn5Tp6r11+X/mzxpbuzvl0CTMb:GhcOTm3qTQa1YSorTMb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

2b:83:77:d2:23:b9:42:8b:c6:db:8e:13:59:e4:a9:40:87:3b:8c:3e:7e:ad:27:77:0d:92:f9:a9:52:14:05:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

f1:e3:36:a9:a5:44:88:94:5a:ed:05:0b:d8:b8:2b:7a:72:9b:6c:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

3046636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\REI_WS2\Production2\Release-ConsumerConatiner\x64\Reimage.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

EnumProcesses GetProcessImageFileNameW

wininet

InternetCloseHandle InternetSetCookieW InternetGetCookieW InternetOpenW

dwmapi

DwmSetWindowAttribute

kernel32

GetStartupInfoW GetConsoleCP LCMapStringW GetStringTypeW GetStdHandle GetFileType SetStdHandle VirtualQuery GetSystemInfo HeapQueryInformation ResetEvent ExitThread GetCommandLineA RtlUnwindEx RtlPcToFileHeader QueryPerformanceFrequency LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList OutputDebugStringW InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SearchPathW GetProfileIntW VerifyVersionInfoW VerSetConditionMask SetErrorMode GetWindowsDirectoryW SystemTimeToTzSpecificLocalTime GetFileSizeEx GetFileAttributesExW GetStringTypeExW lstrcmpiW GetCurrentProcess DuplicateHandle UnlockFile SetEndOfFile LockFile GetShortPathNameW FlushFileBuffers VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags IsDebuggerPresent GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetThreadLocale LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc ReplaceFileW GetTempFileNameW GetDiskFreeSpaceW WritePrivateProfileStringW CompareStringA lstrcmpA GetCurrentThread GlobalGetAtomNameW SetThreadPriority SetEvent CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW GetModuleHandleExW FreeResource GetSystemDirectoryW EncodePointer MulDiv WaitForSingleObjectEx GlobalUnlock GlobalLock GlobalSize CreateEventW OutputDebugStringA GetVolumeInformationW FindNextFileW FindFirstFileW LoadLibraryA GetVersionExA GetTimeZoneInformation GetFileSize ReadFile SetFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime GetLocalTime FileTimeToSystemTime InitializeCriticalSection SetFilePointer FindClose MoveFileA MoveFileW CreateFileA GetFileAttributesA SetFileAttributesW SetFileAttributesA CreateDirectoryA DeleteFileA CopyFileW GetTempPathA GetTempPathW GetCurrentDirectoryA GetFullPathNameA GetFullPathNameW FormatMessageA GetComputerNameA GetOEMCP GetACP LocalFree lstrlenW lstrcatW lstrcpyW FormatMessageW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer SystemTimeToFileTime GetVersionExW GetSystemTime GetVersion GetFileTime ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar IsBadReadPtr LoadLibraryW FreeLibrary FindResourceExW UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW GetTickCount GetThreadTimes CreateProcessW ResumeThread SuspendThread CreateThread TerminateProcess GetCurrentProcessId Sleep OpenMutexW CreateMutexW WaitForSingleObject ReleaseMutex InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError WriteFile DeleteFileW CreateFileW CreateDirectoryW GetCommandLineW GlobalFree GlobalAlloc GetProcAddress GetModuleFileNameW OpenProcess GetCurrentThreadId ExitProcess QueryDosDeviceW GetFileAttributesW GetDriveTypeW GetCurrentDirectoryW GetModuleHandleW Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW lstrcpynW SizeofResource LockResource LoadResource DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException CloseHandle GetConsoleMode SetFilePointerEx ReadConsoleW FindFirstFileExW IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleW FreeLibraryAndExitThread

user32

SetRectEmpty InsertMenuItemW DestroyMenu CreatePopupMenu TranslateAcceleratorW LoadAcceleratorsW ReleaseCapture TranslateMessage GetMessageW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton MoveWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx SetWindowsHookExW GetWindow GetLastActivePopup GetTopWindow GetClassLongPtrW EqualRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect SetActiveWindow TrackPopupMenu SetMenu GetMenu GetCapture IntersectRect GetDlgCtrlID GetDlgItem EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild IsMenu InvalidateRgn GetNextDlgGroupItem MessageBeep TrackMouseEvent GetMenuDefaultItem LockWindowUpdate DrawFocusRect GetClassInfoW RegisterClassW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW SetMenuItemInfoW GetIconInfo SetMenuItemBitmaps EnableMenuItem CheckMenuItem GetFocus GetSysColor ClientToScreen EndPaint BeginPaint TabbedTextOutW GrayStringW DrawTextExW DrawTextW UnhookWindowsHookEx SetParent AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetMenuState GetMenuStringW FindWindowA GetWindowLongPtrW CallWindowProcW DefWindowProcW PostMessageA WindowFromPoint GetWindowTextW GetAsyncKeyState PostMessageW SystemParametersInfoW UnpackDDElParam ReuseDDElParam InflateRect IsZoomed GetMenuItemInfoW PostQuitMessage ShowOwnedPopups RegisterClipboardFormatW SetWindowContextHelpId MapDialogRect SetCapture DrawIcon IsRectEmpty GetSysColorBrush GetClassNameW GetClassNameA RealChildWindowFromPoint CopyImage SendDlgItemMessageA GetKeyNameTextW MapVirtualKeyW UnionRect GetSystemMenu SetFocus EnableScrollBar HideCaret InvertRect NotifyWinEvent EnumDisplayMonitors SetClassLongPtrW OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl SetRect CharUpperW CharNextW SetCursorPos RegisterWindowMessageA SendMessageW UnregisterClassW SetTimer EnableWindow GetClientRect LoadBitmapW GetKeyState GetSystemMetrics CopyIcon GetWindowDC ReleaseDC GetWindowRect SetCursor ScreenToClient FillRect CopyRect OffsetRect PtInRect FindWindowW LoadCursorW GetDC SetWindowRgn GetDesktopWindow LoadIconW DestroyIcon LoadImageW DrawIconEx wsprintfW RegisterWindowMessageW SendMessageTimeoutW AttachThreadInput BringWindowToTop KillTimer LoadMenuW GetSubMenu SetMenuDefaultItem GetForegroundWindow SetForegroundWindow GetCursorPos GetWindowThreadProcessId PostThreadMessageW WaitForInputIdle RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow DestroyWindow ShowWindow SetLayeredWindowAttributes FlashWindow CloseWindow IsWindowVisible IsIconic UpdateWindow InvalidateRect MessageBoxW GetWindowLongW SetWindowLongW SetWindowLongPtrW GetParent EnumChildWindows EnumWindows FrameRect UpdateLayeredWindow MonitorFromPoint GetComboBoxInfo DeleteMenu RemoveMenu CopyAcceleratorTableW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable GetDoubleClickTime ModifyMenuW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DestroyCursor GetWindowRgn CreateMenu SubtractRect TranslateMDISysAccel GetMenuCheckMarkDimensions DefMDIChildProcW

gdi32

ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectW CreateRectRgnIndirect GetMapMode PatBlt SetRectRgn DPtoLP GetTextExtentPoint32W GetTextMetricsW CreateEllipticRgn Ellipse CreateDIBSection LPtoDP GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette TextOutW EnumFontFamiliesW GetTextCharsetInfo SetPixel SetDIBColorTable CreatePolygonRgn Polygon Polyline CreateRoundRectRgn OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW MoveToEx SetTextAlign SetTextColor SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape CreatePatternBrush CreateHatchBrush CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW StretchBlt DeleteObject CreateCompatibleBitmap CombineRgn DeleteDC CreateRectRgn GetObjectW SelectObject Rectangle CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateDIBitmap BitBlt

