8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850faa7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850faa7.exe
Size

36.8MB
MD5

37e914a1980a17e73ddc1771a8cdd691
SHA1

faeac8977e002c59c686367a28cad689255b0e0b
SHA256

8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850faa7
SHA512

11de7b34c91619f7e21966c0dfc068603eaf63de96a17eba4175854f4543fcdfd11aa828e80a76261d5ce1a77caa42c24e118fc6ab397182ff02ecacbc62f3b1
SSDEEP

786432:o0SNxjTMMQabxZYx0uvygDy4l0ZvCND8NYEBvcI7VPc2fhAVCA6:o0AhbxZoF6CNEYEJhklw

Score

3^/10

Malware Config

Signatures

Unsigned PE 54 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumChromeHelper.exe
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/Newtonsoft.Json.dll
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumMozillaHelper.exe
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/Newtonsoft.Json.dll
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumOperaHelper.exe
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/Newtonsoft.Json.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/textreplace.dll
unpack001/$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumChromeHelper.exe
unpack001/$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/Newtonsoft.Json.dll
unpack001/$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumMozillaHelper.exe
unpack001/$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/Newtonsoft.Json.dll
unpack001/$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumOperaHelper.exe
unpack001/$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumSupport.dll
unpack001/$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/Newtonsoft.Json.dll
unpack001/Ekag20nt.exe
unpack001/Ekc3220.dll
unpack001/Ekc6420.dll
unpack001/FireFox_Profile_Itt.dll
unpack001/Microsoft.Expression.Drawing.dll
unpack001/NetFilter/BatchFiles/release/win32/libeay32.dll
unpack001/NetFilter/BatchFiles/release/win32/nfregdrv.exe
unpack001/NetFilter/BatchFiles/release/win32/ssleay32.dll
unpack001/NetFilter/Be.Windows.Forms.HexBox.dll
unpack001/NetFilter/Newtonsoft.Json.dll
unpack001/NetFilter/nfapinet.dll
unpack001/NetFilter/nss/certutil.exe
unpack001/NetFilter/nss/nss3.dll
unpack001/NetFilter/nss/smime3.dll
unpack001/NetFilter/nss/softokn3.dll
unpack001/NetFilter/pfapinet.dll
unpack001/Newtonsoft.Json.dll
unpack001/System.Data.SQLite.EF6.dll
unpack001/System.Data.SQLite.Linq.dll
unpack001/System.Data.SQLite.dll
unpack001/System.Windows.Interactivity.dll
unpack001/Updshl10.exe
unpack001/Xceed.Wpf.AvalonDock.Themes.Aero.dll
unpack001/Xceed.Wpf.AvalonDock.Themes.Metro.dll
unpack001/Xceed.Wpf.AvalonDock.Themes.VS2010.dll
unpack001/Xceed.Wpf.AvalonDock.dll
unpack001/Xceed.Wpf.DataGrid.dll
unpack001/Xceed.Wpf.Toolkit.dll
unpack001/x64/SQLite.Interop.dll
unpack001/x86/SQLite.Interop.dll

Files

8ad1526a87b9617cf6dd677cdf9f87a0e3fd1555b6a8828d87ec2bef2850faa7.exe
.exe windows:4 windows x86 arch:x86

edb20cb9a820a54943b8a5a44cbd4e77

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:92:31:5d:60:7f:2c:d6:8b:40:67:e3:60:ea:1e:24:a6:d8:33:47:bb:13:05:4f:8f:81:ef:88:a6:fb:05:c0
Signer

Actual PE Digest

4f:92:31:5d:60:7f:2c:d6:8b:40:67:e3:60:ea:1e:24:a6:d8:33:47:bb:13:05:4f:8f:81:ef:88:a6:fb:05:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetFileAttributesW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
GetLastError
SetCurrentDirectoryW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
MoveFileW
GlobalLock
CreateThread
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
lstrcmpW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
MultiByteToWideChar
ReadFile
lstrlenA
MulDiv
GetPrivateProfileStringW
WritePrivateProfileStringW
WideCharToMultiByte
LoadLibraryExW
GetModuleHandleW
FreeLibrary

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
wvsprintfW
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
ScreenToClient
CreateWindowExW
RegisterClassW
SystemParametersInfoW
CharNextW
GetClassInfoW
DialogBoxParamW
CreateDialogParamW
LoadImageW
DestroyWindow
PostQuitMessage
SetTimer
SetForegroundWindow
SetWindowLongW
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
AppendMenuW
TrackPopupMenu
CreatePopupMenu
DrawTextW
EndPaint
ExitWindowsEx
ShowWindow
SetWindowTextW

gdi32

SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExW
SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHFileOperationW

advapi32

AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_Create
ImageList_AddMasked
ord17
ImageList_Destroy

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 232KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/AvastAntiTrackPremiumFiles/DefaultCookieWhitelist.txt
$LOCALAPPDATA/AvastAntiTrackPremium/AvastAntiTrackPremiumFiles/FirefoxTemp.txt
$LOCALAPPDATA/AvastAntiTrackPremium/Data/MyTestSQLCompactDB.sdf
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeExtension/com.avast.avastantitrackpremium.chrome.json
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeExtension/install_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeExtension/uninstall_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumChromeHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/ChromeNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/FirefoxExtension/[email protected]
.zip
META-INF/manifest.mf
META-INF/mozilla.rsa
META-INF/mozilla.sf
_locales/de/messages.json
_locales/en/messages.json
_locales/es/messages.json
_locales/fr/messages.json
_locales/it/messages.json
_locales/ja/messages.json
_locales/nl/messages.json
_locales/zh/messages.json
avast.ico
contentscript.js
.js
main.js
.js
manifest.json
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaExtension/install_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaExtension/messanger.json
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaExtension/uninstall_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumMozillaHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/MozillaNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaExtension/com.avast.avastantitrackpremium.opera.json
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaExtension/install_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaExtension/uninstall_host.bat
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumOperaHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$LOCALAPPDATA/AvastAntiTrackPremium/Support/OperaNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW

user32

DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC

gdi32

GetDeviceCaps
CreateFontIndirectW
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

e2ee55bddad4241d619d6a8a38e2d869

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 630B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d31c5eb927119d00232e4d4b0e32fcdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
MultiByteToWideChar
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyW
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessW
GetStartupInfoW
CreatePipe
GetProcAddress
lstrcpynW
DeleteFileW
lstrcmpiW
GetCurrentProcess
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
ExitProcess
GetCommandLineW
GlobalLock
GetVersion
lstrlenW

user32

SendMessageW
FindWindowExW
CharNextW
wsprintfW
CharPrevW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/textreplace.dll
.dll windows:4 windows x86 arch:x86

c9b875d3f7604775d782afcb308d92df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
lstrcpynA
GlobalFree
CloseHandle
GlobalAlloc
GetFileSize
SetFilePointer
ReadFile
CreateFileA
WriteFile
SetFileAttributesA
GetFileAttributesA
CopyFileA
lstrcmpiA

user32

CharUpperA

Exports

Exports

_FillReadBuffer
_FindInFile
_FreeReadBuffer
_ReplaceInFile
_Unload

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 669B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/AvastAntiTrackPremiumFiles/DefaultCookieWhitelist.txt
$R0/AvastAntiTrackPremium/AvastAntiTrackPremiumFiles/FirefoxTemp.txt
$R0/AvastAntiTrackPremium/Data/MyTestSQLCompactDB.sdf
$R0/AvastAntiTrackPremium/Support/ChromeExtension/com.avast.avastantitrackpremium.chrome.json
$R0/AvastAntiTrackPremium/Support/ChromeExtension/install_host.bat
$R0/AvastAntiTrackPremium/Support/ChromeExtension/uninstall_host.bat
$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumChromeHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/ChromeNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/FirefoxExtension/[email protected]
.zip
META-INF/manifest.mf
META-INF/mozilla.rsa
META-INF/mozilla.sf
_locales/de/messages.json
_locales/en/messages.json
_locales/es/messages.json
_locales/fr/messages.json
_locales/it/messages.json
_locales/ja/messages.json
_locales/nl/messages.json
_locales/zh/messages.json
avast.ico
contentscript.js
.js
main.js
.js
manifest.json
$R0/AvastAntiTrackPremium/Support/MozillaExtension/install_host.bat
$R0/AvastAntiTrackPremium/Support/MozillaExtension/messanger.json
$R0/AvastAntiTrackPremium/Support/MozillaExtension/uninstall_host.bat
$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumMozillaHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/MozillaNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/OperaExtension/com.avast.avastantitrackpremium.opera.json
$R0/AvastAntiTrackPremium/Support/OperaExtension/install_host.bat
$R0/AvastAntiTrackPremium/Support/OperaExtension/uninstall_host.bat
$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumOperaHelper.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\Wpf_Chrome_Instantiater\Wpf_Chrome_Instantiater\obj\x86\Debug\AvastAntiTrackPremiumChromeHelper.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\V2 Projects\TrackOFF\Track Off\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R0/AvastAntiTrackPremium/Support/OperaNativeMessage/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/AvastAntiTrackPremiumInstallFiles/SSCERuntime_x64-ENU.exe
.exe windows:5 windows x86 arch:x86

02483cd76378259a50b7b66146b45f06

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ae:fb:5e:3d:6a:81:bb:d7:cb:84:44:83:41:2a:c7:30:97:2e:69:a5
Signer

Actual PE Digest

ae:fb:5e:3d:6a:81:bb:d7:cb:84:44:83:41:2a:c7:30:97:2e:69:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

boxstub.pdb

Imports

advapi32

CryptGenRandom
CryptReleaseContext
DecryptFileW
CryptAcquireContextA

kernel32

Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventA
CreateThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
CreateProcessW
CompareStringW
LocalFree
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
lstrlenW
WaitForMultipleObjects
ResetEvent
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GlobalAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetProcessHeap
RaiseException

comctl32

ord17

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageA
PostMessageW
SendMessageW
DialogBoxParamA
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
DialogBoxParamW
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW

cabinet

ord22
ord23
ord20

oleaut32

SysAllocString
VariantClear

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boxld01
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/AvastAntiTrackPremiumInstallFiles/SSCERuntime_x86-ENU.exe
.exe windows:5 windows x86 arch:x86

02483cd76378259a50b7b66146b45f06

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

bd:e4:ec:b1:2d:38:71:6f:d3:92:20:21:50:ce:b5:41:44:72:c7:94
Signer

Actual PE Digest

bd:e4:ec:b1:2d:38:71:6f:d3:92:20:21:50:ce:b5:41:44:72:c7:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

boxstub.pdb

Imports

advapi32

CryptGenRandom
CryptReleaseContext
DecryptFileW
CryptAcquireContextA

kernel32

Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventA
CreateThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
CreateProcessW
CompareStringW
LocalFree
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
lstrlenW
WaitForMultipleObjects
ResetEvent
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GlobalAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetProcessHeap
RaiseException

comctl32

ord17

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageA
PostMessageW
SendMessageW
DialogBoxParamA
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
DialogBoxParamW
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW

cabinet

ord22
ord23
ord20

oleaut32

SysAllocString
VariantClear

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boxld01
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/AvastAntiTrackPremiumInstallFiles/WindowsInstaller-KB893803-v2-x86.exe
.exe windows:6 windows x86 arch:x86

f676e16c67a815430fbcd6d520ece6e4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

23/05/2002, 08:00

Not After

25/09/2011, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:87:58:00:03:00:00:00:5a
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2005, 23:20

Not After

05/04/2006, 23:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

02:b7:21:1e:39:9a:28:2f:be:ca:b5:cc:b9:f9:79:df:cd:15:97:7f
Signer

Actual PE Digest

02:b7:21:1e:39:9a:28:2f:be:ca:b5:cc:b9:f9:79:df:cd:15:97:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb

Imports

msvcrt

strncpy
toupper
sprintf
strchr
_strnicmp
_stricmp
strrchr
_strcmpi
strstr
_strlwr
_snprintf

advapi32

InitiateSystemShutdownA
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid

kernel32

ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
MoveFileA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
DosDateTimeToFileTime
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
LoadStringA
EndDialog

ntdll

NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/AvastAntiTrackPremiumInstallFiles/dotNetFx40_Full_setup.exe
.exe windows:5 windows x86 arch:x86

02483cd76378259a50b7b66146b45f06

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d6:d5:21:44:87:a4:87:f6:84:c8:27:2e:90:f4:8d:98:d2:12:c9:41
Signer