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

SetFileSecurityW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegEnumKeyExW GetUserNameA RegOpenKeyExA RegCreateKeyExA CryptAcquireContextA RegSetValueExA RegQueryValueExA CryptReleaseContext CryptGenRandom CryptExportKey CryptDestroyKey CryptEnumProvidersA CryptGetProvParam CryptGetUserKey CryptAcquireContextW RegSetValueW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegQueryValueW RegEnumValueW RegCloseKey GetFileSecurityW

shell32

ShellExecuteW SHGetSpecialFolderPathW DragQueryFileW DragFinish SHAddToRecentDocs ExtractIconW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW SHGetDesktopFolder Shell_NotifyIconW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW AssocQueryStringW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathIsUNCW PathFindExtensionW

uxtheme

GetThemeSysColor GetWindowTheme GetCurrentThemeName GetThemeColor IsAppThemed GetThemePartSize CloseThemeData OpenThemeData DrawThemeParentBackground IsThemeBackgroundPartiallyTransparent DrawThemeBackground DrawThemeText

ole32

OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard CoInitializeEx StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoRevokeClassObject CoGetClassObject CoDisconnectObject OleDraw CreateStreamOnHGlobal OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc StringFromCLSID CoSetProxyBlanket OleRun CLSIDFromProgID CLSIDFromString CreateILockBytesOnHGlobal CoCreateInstance CoInitialize CoUninitialize DoDragDrop StgOpenStorageOnILockBytes

oleaut32

LoadTypeLi SysAllocStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen SysStringLen VariantChangeType VariantCopy VariantInit VariantClear SysFreeString SysAllocString VarBstrFromDate OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreate

oledlg

OleUIBusyW

urlmon

URLDownloadToFileW

gdiplus

GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipAlloc GdiplusShutdown GdipDrawImageRectI GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree

setupapi

SetupIterateCabinetW

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

crypt32

CertNameToStrW CertFreeCertificateContext CertSetCertificateContextProperty CryptDecodeObject CertGetCertificateContextProperty CertDuplicateCertificateContext CertCreateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetSubjectCertificateFromStore CryptMsgControl CryptMsgGetParam CryptMsgClose CryptMsgUpdate CryptMsgOpenToDecode CryptDecryptMessage CryptEncodeObject CryptEncryptMessage

ws2_32

setsockopt ioctlsocket ntohs inet_ntoa inet_addr htons select __WSAFDIsSet closesocket shutdown WSAGetLastError send recv getsockname bind gethostbyname socket connect WSAStartup

ReimageCLS.exe

IMPHASH e0954cec0701c8cbd3fb3b1113671113
SHA256 d7015958a7d2b00bbb591031fc467782ce7116297f9592543668827dbd8f8878
MD5 ee2c6f9395ce60f5f3c7a9588a37d306
SHA1 008c79d954977d3fa99e471a3eadb88782e87837
SHA512 ebf2bca22d990d5ff80dcafd2bf575ef66265cb701ebbe95dde0bf2aa19a000e3ceff7d2ac904fd0fac967c36a016efe89521dd3a86614481b7f73d9267e9ef6
SSDEEP 3072:0XyuYSVnJ1uaIbvuSVowd0aAnfSbjrUfGzTXC4Nv1BXylOKIA3OVfTsMrSEg0J3Y:WVnJkaKvlN0FfejrTrC4LcOKwTrv3/3A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

a5:20:2f:64:16:74:f5:f8:eb:7d:95:fc:b5:28:14:6b:f7:ca:3c:d2:0c:d6:fa:34:30:87:ee:c5:7d:d3:32:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

04:44:76:f8:ce:7d:e7:06:92:c0:0f:f6:e3:9d:cb:e7:9f:d1:e2:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

2

Major OS version

5

Entry point

47696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\REI_WS2\Production2\Release\x64\REI_CommandLine.pdb

kernel32

SizeofResource HeapFree InitializeCriticalSectionAndSpinCount FreeLibraryAndExitThread HeapSize MultiByteToWideChar Sleep GetLastError LockResource HeapReAlloc RaiseException FreeConsole LoadLibraryW FindResourceExW LoadResource FindResourceW HeapAlloc HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap WideCharToMultiByte GetCommandLineW GetVersionExW CreateFileW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetACP CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers

shell32

ShellExecuteW

ReimageReminder.exe

IMPHASH 0ad00114bce662b2318c7a6c9e3b1c32
SHA256 aa5deebc70e449a14600dd7381368c3ea3de3465b22bd51725d8bf1f537dff76
MD5 aca1fdbf38f8cf11b6d08e54e8bc8344
SHA1 bf7d19b461d650274a8888beaff4407b3fe5980e
SHA512 f395f15a3463a92f3b263f4135810c04db222ded807160d12f4ca07a8b6da02d3ff7a6376fbf406e9476fc9dcae1df2bb87d0ac7610e3f2fdfcdfc87a4f3d438
SSDEEP 49152:8giwliz4HQWOeNZsvdokR4+It5HnA2OTXSSkvwf4pKYrmbxg+tKS3laVJwUHXsGP:ctL9hv4S3lCxHXsG+R5vP9JQEg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

a2:5c:36:b1:56:c9:0f:b1:9d:06:7d:84:b4:7b:22:f3:36:ca:34:38:d3:ad:e8:b1:dd:84:64:51:51:ab:a1:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

85:ea:10:da:e1:73:6e:cc:61:bc:59:a4:ef:88:5f:f8:3b:06:0f:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 19, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

2883420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\REI_WS2\Production2\Release\x64\ReimageReminder.pdb

kernel32

HeapQueryInformation GetCommandLineA FreeLibraryAndExitThread ExitThread VirtualQuery GetSystemInfo RtlPcToFileHeader RtlUnwindEx LCMapStringW GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW SetStdHandle IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW WriteConsoleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent QueryPerformanceFrequency GetFileType GetStdHandle FindFirstFileExW GetTempFileNameW SearchPathW GetProfileIntW VerifyVersionInfoW VerSetConditionMask SetErrorMode SystemTimeToTzSpecificLocalTime GetFileSizeEx GetFileAttributesExW VirtualProtect GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount GetThreadLocale lstrcmpiW GetCurrentProcess DuplicateHandle UnlockFile SetEndOfFile LockFile GetVolumeInformationW FlushFileBuffers lstrcpyW GetCurrentProcessId WritePrivateProfileStringW lstrcmpA GetCurrentThread SetThreadPriority CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryW LoadLibraryExW GetModuleHandleExW GetModuleHandleW FreeResource GetSystemDirectoryW GetCurrentThreadId EncodePointer OutputDebugStringA FormatMessageW MulDiv GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc SetLastError FindResourceExW FreeLibrary FindNextFileW FindFirstFileW LoadLibraryA GetProcAddress GetVersionExA GetTimeZoneInformation GetFileTime InitializeCriticalSection SetFilePointer FindClose CreateDirectoryW MoveFileA MoveFileW CreateFileA SetFileAttributesW SetFileAttributesA CreateDirectoryA DeleteFileA DeleteFileW CopyFileW GetModuleFileNameW GetTempPathA GetTempPathW GetCurrentDirectoryW GetCurrentDirectoryA GetFullPathNameA GetFullPathNameW FileTimeToLocalFileTime GetSystemTime FileTimeToSystemTime FormatMessageA GetComputerNameA GetOEMCP GetACP Sleep LocalFree OpenThread GetTickCount WideCharToMultiByte CreateProcessW ExitProcess GetFileSize GetFileAttributesA K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess ResumeThread CreateFileW Thread32First Thread32Next TerminateProcess WriteFile ReadFile GetFileAttributesW GetPrivateProfileIntW OpenMutexW GetWindowsDirectoryW GetPrivateProfileStringW GetVersionExW CreateThread CloseHandle SetEvent CreateEventW WaitForSingleObject CreateMutexW SizeofResource GetCommandLineW MultiByteToWideChar SystemTimeToFileTime GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer GetLocalTime HeapAlloc FindResourceW LoadResource RaiseException HeapReAlloc LockResource OutputDebugStringW GetLastError HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree VirtualAlloc

user32

SetWindowContextHelpId IsRectEmpty SetRect InvalidateRgn InvalidateRect CopyAcceleratorTableW ReleaseCapture SetCapture CharNextW IntersectRect MapDialogRect GetAsyncKeyState RealChildWindowFromPoint OffsetRect SetRectEmpty SendDlgItemMessageA CopyImage SystemParametersInfoW InflateRect GetMenuItemInfoW DestroyMenu LoadCursorW GetSysColorBrush CharUpperW GetWindowThreadProcessId SetCursor ShowOwnedPopups PostQuitMessage GetCursorPos TranslateMessage GetMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem FillRect ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW IsWindowEnabled DeleteMenu OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge LoadIconW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetWindow GetLastActivePopup GetTopWindow GetClassNameW DrawFrameControl GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW PtInRect EqualRect WindowFromPoint GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos DrawFocusRect DrawIconEx GetIconInfo EnableScrollBar HideCaret InvertRect NotifyWinEvent SetWindowRgn MapVirtualKeyW GetKeyNameTextW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongPtrW DestroyIcon TrackMouseEvent LoadImageW CreatePopupMenu GetMenuDefaultItem RegisterClipboardFormatW GetNextDlgGroupItem SetParent MessageBeep UnregisterClassW EnableWindow IsIconic GetClientRect DrawIcon GetSystemMetrics SendMessageW GetDesktopWindow KillTimer SetWindowLongW SetWindowsHookExW UnhookWindowsHookEx ClientToScreen SetTimer CallNextHookEx SetWindowPos GetWindowRect GetWindowLongW GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos GetMessageTime PostMessageW DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW IsWindow IsMenu IsChild DestroyWindow GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible GetDlgItem GetDlgCtrlID SetFocus GetFocus GetKeyState GetCapture GetMenu SetMenu TrackPopupMenu UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow BeginPaint EndPaint ValidateRect RedrawWindow ScrollWindow SetScrollPos IsZoomed GetSystemMenu BringWindowToTop SetCursorPos CopyRect CopyIcon FrameRect PostThreadMessageW UnionRect UpdateLayeredWindow MonitorFromPoint LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor GetParent