Actual PE Digest

d6:d5:21:44:87:a4:87:f6:84:c8:27:2e:90:f4:8d:98:d2:12:c9:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

boxstub.pdb

Imports

advapi32

CryptGenRandom
CryptReleaseContext
DecryptFileW
CryptAcquireContextA

kernel32

Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventA
CreateThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
CreateProcessW
CompareStringW
LocalFree
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
lstrlenW
WaitForMultipleObjects
ResetEvent
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GlobalAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetProcessHeap
RaiseException

comctl32

ord17

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shell32

CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageA
PostMessageW
SendMessageW
DialogBoxParamA
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
DialogBoxParamW
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW

cabinet

ord22
ord23
ord20

oleaut32

SysAllocString
VariantClear

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boxld01
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Avast-Installer-48px.ico
AvastAntiTrackPremium.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:3e:14:19:a6:5f:0c:d0:8d:37:d7:d0:8a:3c:97:e8:27:02:0e:9b:3f:1d:c3:02:2d:82:67:e1:24:6b:53:dc
Signer

Actual PE Digest

73:3e:14:19:a6:5f:0c:d0:8d:37:d7:d0:8a:3c:97:e8:27:02:0e:9b:3f:1d:c3:02:2d:82:67:e1:24:6b:53:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\TrackOFF_Application\obj\x86\Debug\AvastAntiTrackPremium.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 18.3MB - Virtual size: 18.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AvastAntiTrackPremiumStart.xml
.xml
AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:6b:0c:fb:dd:f4:ab:e8:de:03:de:28:7e:88:cf:b6:6e:16:50:fb:fd:1e:e1:00:8b:7f:32:ae:c6:45:19:78
Signer

Actual PE Digest

36:6b:0c:fb:dd:f4:ab:e8:de:03:de:28:7e:88:cf:b6:6e:16:50:fb:fd:1e:e1:00:8b:7f:32:ae:c6:45:19:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AvastAntiTrackPremium_sdk.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:05:da:3c:62:fa:ac:e1:25:f1:5e:03:cd:fc:08:76:5e:d1:4b:02:86:8d:6e:34:76:37:f0:5d:15:27:79
Signer

Actual PE Digest

61:0f:05:da:3c:62:fa:ac:e1:25:f1:5e:03:cd:fc:08:76:5e:d1:4b:02:86:8d:6e:34:76:37:f0:5d:15:27:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\Praetorian.TrackOFF\obj\Debug\AvastAntiTrackPremium_sdk.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CheckAppInstance_AvastAntiTrackPremium.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:62:dc:e6:35:ed:55:63:c5:84:d9:d5:98:f0:08:d5:99:f2:a3:67:1e:a1:f5:f1:e2:10:ff:e7:cf:cc:e7:08
Signer

Actual PE Digest

c6:62:dc:e6:35:ed:55:63:c5:84:d9:d5:98:f0:08:d5:99:f2:a3:67:1e:a1:f5:f1:e2:10:ff:e7:cf:cc:e7:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\CheckAppInstance\CheckAppInstance\obj\Debug\CheckAppInstance.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ekag20nt.exe
.exe windows:4 windows x86 arch:x86

23452a4449e1e00369387bff1501e974

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AddAccessAllowedAce
AddAce
EqualSid
GetAce
GetAclInformation
GetFileSecurityA
GetLengthSid
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetSecurityDescriptorDacl

kernel32

CloseHandle
CompareStringA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileA
DeviceIoControl
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FlushFileBuffers
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentVariableA
GetFileAttributesA
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeW
GetSystemDefaultLangID
GetSystemInfo
GetTempPathA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalGetAtomNameA
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
RemoveDirectoryA
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SizeofResource
Sleep
SleepEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerLanguageNameA
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA
lstrcpyA
lstrcpynA
lstrlenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

WSACleanup
WSAGetLastError
WSAStartup
gethostbyname
getprotobyname
htons
ioctlsocket
inet_addr
ntohl
recvfrom
sendto
setsockopt
socket

comctl32

ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write

gdi32

BitBlt
CopyEnhMetaFileA
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
ExcludeClipRect
ExtCreatePen
ExtTextOutA
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetObjectA
GetPaletteEntries
GetPixel
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32A
GetTextMetricsA
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
Pie
PlayEnhMetaFile
PolyPolyline
RealizePalette
RectVisible
RestoreDC
SaveDC
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetEnhMetaFileBits
SetMapMode
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StretchBlt
UnrealizeObject

user32

ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharLowerBuffA
CharNextA
CharUpperBuffA
CheckMenuItem
ClientToScreen
CloseClipboard
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DdeCreateDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
DdeGetData
DdeInitializeA
DdeNameService
DdePostAdvise
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumClipboardFormats
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowA
FrameRect
GetActiveWindow
GetCapture
GetCaretPos
GetClassInfoA
GetClassNameA
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessageTime
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
IsCharAlphaA
IsCharAlphaNumericA
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadKeyboardLayoutA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBeep
MessageBoxA
OemToCharA
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
ScrollWindowEx
SendMessageA
SetActiveWindow
SetCapture
SetClassLongA
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetKeyboardState
SetMenu
SetMenuItemInfoA
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassA
UpdateWindow
ValidateRect
WaitMessage
WinHelpA
WindowFromPoint
wsprintfA
GetSysColor

ole32

CoCreateInstance
CoInitialize
CoInitializeSecurity
CoTaskMemFree
CoUninitialize
IsEqualGUID
StringFromCLSID

oleaut32

CreateErrorInfo
GetErrorInfo
SafeArrayAccessData
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData
SetErrorInfo
SysAllocString
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantCopyInd
VariantInit

wininet

HttpAddRequestHeadersA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetAttemptConnect
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetErrorDlg
InternetOpenA
InternetQueryDataAvailable
InternetQueryOptionA
InternetReadFile
InternetSetOptionA

Exports

Exports

@$xp$10TCCalendar
@$xp$14Wsdlbind@IPart
@$xp$14Wsdlbind@IPort
@$xp$14Wsdlbind@TPart
@$xp$14Wsdlbind@TPort
@$xp$15Wsdlbind@IFault
@$xp$15Wsdlbind@IParam
@$xp$15Wsdlbind@IParts
@$xp$15Wsdlbind@IPorts
@$xp$15Wsdlbind@ITypes
@$xp$15Wsdlbind@TParam
@$xp$15Wsdlbind@TParts
@$xp$15Wsdlbind@TPorts
@$xp$15Wsdlbind@TTypes
@$xp$16Webnode@IWebNode
@$xp$16Wsdlbind@IFaults
@$xp$16Wsdlbind@IImport
@$xp$16Wsdlbind@TFaults
@$xp$16Wsdlbind@TImport
@$xp$17TPerformanceGraph
@$xp$17Wsdlbind@IBinding
@$xp$17Wsdlbind@IImports
@$xp$17Wsdlbind@IMessage
@$xp$17Wsdlbind@IService
@$xp$17Wsdlbind@TBinding
@$xp$17Wsdlbind@TImports
@$xp$17Wsdlbind@TMessage
@$xp$17Wsdlbind@TService
@$xp$17Wsdlintf@TWString
@$xp$18Intfinfo@TCallConv
@$xp$18Wsdlbind@IBindings
@$xp$18Wsdlbind@IMessages
@$xp$18Wsdlbind@IPortType
@$xp$18Wsdlbind@IServices
@$xp$18Wsdlbind@TBindings
@$xp$18Wsdlbind@TMessages
@$xp$18Wsdlbind@TPortType
@$xp$18Wsdlbind@TServices
@$xp$18Wsdlnode@TWSDLView
@$xp$18Xsbuiltins@TXSDate
@$xp$18Xsbuiltins@TXSTime
@$xp$19Account@AccountSoap
@$xp$19Service@ServiceSoap
@$xp$19Wsdlbind@IOperation
@$xp$19Wsdlbind@IPortTypes
@$xp$19Wsdlbind@TOperation
@$xp$19Wsdlbind@TPortTypes
@$xp$20Intfinfo@IntfInfo__2
@$xp$20Intfinfo@IntfInfo__3
@$xp$20Opconvert@IOPConvert
@$xp$20Service@GetStatusRes
@$xp$20Service@UpdateLogRes
@$xp$20Wsdlbind@IDefinition
@$xp$20Wsdlbind@IDocumented
@$xp$20Wsdlbind@IOperations
@$xp$20Wsdlbind@TDefinition
@$xp$20Wsdlbind@TDocumented
@$xp$20Wsdlbind@TOperations
@$xp$20Wsdlintf@WSDLIntf__2
@$xp$20Wsdlintf@WSDLIntf__3
@$xp$20Wsdlintf@WSDLIntf__4
@$xp$20Wsdlintf@WSDLIntf__5
@$xp$20Wsdlintf@WSDLIntf__6
@$xp$20Wsdlitems@IWSDLItems
@$xp$20Wsdlitems@TWSDLItems
@$xp$20Xsbuiltins@TXSString
@$xp$21Soapenv@TSoapEnvelope
@$xp$21Wsdlintf@TBindingType
@$xp$21Wsdlintf@TWSDLElement
@$xp$21Wsdlintf@TWideStrings
@$xp$21Xsbuiltins@TXSDecimal
@$xp$22Httputil@IStreamLoader
@$xp$22Intfinfo@PIntfMetaData
@$xp$22Intfinfo@TIntfMetaData
@$xp$22Rio@TAfterExecuteEvent
@$xp$22Service@CheckUserIDRes
@$xp$22Service@SaveRegNameRes
@$xp$22Soapconst@SOAPConst__1
@$xp$22Soapconst@SOAPConst__2
@$xp$22Wsdlbind@IBindingInput
@$xp$22Wsdlbind@IWSDLDocument
@$xp$22Wsdlbind@TWSDLDocument
@$xp$22Wsdlintf@TWSDLElements
@$xp$22Xsbuiltins@TXSDateTime
@$xp$22Xsbuiltins@TXSDuration
@$xp$23Intfinfo@PIntfMethEntry
@$xp$23Intfinfo@TIntfMethEntry
@$xp$23Rio@TBeforeExecuteEvent
@$xp$23Service@CheckRegNameRes
@$xp$23Service@GetRegIDTranRes
@$xp$23Soaphttpclient@THTTPRIO
@$xp$23Wsdlbind@IBindingOutput
@$xp$23Wsdlbind@IDocumentation
@$xp$23Wsdlbind@IXMLSchemaDefs
@$xp$23Wsdlbind@TDocumentation
@$xp$23Wsdlbind@TXMLSchemaDefs
@$xp$23Xsbuiltins@TXSHexBinary
@$xp$24Intfinfo@TIntfParamEntry
@$xp$24Wsdlitems@IQualifiedName
@$xp$24Wsdlnode@TWSDLClientNode
@$xp$25Account@GetAccountInfoRes
@$xp$25Httputil@IStringTokenizer
@$xp$25Invokeregistry@TRemotable
@$xp$25Typetrans@TTypeTranslator
@$xp$26Invokeregistry@PTRemotable
@$xp$26Invokeregistry@TDynToClear
@$xp$26Invokeregistry@TInvContext
@$xp$26Service@ActivateLicenseRes
@$xp$26Soaphttptrans@IHTTPReqResp
@$xp$26Soaphttptrans@THTTPReqResp
@$xp$26Wsdlbind@IBindingOperation
@$xp$26Wsdlbind@TBindingOperation
@$xp$26Wsdlitems@TWSDLIterateProc
@$xp$27Cdiroutl@TCDirectoryOutline
@$xp$27Invokeregistry@TDataContext
@$xp$27Invokeregistry@TRemRegEntry
@$xp$27Invokeregistry@TRemotableXS
@$xp$27Wsdlbind@IBindingOperations
@$xp$27Wsdlbind@TBindingOperations
@$xp$27Wsdlnode@EWSDLLoadException
@$xp$28Account@UpdateAccountInfoRes
@$xp$28Intfinfo@TFillMethodArrayOpt
@$xp$28Intfinfo@TIntfMethEntryArray
@$xp$28Opconvert@TSOAPConvertOption
@$xp$28Optosoapdomconv@TSOAPDomConv
@$xp$28Service@DeactivateLicenseRes
@$xp$28Service@ReactivateLicenseRes
@$xp$28Xsbuiltins@TXSCustomDateTime
@$xp$29Intfinfo@TIntfParamEntryArray
@$xp$29Intfinfo@TPIntfMethEntryArray
@$xp$29Invokeregistry@ExtNameMapItem
@$xp$29Opconvert@TSOAPConvertOptions
@$xp$29Optosoapdomconv@ConvNodeState
@$xp$29Optosoapdomconv@TXMLNodeArray
@$xp$29Service@ConfirmDestroyCodeRes
@$xp$29Soapdomconv@TSOAPDOMProcessor
@$xp$29Typetrans@ETypeTransException
@$xp$30Invokeregistry@InvRegIntfEntry
@$xp$30Invokeregistry@TInvokableClass
@$xp$30Invokeregistry@TRemotableClass
@$xp$30Optosoapdomconv@TMultiRefNodes
@$xp$30Optosoapdomconv@TSOAPArrayDesc
@$xp$30Wsdlitems@IterateImportOptions
@$xp$30Xsbuiltins@EXSDecimalException
@$xp$31Invokeregistry@InvRegClassEntry
@$xp$31Invokeregistry@TObjMultiOptions