gdi32

SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateFontIndirectW GetTextExtentPoint32W GetTextMetricsW CombineRgn CreateRectRgnIndirect GetMapMode PatBlt SetRectRgn DPtoLP GetBkColor GetTextColor GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateEllipticRgn Ellipse SetViewportOrgEx Polygon Polyline CreateRoundRectRgn LPtoDP Rectangle OffsetRgn RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW SetViewportExtEx ExtTextOutW TextOutW MoveToEx SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetClipBox ExcludeClipRect Escape DeleteObject CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt GetObjectW SetTextColor SetBkColor DeleteDC CopyMetaFileW CreateDCW CreatePolygonRgn GetObjectType GetDeviceCaps

msimg32

TransparentBlt AlphaBlend

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey GetUserNameA RegOpenKeyExA RegCreateKeyExA CryptAcquireContextA CryptReleaseContext CryptGenRandom RegSetValueExA RegQueryValueExA CryptExportKey CryptDestroyKey CryptEnumProvidersA CryptGetProvParam CryptGetUserKey CryptAcquireContextW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegQueryValueExW RegEnumValueW RegQueryValueW

shell32

SHAppBarMessage DragFinish DragQueryFileW SHGetFileInfoW SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ShellExecuteExW ShellExecuteW CommandLineToArgvW SHGetDesktopFolder

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

GetWindowTheme DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetThemePartSize IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeSysColor

ole32

IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject CreateStreamOnHGlobal CoInitializeEx OleUninitialize OleInitialize CoFreeUnusedLibraries CLSIDFromProgID CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CLSIDFromString CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen DispCallFunc LoadRegTypeLi VariantCopy SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VarBstrFromDate LoadTypeLi OleCreateFontIndirect SafeArrayDestroy SysFreeString SafeArrayGetElemsize

oledlg

OleUIBusyW

gdiplus

GdipSetInterpolationMode GdiplusShutdown GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdipDrawImageRectI

ws2_32

connect socket gethostbyname bind getsockname recv send WSAGetLastError shutdown closesocket __WSAFDIsSet select htons inet_addr inet_ntoa ntohs ioctlsocket setsockopt WSAStartup

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

crypt32

CertNameToStrW CertFreeCertificateContext CertSetCertificateContextProperty CryptDecodeObject CertGetCertificateContextProperty CertDuplicateCertificateContext CertCreateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetSubjectCertificateFromStore CryptMsgControl CryptMsgGetParam CryptMsgClose CryptMsgUpdate CryptMsgOpenToDecode CryptDecryptMessage CryptEncodeObject CryptEncryptMessage

ReimageSafeMode.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 299d60f623698d7c00d998a5dd4636a0e40dadd03500f2ae8148b190feafe9ba
MD5 e1533eaffad6f6d5d25022e43126fa38
SHA1 6048cbf2b8a366b98f24c8b45a6003c805791d3f
SHA512 7d12e8a63d07cdda57d28cadfc947561aee6413a302b6840ac8f077ab6350a6e1fa4e6ce61bbebdcafd7c01c73f4dbffdc96c3e0d0526ad8da424f6bdd070d7b
SSDEEP 6144:m50gUCL93xHlDnQqK3RTGzh2hQ8E9QcwtzH+gTBxnlimMb8GVNVOaj7g0EgVPB:Y0gPPlDQ73RT7E9YzewxnlelOq8+B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

e4:70:6a:e7:6f:95:bc:10:f2:bf:bf:d9:dd:43:c8:42:d5:c1:cc:9b:4f:d0:91:d1:6f:89:77:66:de:ff:88:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HE 252212,CN=Reimage LTD.,O=Reimage LTD.,L=Strovolos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Chains

Feb 26, 2020

SERIALNUMBER=HE 252212,CN=Reimage LTD.,O=Reimage LTD.,L=Strovolos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

e3:10:50:9e:c0:4d:48:c7:d5:87:c9:83:75:79:ad:af:71:89:33:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=HE 252212,CN=Reimage LTD.,O=Reimage LTD.,L=Strovolos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Chains

Feb 26, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HE 252212,CN=Reimage LTD.,O=Reimage LTD.,L=Strovolos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Serial Number

02:a2:cf:da:6c:4c:75:dd:2d:a3:a4:69:76:5b:9c:00

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 11, 2019 - Mar 2, 2022

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HE 252212,CN=Reimage LTD.,O=Reimage LTD.,L=Strovolos,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Serial Number

09:d1:40:39:e6:51:79:66:f2:1e:8a:25:da:e6:21:9c

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Mar 2, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ExecDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 0deb397ca1e716bb7b15e1754e52b2ac
SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH 3f0fda09180f619ca116344bede41608
SHA256 fe2093ff4bfa1d7259c922aca1e7bb219c4d234e469942446d9e2f8086b7d720
MD5 a75e3775daac9958610ce1308e0bca3b
SHA1 d83ce354cde527c2e20fb425415f6d4795dd4cd4
SHA512 48168a91ec90df262b1e158f32b4bc2a6d6ce10022eb96d4a6f3c755b977e5c104558626adaa214bda29d7f1d246f19e2df59b9a338982aa1c623e1bdd5714c6
SSDEEP 3072:oa/4Ftm9rSlia00FW96LOsWNQmtQ9WVx95+tTIJ:t/4S9raiae8DSDtQ9W3utEJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Unicode\Plugins\IpConfig.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalAlloc lstrcpynW GlobalFree lstrcpyW FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA HeapFree GetProcessHeap GetLastError GetCurrentThreadId GetCommandLineA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer WriteFile GetConsoleCP GetConsoleMode MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WmiInspector.dll

IMPHASH 7f0e53ce204644197ed8a4abb8792a26
SHA256 fe268b2259429b6d5efdae9a5dfe621214b2e2c22f03087b2f5f7132596f9f8d
MD5 1a0b4ff3847dc729ed2ee669c8ac0519
SHA1 a179ca7c5adabd0e1aaa7fe36309770d774ffa43
SHA512 118f82fc4e90a03a18f7dccc1facf35eb5a8f0fe092ce4b4b7b1ddb7987efcc9d50674418e004b992a6be35c5e18e7d659843a1bdce9694e5435060c158cc416
SSDEEP 1536:vRhrWA5HRhMz7n8eA9G9gVoAdqszdwKKEPdLQndOpP6nSBEkD7MvvyIXiD:vnSFjLEPdUdOr4SIX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\sources\NSISplugins\WmiInspector\Release\WmiInspector.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar FlushFileBuffers CloseHandle CreateFileW GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle GetLastError lstrlenA LocalFree GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc RtlUnwind EncodePointer RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleFileNameW HeapSize IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LoadLibraryW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocStringByteLen VariantClear SysStringLen SysAllocString

$PLUGINSDIR/inetc.dll

IMPHASH 86cdacc6fa5e3ff4938d358350751516
SHA256 9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2
MD5 5da9df435ff20853a2c45026e7681cef
SHA1 39b1d70a7a03e7c791cb21a53d82fd949706a4b4
SHA512 4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f
SSDEEP 768:FRci+9MscTJMR2+d8heiwhSruaFajMGbJDVVG08:Fg9sTJv+AVwhl25ci
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcstol _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul wcsstr wcschr memset _chkesp

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW CreateFileW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
MD5 7059f133ea2316b9e7e39094a52a8c34
SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 1d4c3b4184538309e9572bd9e8bf2bb3e5b996592169da9bac3488d41672cfcb
MD5 d9c765fe2f48c840178b2466c1080f15
SHA1 98d4d7a8611b82a08a616e7fb1d41f0043b7c7d0
SHA512 39214f9fc8ae01772e5a7d6dedd8f1b3869d45260a7512899847dbd18a2687726896077e3a45fb7b2e1ec4d15ef5bd48d2964e10ad233d38bf02fd0f21cf9e5f
SSDEEP 96:8wViSwBT9Cg0Dvxn6GuKM9sh1gdrN9+oB7FT9nGogZcko5Nt4A:8XSACgRK8hlHZkKQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4580