@$xp$31Soapdomconv@IDOMHeaderProcessor
@$xp$31Soaphttptrans@SOAPInvokeOptions
@$xp$31Xsbuiltins@EXSDateTimeException
@$xp$32Intfinfo@EInterfaceRTTIException
@$xp$32Invokeregistry@InvokeRegistry__5
@$xp$32Invokeregistry@InvokeRegistry__6
@$xp$32Invokeregistry@InvokeRegistry__7
@$xp$32Invokeregistry@InvokeRegistry__9
@$xp$32Invokeregistry@TIntfInvokeOption
@$xp$32Invokeregistry@TRemotableXSClass
@$xp$32Optosoapdomconv@TMultiRefNodeMap
@$xp$32Optosoapdomcustom@ICustomConvert
@$xp$32Soaphttptrans@TSOAPInvokeOptions
@$xp$32Xsbuiltins@EXSHexBinaryException
@$xp$33Invokeregistry@InvokeRegistry__01
@$xp$33Invokeregistry@InvokeRegistry__02
@$xp$33Invokeregistry@InvokeRegistry__22
@$xp$33Invokeregistry@InvokeRegistry__31
@$xp$33Invokeregistry@InvokeRegistry__32
@$xp$33Invokeregistry@InvokeRegistry__42
@$xp$33Invokeregistry@InvokeRegistry__51
@$xp$33Invokeregistry@InvokeRegistry__61
@$xp$33Invokeregistry@InvokeRegistry__71
@$xp$33Invokeregistry@InvokeRegistry__81
@$xp$33Invokeregistry@InvokeRegistry__91
@$xp$33Invokeregistry@TIntfInvokeOptions
@$xp$33Optosoapdomconv@TMultiRefNodeElem
@$xp$33Optosoapdomcustom@TConverterEntry
@$xp$33Wsdlbind@IDocumentationCollection
@$xp$33Wsdlbind@TDocumentationCollection
@$xp$34Invokeregistry@ERemotableException
@$xp$34Invokeregistry@TCreateInstanceProc
@$xp$34Optosoapdomconv@OPToSOAPDomConv__3
@$xp$34Optosoapdomconv@TSOAPArrayElemDesc
@$xp$35Invokeregistry@MethParamNameMapItem
@$xp$35Invokeregistry@SerializationOptions
@$xp$35Invokeregistry@TInvokableClassClass
@$xp$35Optosoapdomconv@TOPToSoapDomConvert
@$xp$36Invokeregistry@TInvRegIntfEntryArray
@$xp$36Invokeregistry@TSerializationOptions
@$xp$36Optosoapdomconv@ESOAPDomConvertError
@$xp$36Optosoapdomconv@TMultiRefNodeMapElem
@$xp$36Soapdomconv@TDOMHeaderProcessorArray
@$xp$36Soapdomconv@TDOMHeaderProcessorEntry
@$xp$37Invokeregistry@ETypeRegistryException
@$xp$37Invokeregistry@TRemotableTypeRegistry
@$xp$38Invokeregistry@TInvokableClassRegistry
@$xp$38Optosoapdomcustom@OPToSOAPDomCustom__2
@$xp$39Invokeregistry@ERemotableExceptionClass
@$xp$44Optosoapdomcustom@TOPToSoapDomCustomRegistry
@$xp$7TCGauge
@$xp$8Rio@TRIO
@@Actkey@Finalize
@@Actkey@Initialize
@@Ccalendr@Finalize
@@Ccalendr@Initialize
@@Cdiroutl@Finalize
@@Cdiroutl@Initialize
@@Cgauges@Finalize
@@Cgauges@Initialize
@@Perfgrap@Finalize
@@Perfgrap@Initialize
@@Prkdsmu1@Finalize
@@Prkdsmu1@Initialize
@@Useracc@Finalize
@@Useracc@Initialize
@Account@Finalization$qqrv
@Account@GetAccountInfoRes@
@Account@GetAccountSoap$qqro17System@AnsiStringp23Soaphttpclient@THTTPRIO
@Account@UpdateAccountInfoRes@
@Account@initialization$qqrv
@Cdiroutl@TCDirectoryOutline@
@Cdiroutl@TCDirectoryOutline@$bctr$qqrp18Classes@TComponent
@Cdiroutl@TCDirectoryOutline@APointer
@Cdiroutl@TCDirectoryOutline@AssignCaseProc$qqrv
@Cdiroutl@TCDirectoryOutline@BuildOneLevel$qqrl
@Cdiroutl@TCDirectoryOutline@BuildSubTree$qqrl
@Cdiroutl@TCDirectoryOutline@BuildTree$qqrv
@Cdiroutl@TCDirectoryOutline@Change$qqrv
@Cdiroutl@TCDirectoryOutline@Click$qqrv
@Cdiroutl@TCDirectoryOutline@CreateWnd$qqrv
@Cdiroutl@TCDirectoryOutline@CurDir$qv
@Cdiroutl@TCDirectoryOutline@DriveToInt$qqrc
@Cdiroutl@TCDirectoryOutline@Expand$qqri
@Cdiroutl@TCDirectoryOutline@ForceCase$qqrrx17System@AnsiString
@Cdiroutl@TCDirectoryOutline@GetChildNamed$qqrrx17System@AnsiStringl
@Cdiroutl@TCDirectoryOutline@InvalidIndex
@Cdiroutl@TCDirectoryOutline@Loaded$qqrv
@Cdiroutl@TCDirectoryOutline@RootIndex
@Cdiroutl@TCDirectoryOutline@SetDirectory$qqr17System@AnsiString
@Cdiroutl@TCDirectoryOutline@SetDrive$qqrc
@Cdiroutl@TCDirectoryOutline@SetTextCase$qqr18Cdiroutl@TTextCase
@Cdiroutl@TCDirectoryOutline@WalkTree$qqrrx17System@AnsiString
@Encddecd@DecodeStream$qqrp15Classes@TStreamt1
@Encddecd@DecodeString$qqrx17System@AnsiString
@Encddecd@EncodeStream$qqrp15Classes@TStreamt1
@Encddecd@EncodeString$qqrx17System@AnsiString
@Encddecd@Finalization$qqrv
@Encddecd@initialization$qqrv
@Httputil@Finalization$qqrv
@Httputil@FirstDelimiter$qqrx17System@AnsiStringt1
@Httputil@FirstDelimiter$qqrx17System@WideStringt1
@Httputil@GetDefaultStreamLoader$qqrv
@Httputil@HTMLEscape$qqrx17System@AnsiString
@Httputil@StartsWith$qqrx17System@AnsiStringt1
@Httputil@StringToStringArray$qqrx17System@AnsiStringt1
@Httputil@StringTokenizer$qqrx17System@AnsiStringt1
@Httputil@initialization$qqrv
@Intfinfo@CallingConventionName
@Intfinfo@EInterfaceRTTIException@
@Intfinfo@Finalization$qqrv
@Intfinfo@GetClsMemberTypeInfo$qqrpx17Typinfo@TTypeInfox17System@AnsiString
@Intfinfo@GetDynArrayElTypeInfo$qqrp17Typinfo@TTypeInforp17Typinfo@TTypeInfori
@Intfinfo@GetDynArrayNextInfo$qqrp17Typinfo@TTypeInfo
@Intfinfo@GetDynArrayNextInfo2$qqrp17Typinfo@TTypeInfor17System@AnsiString
@Intfinfo@GetIntfMetaData$qqrp17Typinfo@TTypeInfor22Intfinfo@TIntfMetaData28Intfinfo@TFillMethodArrayOpt
@Intfinfo@GetIntfMetaData$qqrp17Typinfo@TTypeInfor22Intfinfo@TIntfMetaDatao
@Intfinfo@GetMethNum$qqrrx22Intfinfo@TIntfMetaDatax17System@AnsiString
@Intfinfo@GetPropListFlat$qqrp17Typinfo@TTypeInforpa16380$p17Typinfo@TPropInfo
@Intfinfo@IsStoredPropConst$qqrp14System@TObjectp17Typinfo@TPropInfo
@Intfinfo@OtherTypeName$qqrx17System@AnsiString
@Intfinfo@SameTypeInfo$qqrpx17Typinfo@TTypeInfot1
@Intfinfo@TypeInfoNames
@Intfinfo@TypeNamesMatch$qqrx17System@AnsiStringt1
@Intfinfo@initialization$qqrv
@Invokeregistry@AppNameSpacePrefix
@Invokeregistry@ERemotableException@
@Invokeregistry@ERemotableException@$bctr$qqrv
@Invokeregistry@ETypeRegistryException@
@Invokeregistry@Finalization$qqrv
@Invokeregistry@GetRemotableDataContext$qqrv
@Invokeregistry@InvRegistry$qqrv
@Invokeregistry@RemClassRegistry$qqrv
@Invokeregistry@RemTypeRegistry$qqrv
@Invokeregistry@SetRemotableDataContext$qqrpv
@Invokeregistry@SubstituteStrings$qqrx17System@WideStringt1t1
@Invokeregistry@TDataContext@
@Invokeregistry@TDataContext@$bctr$qqrv
@Invokeregistry@TDataContext@$bdtr$qqrv
@Invokeregistry@TDataContext@AddDynArrayToClear$qqrpvp17Typinfo@TTypeInfo
@Invokeregistry@TDataContext@AddObjectToDestroy$qqrp14System@TObject
@Invokeregistry@TDataContext@AddStrToClear$qqrpv
@Invokeregistry@TDataContext@AddVariantToClear$qqrp8TVarData
@Invokeregistry@TDataContext@AllocData$qqri
@Invokeregistry@TDataContext@GetDataPointer$qqri
@Invokeregistry@TDataContext@RemoveObjectToDestroy$qqrp14System@TObject
@Invokeregistry@TDataContext@SetDataPointer$qqripv
@Invokeregistry@TInvContext@
@Invokeregistry@TInvContext@AllocServerData$qqrrx23Intfinfo@TIntfMethEntry
@Invokeregistry@TInvContext@GetParamPointer$qqri
@Invokeregistry@TInvContext@GetResultPointer$qqrv
@Invokeregistry@TInvContext@SetMethodInfo$qqrrx23Intfinfo@TIntfMethEntry
@Invokeregistry@TInvContext@SetParamPointer$qqripv
@Invokeregistry@TInvContext@SetResultPointer$qqrpv
@Invokeregistry@TInvokableClass@
@Invokeregistry@TInvokableClass@$bctr$qqrv
@Invokeregistry@TInvokableClassRegistry@
@Invokeregistry@TInvokableClassRegistry@$bctr$qqrv
@Invokeregistry@TInvokableClassRegistry@$bdtr$qqrv
@Invokeregistry@TInvokableClassRegistry@DeleteFromReg$qqrp17System@TMetaClassp17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@GetActionURIOfIID$qqrrx5_GUID
@Invokeregistry@TInvokableClassRegistry@GetActionURIOfInfo$qqrpx17Typinfo@TTypeInfox17System@WideString
@Invokeregistry@TInvokableClassRegistry@GetClassFromIntfInfo$qqrp17Typinfo@TTypeInforp17System@TMetaClass
@Invokeregistry@TInvokableClassRegistry@GetInfoForURI$qqrx17System@AnsiStringt1rp17System@TMetaClassrp17Typinfo@TTypeInfor17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@GetInterfaceCount$qqrv
@Invokeregistry@TInvokableClassRegistry@GetInterfaceExternalName$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@GetInterfaceExternalName$qqrp17Typinfo@TTypeInfo17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@GetInterfaceExternalName$qqrp17Typinfo@TTypeInfo17System@AnsiStringt2
@Invokeregistry@TInvokableClassRegistry@GetInterfaceInfoFromName$qqrx17System@AnsiStringt1rp17Typinfo@TTypeInfor5_GUID
@Invokeregistry@TInvokableClassRegistry@GetInterfaceTypeInfo$qqrrx5_GUID
@Invokeregistry@TInvokableClassRegistry@GetIntfInvokeOptions$qqrpx17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@GetIntfInvokeOptions$qqrrx5_GUID
@Invokeregistry@TInvokableClassRegistry@GetInvokableObjectFromClass$qqrp17System@TMetaClass
@Invokeregistry@TInvokableClassRegistry@GetMethExternalName$qqrp17Typinfo@TTypeInfo17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@GetMethInternalName$qqrp17Typinfo@TTypeInfo17System@WideString
@Invokeregistry@TInvokableClassRegistry@GetNamespaceByGUID$qqrrx5_GUID
@Invokeregistry@TInvokableClassRegistry@GetParamExternalName$qqrp17Typinfo@TTypeInfo17System@AnsiStringt2
@Invokeregistry@TInvokableClassRegistry@GetParamInternalName$qqrp17Typinfo@TTypeInfo17System@AnsiString17System@WideString
@Invokeregistry@TInvokableClassRegistry@GetRegInterfaceEntry$qqri