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Reimage_SafeMode.ico

SHA256 a8b3c399af25f05b095e6dadd86f5d63a26a728da8a239047696fc269632794f
MD5 e8930e339f01ed0a30cb9253c5e78664
SHA1 d916b90f29c6bf7e2a5114d5cb51fcf2d8cf2785
SHA512 bde4ec633e191f8ca03941b57757cc2b5fbe3f5ccc5c98f4df084e03b699ba7b2429d58a3115368b5ab2918cdb161912900ef7781be884cad594d9fad3d6cbf2
SSDEEP 192:OyDudYkfBVEcWN0hHkvA0Yh2A10SvWPRoHiRAubhLXeI/9tSf9aPtD:OpdYkDEcHhHyYsA10SvioCR/9DVUYp
MD5 SHA1 SHA512 SSDEEP

Reimage_uninstall.ico

SHA256 0b184043262a6b5b75921072dbf8b4db02c5f345ebcd2706494f57822745bae5
MD5 a2d1e86ff0ea91cd11c5ee4a990a0295
SHA1 42607b7ef37d6642d7c54ef8ba36422e291b8096
SHA512 d4a4972c7642dd5edc0a6c646c59f7ff514133c14a18c7b9f4179b1cae44213da34e3b63e13210200a9f8ba4f330cdc457630cd43e0214f2e278bf9020fdc2bc
SSDEEP 192:nGJvSxSkbOooPmn12lLyQYY5F7ocfN2ulmMMKkIr:nGsOP02l/HbNlmM4Ir
MD5 SHA1 SHA512 SSDEEP

Reimage_website.ico

SHA256 4cd87fae5f1325b6dc39fac4ffcd7cd601d1ae2c08d478bf1a8aa1bfeaa657ab
MD5 ff4f1010ea7f15d2e1a016a25b56c598
SHA1 37657197d12a5ad55676f0234cc85e438f954506
SHA512 8ad24aa772ca687c91f033c1c02bce28355ab1ebbf231bddb5eebb2c239b838b5a923f5467041303435b9a2d7b00810b5c3404f687caf145cac7e37c4fdadd96
SSDEEP 192:QTcOyzvXVLYOoIy7aOiSEOsiWi6Hr6m0eoolMzn/culmMMKkIr:QTcOsjwHlEpGS1PpW5lmM4Ir
MD5 SHA1 SHA512 SSDEEP

Reimageicon.ico

SHA256 287ccc5d356434994a669cfb919475bb0a2cee54b1e6f34fbdabcf179a0b27dc
MD5 760597e4323eb511b4bf4ee00a3d1992
SHA1 782ad50a673139f9902c8e1ccb8851c437337d26
SHA512 a873e694f3a88f7bd52ac1abccfbdff74b1eb7f808115b772aa6f9a144fdb7591f8e3f302818ca7175653e202eb5764438f3b0bba514218a41b883a237ec8f70
SSDEEP 96:bNLCCCCCChvKMYhXPbvqKDlkz/MMMMMMMMMTLUNCEM7NCCCCCCCCCCCCCltCCCCe:ZkvLkxOooM9o6p62ulmMMKkIr
MD5 SHA1 SHA512 SSDEEP

engine.dat

SHA256 2c4deb59814ed81764f536f5b5706704f26a3ef4893ac4f2116c43dd7e0f0fde
MD5 7f47cc9c180120cff954b4de3a19a772
SHA1 8c833da23086b73b0c34c4252f833fb4eb4dcba4
SHA512 25b2d6a43831473f177b68747e0956b2bb2047b8e1e05f47e335e5227618b6104040600b921cba7ae134fc72012019e255b5d914ff7d22bbbeda889143ee7dc6
SSDEEP 98304:KnZRJ+XHdn7pDa2FU4L0ICsGJjOqa2PTlzP:gMXJd1UG0IxsOOLdP
MD5 SHA1 SHA512 SSDEEP

msvcr120.dll

IMPHASH aa8d086deb6960b10f8791df466a5610
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 15, 2024

PE Signature issue

Digest

3f:08:90:50:77:63:e4:04:ba:19:2c:b1:94:32:e7:d0:82:51:35:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 5, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

72260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr120.i386.pdb

kernel32

EncodePointer DecodePointer RaiseException GetLastError ExitProcess GetModuleHandleW GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCommandLineW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetModuleFileNameA SetLastError GetCurrentThread GetModuleFileNameW IsProcessorFeaturePresent GetStdHandle WriteFile FindClose FindFirstFileExA FindNextFileA FindFirstFileExW FindNextFileW CloseHandle CreateThread ExitThread ResumeThread LoadLibraryExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode Beep Sleep GetFullPathNameA GetCurrentProcessId GetFileAttributesExW SetFileAttributesW GetFullPathNameW CreateDirectoryW MoveFileExW RemoveDirectoryW GetDriveTypeW DeleteFileW SetEnvironmentVariableA SetCurrentDirectoryA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SetEnvironmentVariableW WaitForSingleObject GetExitCodeProcess CreateProcessA FreeLibrary LoadLibraryExA CreateProcessW ReadFile GetTempPathA GetTempPathW DuplicateHandle GetCurrentProcess GetSystemTimeAsFileTime GetTimeZoneInformation GetLocalTime LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime SetLocalTime InterlockedPopEntrySList InterlockedFlushSList QueryDepthSList InterlockedPushEntrySList CreateTimerQueue SetEvent WaitForSingleObjectEx UnregisterWait TlsGetValue SignalObjectAndWait TlsSetValue SetThreadPriority ChangeTimerQueueTimer CreateTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject GetLogicalProcessorInformation RtlCaptureStackBackTrace GetThreadPriority GetProcessAffinityMask SetThreadAffinityMask TlsAlloc DeleteTimerQueueTimer TlsFree SwitchToThread TryEnterCriticalSection SetProcessAffinityMask VirtualFree GetVersionExW VirtualAlloc VirtualProtect InitializeSListHead ReleaseSemaphore UnregisterWaitEx LoadLibraryW OutputDebugStringW FreeLibraryAndExitThread GetModuleHandleA GetThreadTimes CreateEventW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind HeapFree HeapAlloc GetProcessHeap HeapReAlloc HeapSize HeapQueryInformation HeapValidate HeapCompact HeapWalk GetSystemInfo VirtualQuery GetFileType GetStartupInfoW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe CreateFileW GetConsoleMode ReadConsoleW GetConsoleCP SetFilePointerEx FlushFileBuffers CreatePipe SetStdHandle GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ReadConsoleInputW WriteConsoleW SetEndOfFile LockFileEx UnlockFileEx IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TerminateProcess GetTickCount CreateSemaphoreW SetConsoleCtrlHandler QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringA

$I10_OUTPUT ??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z ??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z ??0SchedulerPolicy@Concurrency@@QAA@IZZ ??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z ??0SchedulerPolicy@Concurrency@@QAE@XZ ??0_Cancellation_beacon@details@Concurrency@@QAE@XZ ??0_Condition_variable@details@Concurrency@@QAE@XZ ??0_Context@details@Concurrency@@QAE@PAVContext@2@@Z ??0_Interruption_exception@details@Concurrency@@QAE@PBD@Z ??0_Interruption_exception@details@Concurrency@@QAE@XZ ??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_ReaderWriterLock@details@Concurrency@@QAE@XZ ??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??0_ReentrantLock@details@Concurrency@@QAE@XZ ??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z ??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z ??0_SpinLock@details@Concurrency@@QAE@ACJ@Z ??0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z ??0_TaskCollection@details@Concurrency@@QAE@XZ ??0_Timer@details@Concurrency@@IAE@I_N@Z ??0__non_rtti_object@std@@QAE@ABV01@@Z ??0__non_rtti_object@std@@QAE@PBD@Z ??0bad_cast@std@@AAE@PBQBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@PBD@Z ??0bad_target@Concurrency@@QAE@XZ ??0bad_typeid@std@@QAE@ABV01@@Z ??0bad_typeid@std@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@PBD@Z ??0context_self_unblock@Concurrency@@QAE@XZ ??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z ??0context_unblock_unbalanced@Concurrency@@QAE@XZ ??0critical_section@Concurrency@@QAE@XZ ??0default_scheduler_exists@Concurrency@@QAE@PBD@Z ??0default_scheduler_exists@Concurrency@@QAE@XZ ??0event@Concurrency@@QAE@XZ ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@ABQBDH@Z ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@XZ ??0improper_lock@Concurrency@@QAE@PBD@Z ??0improper_lock@Concurrency@@QAE@XZ ??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_attach@Concurrency@@QAE@XZ ??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z ??0improper_scheduler_detach@Concurrency@@QAE@XZ ??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z ??0improper_scheduler_reference@Concurrency@@QAE@XZ ??0invalid_link_target@Concurrency@@QAE@PBD@Z ??0invalid_link_target@Concurrency@@QAE@XZ ??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z ??0invalid_multiple_scheduling@Concurrency@@QAE@XZ ??0invalid_operation@Concurrency@@QAE@PBD@Z ??0invalid_operation@Concurrency@@QAE@XZ ??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z ??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ ??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z ??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ ??0message_not_found@Concurrency@@QAE@PBD@Z ??0message_not_found@Concurrency@@QAE@XZ ??0missing_wait@Concurrency@@QAE@PBD@Z ??0missing_wait@Concurrency@@QAE@XZ ??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z ??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ ??0operation_timed_out@Concurrency@@QAE@PBD@Z ??0operation_timed_out@Concurrency@@QAE@XZ ??0reader_writer_lock@Concurrency@@QAE@XZ ??0scheduler_not_attached@Concurrency@@QAE@PBD@Z ??0scheduler_not_attached@Concurrency@@QAE@XZ ??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z ??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@J@Z ??0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z ??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z ??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z ??0task_canceled@Concurrency@@QAE@PBD@Z ??0task_canceled@Concurrency@@QAE@XZ ??0unsupported_os@Concurrency@@QAE@PBD@Z ??0unsupported_os@Concurrency@@QAE@XZ ??1SchedulerPolicy@Concurrency@@QAE@XZ ??1_Cancellation_beacon@details@Concurrency@@QAE@XZ ??1_Condition_variable@details@Concurrency@@QAE@XZ ??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ ??1_SpinLock@details@Concurrency@@QAE@XZ ??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ ??1_TaskCollection@details@Concurrency@@QAE@XZ ??1_Timer@details@Concurrency@@MAE@XZ ??1__non_rtti_object@std@@UAE@XZ ??1bad_cast@std@@UAE@XZ ??1bad_typeid@std@@UAE@XZ ??1critical_section@Concurrency@@QAE@XZ ??1event@Concurrency@@QAE@XZ ??1exception@std@@UAE@XZ ??1reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock@critical_section@Concurrency@@QAE@XZ ??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ ??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??2@YAPAXIHPBDH@Z ??3@YAXPAX@Z ??3@YAXPAXHPBDH@Z ??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z ??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z ??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z ??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z ??4bad_cast@std@@QAEAAV01@ABV01@@Z ??4bad_typeid@std@@QAEAAV01@ABV01@@Z ??4exception@std@@QAEAAV01@ABV01@@Z ??8type_info@@QBE_NABV0@@Z ??9type_info@@QBE_NABV0@@Z ??_7__non_rtti_object@std@@6B@ ??_7bad_cast@std@@6B@ ??_7bad_typeid@std@@6B@ ??_7exception@std@@6B@ ??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ ??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ ??_F_Context@details@Concurrency@@QAEXXZ ??_F_Scheduler@details@Concurrency@@QAEXXZ ??_Fbad_cast@std@@QAEXXZ ??_Fbad_typeid@std@@QAEXXZ ??_U@YAPAXI@Z ??_U@YAPAXIHPBDH@Z ??_V@YAXPAX@Z ??_V@YAXPAXHPBDH@Z ?Alloc@Concurrency@@YAPAXI@Z ?Block@Context@Concurrency@@SAXXZ ?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z ?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z ?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z ?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ ?CurrentContext@Context@Concurrency@@SAPAV12@XZ ?Detach@CurrentScheduler@Concurrency@@SAXXZ ?DisableTracing@Concurrency@@YAJXZ ?EnableTracing@Concurrency@@YAJXZ ?Free@Concurrency@@YAXPAX@Z ?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?GetExecutionContextId@Concurrency@@YAIXZ ?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ ?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ ?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ ?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z ?GetProcessorCount@Concurrency@@YAIXZ ?GetProcessorNodeCount@Concurrency@@YAIXZ ?GetSchedulerId@Concurrency@@YAIXZ ?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ ?Id@Context@Concurrency@@SAIXZ ?Id@CurrentScheduler@Concurrency@@SAIXZ ?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z ?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ ?Log2@details@Concurrency@@YAKI@Z ?Oversubscribe@Context@Concurrency@@SAX_N@Z ?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z ?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ ?ScheduleGroupId@Context@Concurrency@@SAIXZ ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z ?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z ?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z ?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z ?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z ?VirtualProcessorId@Context@Concurrency@@SAIXZ ?Yield@Context@Concurrency@@SAXXZ ?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z ?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ ?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ ?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ ?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ ?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z ?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ ?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ ?_Copy_str@exception@std@@AAEXPBD@Z ?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ ?_Current_node@location@Concurrency@@SA?AV12@XZ ?_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ ?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ ?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ ?_GetConcurrency@details@Concurrency@@YAIXZ ?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ ?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ ?_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ ?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ ?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ ?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ ?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ ?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z ?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z ?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z ?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ ?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ ?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z ?_Reference@_Scheduler@details@Concurrency@@QAEIXZ ?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ ?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ ?_Release@_Scheduler@details@Concurrency@@QAEIXZ ?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ ?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ ?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z ?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z ?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z ?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z ?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z ?_SetUnobservedExceptionHandler@details@Concurrency@@YAXP6AXXZ@Z ?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ ?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ ?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ ?_SpinYield@Context@Concurrency@@SAXXZ ?_Start@_Timer@details@Concurrency@@IAEXXZ ?_Stop@_Timer@details@Concurrency@@IAEXXZ ?_Tidy@exception@std@@AAEXXZ ?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ ?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z ?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ ?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ ?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ ?_Type_info_dtor@type_info@@CAXPAV1@@Z ?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z ?_UnderlyingYield@details@Concurrency@@YAXXZ ?_ValidateExecute@@YAHP6GHXZ@Z ?_ValidateRead@@YAHPBXI@Z ?_ValidateWrite@@YAHPAXI@Z ?_Value@_SpinCount@details@Concurrency@@SAIXZ ?_Yield@_Context@details@Concurrency@@SAXXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrCompare@@YA_NPBX0@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrSwap@@YAXPAX0@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?_inconsistency@@YAXXZ ?_invalid_parameter@@YAXPBG00II@Z ?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z ?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z ?_open@@YAHPBDHH@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZH@Z ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?_sopen@@YAHPBDHHH@Z ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?_wopen@@YAHPB_WHH@Z ?_wsopen@@YAHPB_WHHH@Z ?before@type_info@@QBE_NABV1@@Z ?current@location@Concurrency@@SA?AV12@XZ ?from_numa_node@location@Concurrency@@SA?AV12@G@Z ?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ ?lock@critical_section@Concurrency@@QAEXXZ ?lock@reader_writer_lock@Concurrency@@QAEXXZ ?lock_read@reader_writer_lock@Concurrency@@QAEXXZ ?name@type_info@@QBEPBDPAU__type_info_node@@@Z ?native_handle@critical_section@Concurrency@@QAEAAV12@XZ ?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ ?notify_one@_Condition_variable@details@Concurrency@@QAEXXZ ?raw_name@type_info@@QBEPBDXZ ?reset@event@Concurrency@@QAEXXZ ?set@event@Concurrency@@QAEXXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z ?set_task_execution_resources@Concurrency@@YAXK@Z ?set_terminate@@YAP6AXXZH@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZH@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?swprintf@@YAHPAGIPBGZZ ?swprintf@@YAHPA_WIPB_WZZ ?terminate@@YAXXZ ?try_lock@critical_section@Concurrency@@QAE_NXZ ?