@Invokeregistry@TInvokableClassRegistry@GetReturnParamNames$qqrpx17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@GetWSDLEncoding$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@GetWSDLEncoding$qqrp17Typinfo@TTypeInfo17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@GetWSDLEncoding$qqrp17Typinfo@TTypeInfo17System@AnsiStringt2
@Invokeregistry@TInvokableClassRegistry@Lock$qqrv
@Invokeregistry@TInvokableClassRegistry@RegisterDefaultSOAPAction$qqrp17Typinfo@TTypeInfox17System@WideString
@Invokeregistry@TInvokableClassRegistry@RegisterExternalMethName$qqrp17Typinfo@TTypeInfo17System@AnsiStringx17System@WideString
@Invokeregistry@TInvokableClassRegistry@RegisterExternalParamName$qqrp17Typinfo@TTypeInfo17System@AnsiStringt2x17System@WideString
@Invokeregistry@TInvokableClassRegistry@RegisterInterface$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@RegisterInterface$qqrp17Typinfo@TTypeInfox17System@WideString
@Invokeregistry@TInvokableClassRegistry@RegisterInterface$qqrp17Typinfo@TTypeInfox17System@WideStringt2
@Invokeregistry@TInvokableClassRegistry@RegisterInterface$qqrp17Typinfo@TTypeInfox17System@WideStringt2x17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@RegisterInterface$qqrp17Typinfo@TTypeInfox17System@WideStringt2x17System@AnsiStringt2
@Invokeregistry@TInvokableClassRegistry@RegisterInvokableClass$qqrp17System@TMetaClass
@Invokeregistry@TInvokableClassRegistry@RegisterInvokableClass$qqrp17System@TMetaClasspqqrrp14System@TObject$v
@Invokeregistry@TInvokableClassRegistry@RegisterInvokeOptions$qqrp17Typinfo@TTypeInfox32Invokeregistry@TIntfInvokeOption
@Invokeregistry@TInvokableClassRegistry@RegisterInvokeOptions$qqrp17Typinfo@TTypeInfox60System@%Set$t32Invokeregistry@TIntfInvokeOption$iuc$0$iuc$5%
@Invokeregistry@TInvokableClassRegistry@RegisterReturnParamNames$qqrp17Typinfo@TTypeInfox17System@AnsiString
@Invokeregistry@TInvokableClassRegistry@UnLock$qqrv
@Invokeregistry@TInvokableClassRegistry@UnRegisterInterface$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TInvokableClassRegistry@UnRegisterInvokableClass$qqrp17System@TMetaClass
@Invokeregistry@TRemotable@
@Invokeregistry@TRemotable@$bctr$qqrv
@Invokeregistry@TRemotable@$bdtr$qqrv
@Invokeregistry@TRemotable@SetDataContext$qqrp27Invokeregistry@TDataContext
@Invokeregistry@TRemotableTypeRegistry@
@Invokeregistry@TRemotableTypeRegistry@$bctr$qqrv
@Invokeregistry@TRemotableTypeRegistry@$bdtr$qqrv
@Invokeregistry@TRemotableTypeRegistry@ClassOptions$qqrp17System@TMetaClass
@Invokeregistry@TRemotableTypeRegistry@ClassToURI$qqrp17System@TMetaClassr17System@WideStringt2roo
@Invokeregistry@TRemotableTypeRegistry@DeleteEntryFromURIMap$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TRemotableTypeRegistry@GetEntry$qqrp17Typinfo@TTypeInforo17System@WideString
@Invokeregistry@TRemotableTypeRegistry@GetExternalPropName$qqrp17Typinfo@TTypeInfo17System@AnsiString
@Invokeregistry@TRemotableTypeRegistry@GetInternalPropName$qqrp17Typinfo@TTypeInfo17System@WideString
@Invokeregistry@TRemotableTypeRegistry@GetRegisteredClassForBuiltInXSD$qqrx17System@WideString
@Invokeregistry@TRemotableTypeRegistry@GetSimpleBuiltInXSDType$qqrx17System@WideStringt1
@Invokeregistry@TRemotableTypeRegistry@GetURICount$qqrv
@Invokeregistry@TRemotableTypeRegistry@GetURIMap$qqri
@Invokeregistry@TRemotableTypeRegistry@GetURIMap$qqrir27Invokeregistry@TRemRegEntry
@Invokeregistry@TRemotableTypeRegistry@GetVarTypeFromXSD$qqr17System@WideStringt1
@Invokeregistry@TRemotableTypeRegistry@GetXSDInfoForClass$qqrp17Typinfo@TTypeInfor17System@WideStringt2
@Invokeregistry@TRemotableTypeRegistry@InfoToURI$qqrp17Typinfo@TTypeInfor17System@WideStringt2roo
@Invokeregistry@TRemotableTypeRegistry@IsClassScalar$qqrp17System@TMetaClass
@Invokeregistry@TRemotableTypeRegistry@Lock$qqrv
@Invokeregistry@TRemotableTypeRegistry@RegisterExternalPropName$qqrp17Typinfo@TTypeInfo17System@AnsiStringx17System@WideString
@Invokeregistry@TRemotableTypeRegistry@RegisterHolderClsMember$qqrp17Typinfo@TTypeInfo17System@WideStringt2t2
@Invokeregistry@TRemotableTypeRegistry@RegisterSerializeOptions$qqrp17System@TMetaClass64System@%Set$t35Invokeregistry@SerializationOptions$iuc$0$iuc$17%
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass17System@WideString
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass17System@WideStringt2
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass17System@WideStringt2t2