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ ?try_lock_for@critical_section@Concurrency@@QAE_NI@Z ?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ ?unexpected@@YAXXZ ?unlock@critical_section@Concurrency@@QAEXXZ ?unlock@reader_writer_lock@Concurrency@@QAEXXZ ?vswprintf@@YAHPA_WIPB_WPAD@Z ?wait@Concurrency@@YAXI@Z ?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z ?wait@event@Concurrency@@QAEII@Z ?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z ?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z ?what@exception@std@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CRT_RTC_INIT _CRT_RTC_INITW _Cbuild _CreateFrameInfo _CxxThrowException _EH_prolog _FCbuild _FindAndUnlinkFrame _Getdays _Getmonths _Gettnames _HUGE _IsExceptionObjectToBeDestroyed _LCbuild _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime _XcptFilter __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CppXcptFilter __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD __STRINGTOLD_L __TypeMatch ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func ___mb_cur_max_l_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __clean_type_info_names_internal __control87_2 __create_locale __crtCompareStringA __crtCompareStringEx __crtCompareStringW __crtCreateEventExW __crtCreateSemaphoreExW __crtCreateSymbolicLinkW __crtEnumSystemLocalesEx __crtFlsAlloc __crtFlsFree __crtFlsGetValue __crtFlsSetValue __crtGetDateFormatEx __crtGetFileInformationByHandleEx __crtGetLocaleInfoEx __crtGetShowWindowMode __crtGetTickCount64 __crtGetTimeFormatEx __crtGetUserDefaultLocaleName __crtInitializeCriticalSectionEx __crtIsPackagedApp __crtIsValidLocaleName __crtLCMapStringA __crtLCMapStringEx __crtLCMapStringW __crtSetFileInformationByHandle __crtSetThreadStackGuarantee __crtSetUnhandledExceptionFilter __crtSleep __crtTerminateProcess __crtUnhandledException __daylight __dllonexit __doserrno __dstbias __fpecode __free_locale __get_current_locale __get_flsindex __get_tlsindex __getmainargs __initenv __iob_func __isascii __iscsym __iscsymf __iswcsym __iswcsymf __lconv __lconv_init __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__commode __p__daylight __p__dstbias __p__environ __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__wpgmptr __pctype_func __pioinfo __pwctype_func __pxcptinfoptrs __report_gsfailure __set_app_type __setlc_active __setusermatherr __strncnt __swprintf_l __sys_errlist __sys_nerr __threadhandle __threadid __timezone __toascii __tzname __unDName __unDNameEx __unDNameHelper __uncaught_exception __unguarded_readlc_active __vswprintf_l __wargv __wcserror __wcserror_s __wcsncnt __wgetmainargs __winitenv _abnormal_termination _abs64 _access _access_s _acmdln _aligned_free _aligned_malloc _aligned_msize _aligned_offset_malloc _aligned_offset_realloc _aligned_offset_recalloc _aligned_realloc _aligned_recalloc _amsg_exit _assert _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _beep _beginthread _beginthreadex _byteswap_uint64 _byteswap_ulong _byteswap_ushort _c_exit _cabs _callnewh _calloc_crt _cexit _cgets _cgets_s _cgetws _cgetws_s _chdir _chdrive _chgsign _chgsignf _chkesp _chmod _chsize _chsize_s _clearfp _close _commit _commode _configthreadlocale _control87 _controlfp _controlfp_s _copysign _copysignf _cprintf _cprintf_l _cprintf_p _cprintf_p_l _cprintf_s _cprintf_s_l _cputs _cputws _creat _create_locale _crt_debugger_hook _cscanf _cscanf_l _cscanf_s _cscanf_s_l _ctime32 _ctime32_s _ctime64 _ctime64_s _cwait _cwprintf _cwprintf_l _cwprintf_p _cwprintf_p_l _cwprintf_s _cwprintf_s_l _cwscanf _cwscanf_l _cwscanf_s _cwscanf_s_l _daylight _dclass _difftime32 _difftime64 _dosmaperr _dpcomp _dsign _dstbias _dtest _dup _dup2 _dupenv_s _ecvt _ecvt_s _endthread _endthreadex _environ _eof _errno _except1 _except_handler2 _except_handler3 _except_handler4_common _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fclose_nolock _fcloseall _fcvt _fcvt_s _fdclass _fdopen _fdpcomp _fdsign _fdtest _fflush_nolock _fgetchar _fgetwc_nolock _fgetwchar _filbuf _filelength _filelengthi64 _fileno _findclose _findfirst32 _findfirst32i64 _findfirst64 _findfirst64i32 _findnext32 _findnext32i64 _findnext64 _findnext64i32 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _free_locale _freea _freea_s _freefls _fscanf_l _fscanf_s_l _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _fstat32 _fstat32i64 _fstat64 _fstat64i32 _ftell_nolock _ftelli64 _ftelli64_nolock _ftime32 _ftime32_s _ftime64 _ftime64_s _ftol _fullpath _futime32 _futime64 _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwrite_nolock _fwscanf_l _fwscanf_s_l _gcvt _gcvt_s _get_current_locale _get_daylight _get_doserrno _get_dstbias _get_errno _get_fmode _get_heap_handle _get_invalid_parameter_handler _get_osfhandle _get_output_format _get_pgmptr _get_printf_count_output _get_purecall_handler _get_terminate _get_timezone _get_tzname _get_unexpected _get_wpgmptr _getc_nolock _getch _getch_nolock _getche _getche_nolock _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getptd _getsystime _getw _getwch _getwch_nolock _getwche _getwche_nolock _getws _getws_s _global_unwind2 _gmtime32 _gmtime32_s _gmtime64 _gmtime64_s _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _hypotf _i64toa _i64toa_s _i64tow _i64tow_s _initptd _initterm _initterm_e _inp _inpd _inpw _invalid_parameter _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _iob _isalnum_l _isalpha_l _isatty _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _isnan _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _itoa _itoa_s _itow _itow_s _j0 _j1 _jn _kbhit _ldclass _ldpcomp _ldsign _ldtest _lfind _lfind_s _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _loaddll _local_unwind2 _local_unwind4 _localtime32 _localtime32_s _localtime64 _localtime64_s _lock _lock_file _locking _logb _longjmpex _lrotl _lrotr _lsearch _lsearch_s _lseek _lseeki64 _ltoa _ltoa_s _ltow _ltow_s _makepath _makepath_s _malloc_crt _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mbctype _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l _memccpy _memicmp _memicmp_l _mkdir _mkgmtime32 _mkgmtime64 _mktemp _mktemp_s _mktime32 _mktime64 _msize _nextafter _onexit _open _open_osfhandle _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _printf_l _printf_p _printf_p_l _printf_s_l _purecall _putch _putch_nolock _putenv _putenv_s _putw _putwch _putwch_nolock _putws _pwctype _read _realloc_crt _recalloc _recalloc_crt _resetstkoflw _rmdir _rmtmp _rotl _rotl64 _rotr _rotr64 _scalb _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _searchenv _searchenv_s _seh_longjmp_unwind _seh_longjmp_unwind4 _set_SSE2_enable _set_abort_behavior _set_controlfp _set_doserrno _set_errno _set_error_mode _set_fmode _set_invalid_parameter_handler _set_malloc_crt_max_wait _set_output_format _set_printf_count_output _set_purecall_handler _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sopen _sopen_s _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _splitpath_s _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _stat32 _stat32i64 _stat64 _stat64i32 _statusfp _statusfp2 _strcoll_l _strdate _strdate_s _strdup _strerror _strerror_s _strftime_l _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strtime _strtime_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _swab _swprintf _swprintf_c _swprintf_c_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _sys_errlist _sys_nerr _tell _telli64 _tempnam _time32 _time64 _timezone _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _tzname _tzset _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _umask _umask_s _ungetc_nolock _ungetch _ungetch_nolock _ungetwc_nolock _ungetwch _ungetwch_nolock _unlink _unloaddll _unlock _unlock_file _utime32 _utime64 _vacopy _vcprintf _vcprintf_l _vcprintf_p _vcprintf_p_l _vcprintf_s _vcprintf_s_l _vcwprintf _vcwprintf_l _vcwprintf_p _vcwprintf_p_l _vcwprintf_s _vcwprintf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _waccess _waccess_s _wasctime _wasctime_s _wassert _wchdir _wchmod _wcmdln _wcreat _wcreate_locale _wcscoll_l _wcsdup _wcserror _wcserror_s _wcsftime_l _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctime32 _wctime32_s _wctime64 _wctime64_s _wctomb_l _wctomb_s_l _wctype _wdupenv_s _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst32 _wfindfirst32i64 _wfindfirst64 _wfindfirst64i32 _wfindnext32 _wfindnext32i64 _wfindnext64 _wfindnext64i32 _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _wgetenv_s _wmakepath _wmakepath_s _wmkdir _wmktemp _wmktemp_s _wopen _wperror _wpgmptr _wpopen _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wputenv _wputenv_s _wremove _wrename _write _wrmdir _wscanf_l _wscanf_s_l _wsearchenv _wsearchenv_s _wsetlocale _wsopen _wsopen_s _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wsplitpath_s _wstat32 _wstat32i64 _wstat64 _wstat64i32 _wstrdate _wstrdate_s _wstrtime _wstrtime_s _wsystem _wtempnam _wtmpnam _wtmpnam_s _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l _wunlink _wutime32 _wutime64 _y0 _y1 _yn abort abs acos acosh acoshf acoshl asctime asctime_s asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl atexit atof atoi atol atoll bsearch bsearch_s btowc cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl calloc carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clearerr clearerr_s clock clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl div erf erfc erfcf erfcl erff erfl exit exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fclose fdim fdimf fdiml feclearexcept fegetenv fegetexceptflag fegetround feholdexcept feof feraiseexcept ferror fesetenv fesetexceptflag fesetround fetestexcept feupdateenv fflush fgetc fgetpos fgets fgetwc fgetws floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fopen fopen_s fprintf fprintf_s fputc fputs fputwc fputws fread fread_s free freopen freopen_s frexp fscanf fscanf_s fseek fsetpos ftell fwprintf fwprintf_s fwrite fwscanf fwscanf_s getc getchar getenv getenv_s gets gets_s getwc getwchar ilogb ilogbf ilogbl imaxabs imaxdiv is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv lgamma lgammaf lgammal llabs lldiv llrint llrintf llrintl llround llroundf llroundl localeconv log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl longjmp lrint lrintf lrintl lround lroundf lroundl malloc mblen mbrlen mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml perror pow printf printf_s putc putchar puts putwc putwchar qsort qsort_s raise rand rand_s realloc remainder remainderf remainderl remove remquo remquof remquol rename rewind rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl scanf scanf_s setbuf setlocale setvbuf signal sin sinh sprintf sprintf_s sqrt srand sscanf sscanf_s strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strerror_s strftime strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strrchr strspn strstr strtod strtof strtoimax strtok strtok_s strtol strtold strtoll strtoul strtoull strtoumax strxfrm swprintf_s swscanf swscanf_s system tan tanh tgamma tgammaf tgammal tmpfile tmpfile_s tmpnam tmpnam_s tolower toupper towctrans towlower towupper trunc truncf truncl ungetc ungetwc vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wcrtomb wcrtomb_s wcscat wcscat_s wcschr wcscmp wcscoll wcscpy wcscpy_s wcscspn wcsftime wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsrchr wcsrtombs wcsrtombs_s wcsspn wcsstr wcstod wcstof wcstoimax wcstok wcstok_s wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wcsxfrm wctob wctomb wctomb_s wctrans wctype wmemcpy_s wmemmove_s wprintf wprintf_s wscanf wscanf_s

reimage.dat

SHA256 5049505b4a8a8b23458d0c05fefb1bf808254b0a7a3a2d0cde1967ee89005e28
MD5 3286c3f5652881ea8dd696b0d3e10b87
SHA1 eda55e30f8895eeb9bcbe15f781359a1c30c3162
SHA512 82905f0f9ac9929ca195182e0350a131612850dfb1f451e6207b10f3d7aaadc5069b6325aec45a246a285827602aefd3aa64179c6ff8a1c92a8e05af67aea184
SSDEEP 3072:fPvjtngo1wbQMRnM6Qba1zkcN98z1PsNYjAYtS4TAC:fPqo1wbdRnM6NpCz1PsNYMYt1TAC
MD5 SHA1 SHA512 SSDEEP

savapi.dll

IMPHASH 75c75323062b257b0b349077a3dfbb06
SHA256 9b5c50c8c2f99878081c44a4144f9e35698b44c85e4728d719e281909673b0cb
MD5 7f905e8b22fa760b046776b918c53ced
SHA1 2d422f37b8ac02cea83cd1ce01a9341f52c8f3a4
SHA512 f54f022988fbca1f11b7da36056a4fca5b51401499835910fa46cb028539aba3870e09252a05370d2e8e49829fb669918eda2a2c53d0a60db744769b0b4091c6
SSDEEP 24576:uC+KpPwoTtSz/XpDJOeP0kXxacWY3gBYGp8MhLtNqPM0mq8v8OgYITaPyoVDVidB:VWbXnBan/t7PbqaPDDVidB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

f1:68:8d:8f:19:11:0e:95:27:22:3b:96:63:f1:29:c7:78:5f:6f:f4:8e:60:14:86:4d:49:e7:7c:59:f5:90:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 10, 2018

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:25:07:1d:f9:af

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 18, 2009 - Mar 18, 2019

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2e:66:bf:cd:b0:20:c2:a7:bc:a5:95:cf

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2018 - Mar 23, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

1232679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\home\jenkins\release\savapi\RELEASE\win32\libsavapi\daemon\libsavapi.pdb

ws2_32

setsockopt ioctlsocket recv WSARecv sendto recvfrom freeaddrinfo getaddrinfo send htons WSASetLastError WSAIoctl getsockname getpeername socket shutdown select ntohs listen getsockopt connect closesocket bind accept __WSAFDIsSet ntohl gethostname WSAAddressToStringW WSAGetLastError WSACleanup WSAStartup gethostbyname

shlwapi

PathCanonicalizeW PathRemoveFileSpecW PathFileExistsW

kernel32

GlobalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetLastError GetModuleFileNameW SetLastError GetTempPathW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CloseHandle GetSystemInfo MapViewOfFile UnmapViewOfFile OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW InitializeCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateEventA Sleep GetSystemTimeAsFileTime FileTimeToSystemTime SystemTimeToFileTime SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW FindClose FindFirstFileW GetFileAttributesExW GetFileInformationByHandle GetFileType GetFullPathNameW LocalFree GetEnvironmentVariableW GetStdHandle SetStdHandle CreateFileW DeleteFileW SetFilePointer GetOverlappedResult DeviceIoControl CancelIo MoveFileExW ReadFile WriteFile ReleaseSemaphore CreateSemaphoreA TlsAlloc TlsFree GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW GetCurrentProcess GetCurrentThread OpenFileMappingW FormatMessageA PeekNamedPipe ResetEvent CreateFileMappingA GetVersionExA LoadLibraryA GetExitCodeProcess WaitForMultipleObjects TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx GetModuleHandleA FlushConsoleInputBuffer QueryPerformanceCounter GetTickCount GlobalMemoryStatus CreateEventW LoadLibraryW GetNativeSystemInfo GetVersionExW DisableThreadLibraryCalls IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetSystemTime VerifyVersionInfoA GetSystemDirectoryA VerSetConditionMask ExpandEnvironmentStringsA SleepEx

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetSystemMetrics

advapi32

GetNamedSecurityInfoW AllocateAndInitializeSid CryptAcquireContextW ReportEventA RegisterEventSourceA CryptGenRandom CryptReleaseContext LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken GetSecurityInfo GetNamedSecurityInfoA GetEffectiveRightsFromAclW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle FreeSid CheckTokenMembership

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersAddresses

msvcr120

_malloc_crt _initterm _initterm_e _except1 _lock _unlock _calloc_crt __dllonexit _onexit _crt_debugger_hook __crtUnhandledException __crtTerminateProcess __clean_type_info_names_internal _stat64i32 _amsg_exit __CppXcptFilter _except_handler4_common localeconv strtod isgraph _stat64 _getpid strstr wcsncat_s __sys_nerr strtoll strpbrk fputc _fstat64 _strdup _open _getch fputs signal _wfopen ftell fseek fread fopen _fileno _lseeki64 memcpy memset free malloc calloc realloc _difftime64 _mktime64 _time64 _wcsdup strchr isalnum strspn sprintf isprint strncpy strncmp atoi strrchr toupper tolower _snwprintf wcsncpy wcsstr _wcsicmp _wcsupr _vacopy isalpha memmove _errno rand srand _waccess wcschr printf _snprintf strftime _gmtime64_s _localtime64_s isdigit towupper wcstok strtol memchr abort bsearch wcsncmp isupper islower modf _close _strtoi64 strerror isspace _beginthreadex __iob_func fflush setvbuf _setmode getenv isxdigit _gmtime64 _wchmod _wunlink _wrename _wsopen _wstat64i32 _swprintf _chsize _filelength _lseek _read _write _exit strtoul sscanf _vsnprintf raise qsort _stricmp _strnicmp fprintf strcmp fwrite fclose feof ferror fgets

CharToSTCHAR SAVAPI_APC_cache_operation SAVAPI_APC_get_version SAVAPI_APC_initialize SAVAPI_APC_uninitialize SAVAPI_OA_create_instances SAVAPI_OA_initialize SAVAPI_OA_start_scan SAVAPI_OA_stop_scan SAVAPI_OA_uninitialize SAVAPI_TCHAR_free SAVAPI_char_free SAVAPI_create_instance SAVAPI_engine_modules_get SAVAPI_engine_modules_get_ex SAVAPI_engine_versions_get SAVAPI_extract_malware_names SAVAPI_free SAVAPI_get SAVAPI_get_dynamic_detect SAVAPI_get_fops SAVAPI_get_instance_pool SAVAPI_get_type SAVAPI_get_user_data SAVAPI_get_version SAVAPI_global_set SAVAPI_initialize SAVAPI_is_running SAVAPI_is_running_ex SAVAPI_register_callback SAVAPI_release_instance SAVAPI_reload_engine SAVAPI_reload_engine_ex SAVAPI_reset_instance SAVAPI_scan SAVAPI_send_signal SAVAPI_set SAVAPI_set_avpal_init_flags SAVAPI_set_avpal_inited SAVAPI_set_ex SAVAPI_set_fops SAVAPI_set_log_callback SAVAPI_set_quickload_init SAVAPI_set_user_data SAVAPI_simple_scan SAVAPI_uninitialize SAVAPI_unregister_callback SAVAPI_with_encoding_get STCHARToChar STCHARToString STCHARToTCHAR StringToSTCHAR TCHARToSTCHAR _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4 asc2bin bin2asc bin2hex hex2bin

generic

count=2, id=221, productName=VS2013 build 21005, version=21005,

count=11, id=199, version=41118,

count=15, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=225, productName=VS2013 build 21005, version=21005,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=20, productName=Unmarked objects (old),

count=573, id=224, productName=VS2013 build 21005, version=21005,

count=375, id=1, productName=Unmarked objects,

count=23, id=203, version=65501,

count=98, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=73, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

uninst.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 308a159305eadc0b29fc28b4121c8e31af4030bd8e4938ceff716396949183e5
MD5 fe69460dd31e389a71e6a4d50debfc04
SHA1 488a08beb9d01a73f2ff3f08875a03d1a388793b
SHA512 65d5851889b9f1022f81d9ee0d1e9d8df3c9fcbe8bbffb46d0d77cfea56d51124ba26307dcb0493ff4abf3b1419e9764a9540d896cab6bbdd41572c093bba770
SSDEEP 12288:6EPVHCW2HBZ5ce8y11FGbm6sadQHEawOwTXrp/LJIboRRdxYibwj6:68p2HBZ5cg1zGClrEawOorp/NgoRTxtB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

d8:eb:2c:be:9e:00:ab:e1:ad:d7:90:21:2e:f3:de:88:e9:e3:2d:0d:51:e1:21:44:b2:1d:8c:24:5e:fb:13:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 20, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

d4:56:d1:13:01:a3:a3:11:0d:ee:29:c2:9c:d8:58:ab:03:3b:33:d2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Chains

Dec 20, 2021

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reimage Ltd.,OU=Reimage Ltd.,O=Reimage Ltd.,L=Nicosia,C=CY

Serial Number

61:ea:d2:31:ad:77:6a:62:67:3b:cc:df:37:25:c8:a6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Mar 22, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/AccessControl.dll

SHA256 ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac
MD5 65d017ba65785b43720de6c9979a2e8c
SHA1 0aed2846e1b338077bae5a7f756c345a5c90d8a9
SHA512 31a19105892d5a9b49eb81a90a2330c342a5504fa4940b99a12279a63e1a19ee5d4b257d0900794ff7021a09408995a5d12e95cc38f09cf12fb2fd860d205c95
SSDEEP 96:18YNfTAJj9KMMVSyPg8uxZAQ/zdVJF/mSsQwV6i8zRRxqBt/FZTIVe7/cIH8ykeO:1XwKMMfPuxJ/zb+b6fR+bZEwywQ9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 0deb397ca1e716bb7b15e1754e52b2ac
SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LogEx.dll

IMPHASH 549d7b44067bbcdf42bf6a90a80a3a9e
SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WmiInspector.dll

IMPHASH 7f0e53ce204644197ed8a4abb8792a26
SHA256 26c8981d7e3cd8093c40bb7da0c045e89f6dfc1a0888efaac9e22a555d763142
MD5 b757cd400e19c6722e721e27a6db1cfd
SHA1 2e07f3a7b036c3c263049af483721f88ecdb2c53
SHA512 9e4675f380d7b79ac0c2f59c8b38663710798f8ee19233aabbd9f5ba81b74901c4f7c0e3d982ccca640ca240b631f889daad27160d3456ed7bb66ffe68e29e72
SSDEEP 1536:0o0RUqYnecKBiygONayX2PYnyBN1yksAPvTbhKJB:0/LZiCwyCVPnhM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\REI_WS2\NsisPlugins\WmiInspector\Release\WmiInspector.pdb

kernel32

InterlockedIncrement InterlockedDecrement GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar FlushFileBuffers CloseHandle CreateFileW GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle GetLastError lstrlenA LocalFree GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc RtlUnwind EncodePointer RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleFileNameW HeapSize IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LoadLibraryW

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit SysAllocStringByteLen VariantClear SysStringLen SysAllocString

$PLUGINSDIR/inetc.dll

IMPHASH 86cdacc6fa5e3ff4938d358350751516
SHA256 9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2
MD5 5da9df435ff20853a2c45026e7681cef
SHA1 39b1d70a7a03e7c791cb21a53d82fd949706a4b4
SHA512 4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f
SSDEEP 768:FRci+9MscTJMR2+d8heiwhSruaFajMGbJDVVG08:Fg9sTJv+AVwhl25ci
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcstol _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul wcsstr wcschr memset _chkesp

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW CreateFileW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/installer-164x314.bmp

SHA256 d8ea979f58825c0e2f4c7b1a0ea0effc1570e580ca30cb15c92d38041f14d563
MD5 68436d57a2d46cbc9302b1925359e054
SHA1 c89d42a4cd24e77745e1dfbd7deb9a1d4ec42636
SHA512 42e70d0215771659142cbe1213704f41e39e9eff72d39a692c213baeeeb6cbaef31c4803da607f8114a22b1c99b2d44038ff3fa6b7507f88c74354d678a296b6
SSDEEP 1536:7bzvsXZMpw1RNCJIzccdjPXBBvq35lNN2RLrDww2A:1D35MRLN
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/installer-497x57.bmp

SHA256 e7e5bbfd8c8ad303753ecfda840180b586c336e4ab5aacc6b0adea1c3ef0188a
MD5 ae1a4753df5fc34780602bcac675a8a5
SHA1 3e30c7bbbb25d6b4141fe405fc7862e04868b220
SHA512 b70920c7fe7938fc56badc133a175c80684d0041b1980c0941cfe3781e568a9aaa611670395b0bd7786e5309eb9bfbef5a5f90d9b0b4cdc00aac31c9037fda83
SSDEEP 384:WqlqXPJHv0+BzDaI+tOyBjogH5LaIe99499499GA/Fxq0inD9gFe:jQZ0+BzDantbN5ZFe99499499GA/FQGw
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-header.bmp

SHA256 e7e5bbfd8c8ad303753ecfda840180b586c336e4ab5aacc6b0adea1c3ef0188a
MD5 ae1a4753df5fc34780602bcac675a8a5
SHA1 3e30c7bbbb25d6b4141fe405fc7862e04868b220
SHA512 b70920c7fe7938fc56badc133a175c80684d0041b1980c0941cfe3781e568a9aaa611670395b0bd7786e5309eb9bfbef5a5f90d9b0b4cdc00aac31c9037fda83
SSDEEP 384:WqlqXPJHv0+BzDaI+tOyBjogH5LaIe99499499GA/Fxq0inD9gFe:jQZ0+BzDantbN5ZFe99499499GA/FQGw
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

version.rei

SHA256 ed3b8d81a9d373f5ca3016e63c16bca19be544a9e0637f3c233717b201aa397e
MD5 f7e0ac46edce1c2ef8e9f56e31045ee8
SHA1 7611f1cc893e84364c69840fe5d78908f1a9e065
SHA512 6f5babeeffb219061cb9adf7fa50a2dd546e337efd183516dd34fb1c744e4a5655f3ef14b47ee2276a688cc3116c4ff657c660af480dc48f5a160250bcf11be7
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

ReimagePackage.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AccessControl.dll

generic

out.upx

generic

$PLUGINSDIR/DcryptDll.dll

kernel32

user32

generic

$PLUGINSDIR/ExecDos.dll

kernel32

user32

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/LogEx.dll

kernel32

user32

generic

$PLUGINSDIR/ProtectorUpdater.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AccessControl.dll

generic

out.upx

generic

$PLUGINSDIR/ExecDos.dll

kernel32

user32

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/LogEx.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/WmiInspector.dll

kernel32

ole32

oleaut32

generic

$PLUGINSDIR/inetc.dll