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass17System@WideStringt2t2o
@Invokeregistry@TRemotableTypeRegistry@RegisterXSClass$qqrp17System@TMetaClass17System@WideStringt2t2o31Invokeregistry@TObjMultiOptions
@Invokeregistry@TRemotableTypeRegistry@RegisterXSInfo$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TRemotableTypeRegistry@RegisterXSInfo$qqrp17Typinfo@TTypeInfo17System@WideString
@Invokeregistry@TRemotableTypeRegistry@RegisterXSInfo$qqrp17Typinfo@TTypeInfo17System@WideStringt2
@Invokeregistry@TRemotableTypeRegistry@RegisterXSInfo$qqrp17Typinfo@TTypeInfo17System@WideStringt2t2
@Invokeregistry@TRemotableTypeRegistry@SerializeOptions$qqrp17System@TMetaClass
@Invokeregistry@TRemotableTypeRegistry@TypeInfoToXSD$qqrp17Typinfo@TTypeInfor17System@WideStringt2
@Invokeregistry@TRemotableTypeRegistry@URIToClass$qqr17System@WideStringt1ro
@Invokeregistry@TRemotableTypeRegistry@URIToInfo$qqrx17System@WideStringt1
@Invokeregistry@TRemotableTypeRegistry@UnLock$qqrv
@Invokeregistry@TRemotableTypeRegistry@UnRegisterXSClass$qqrp17System@TMetaClass
@Invokeregistry@TRemotableTypeRegistry@UnRegisterXSInfo$qqrp17Typinfo@TTypeInfo
@Invokeregistry@TRemotableTypeRegistry@VariantToInfo$qqrrx14System@Varianto
@Invokeregistry@TRemotableTypeRegistry@XSDToTypeInfo$qqr17System@WideStringt1
@Invokeregistry@TRemotableXS@
@Invokeregistry@TRemotableXS@NativeToXS$qqrv
@Invokeregistry@TRemotableXS@XSToNative$qqr17System@WideString
@Invokeregistry@XMLBase64Types
@Invokeregistry@XMLSchemaInstNamepspaces
@Invokeregistry@XMLSchemaNamepspaces
@Invokeregistry@initialization$qqrv
@Invrules@Finalization$qqrv
@Invrules@GetStackTypeSize$qqrp17Typinfo@TTypeInfo18Intfinfo@TCallConv
@Invrules@GetTypeSize$qqrp17Typinfo@TTypeInfo
@Invrules@IsParamByRef$qqr38System@%Set$t10TParamFlag$iuc$0$iuc$5%p17Typinfo@TTypeInfo18Intfinfo@TCallConv
@Invrules@IsRetInAXDX$qqrp17Typinfo@TTypeInfo
@Invrules@RetInFPU$qqrp17Typinfo@TTypeInfo
@Invrules@RetOnStack$qqrp17Typinfo@TTypeInfo
@Invrules@initialization$qqrv
@Opconvert@Finalization$qqrv
@Opconvert@initialization$qqrv
@Optosoapdomconv@DefArrayElemName
@Optosoapdomconv@ESOAPDomConvertError@
@Optosoapdomconv@Finalization$qqrv
@Optosoapdomconv@TOPToSoapDomConvert@
@Optosoapdomconv@TOPToSoapDomConvert@$bctr$qqrp18Classes@TComponent
@Optosoapdomconv@TOPToSoapDomConvert@$bdtr$qqrv
@Optosoapdomconv@TOPToSoapDomConvert@CheckWSDL$qqrv
@Optosoapdomconv@TOPToSoapDomConvert@GetBinding$qqrv
@Optosoapdomconv@TOPToSoapDomConvert@GetPartName$qqrrx22Intfinfo@TIntfMetaData17System@WideString
@Optosoapdomconv@TOPToSoapDomConvert@GetSoapNS$qqrrx22Intfinfo@TIntfMetaData
@Optosoapdomconv@TOPToSoapDomConvert@InvContextToMsg$qqrrx22Intfinfo@TIntfMetaDataip26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@MakeFault$qqrpx18Sysutils@Exception
@Optosoapdomconv@TOPToSoapDomConvert@MakeResponse$qqrrx22Intfinfo@TIntfMetaDataxip26Invokeregistry@TInvContextp15Classes@TStream
@Optosoapdomconv@TOPToSoapDomConvert@MsgToInvContext$qqrpx15Classes@TStreamrx22Intfinfo@TIntfMetaDatarip26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@MsgToInvContext$qqrx17System@WideStringrx22Intfinfo@TIntfMetaDatarip26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@ProcessFault$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%
@Optosoapdomconv@TOPToSoapDomConvert@ProcessResponse$qqrpx15Classes@TStreamrx22Intfinfo@TIntfMetaDatarx23Intfinfo@TIntfMethEntryp26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@ProcessResponse$qqrx17System@WideStringrx22Intfinfo@TIntfMetaDatarx23Intfinfo@TIntfMethEntryp26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@ProcessResponse$qqrx48System@%DelphiInterface$t20Xmlintf@IXMLDocument%rx22Intfinfo@TIntfMetaDatarx23Intfinfo@TIntfMethEntryp26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@ProcessSuccess$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%rx22Intfinfo@TIntfMetaDatarx23Intfinfo@TIntfMethEntryp26Invokeregistry@TInvContext
@Optosoapdomconv@TOPToSoapDomConvert@SetWSDLView$qqrpx18Wsdlnode@TWSDLView
@Optosoapdomconv@TSOAPDomConv@
@Optosoapdomconv@TSOAPDomConv@$bctr$qqrp18Classes@TComponent
@Optosoapdomconv@TSOAPDomConv@AddMultiRefNode$qqr17System@AnsiStringpv
@Optosoapdomconv@TSOAPDomConv@AddNamespaceDecl$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%17System@WideString
@Optosoapdomconv@TSOAPDomConv@AddObjectAsWriting$qqrp14System@TObject
@Optosoapdomconv@TSOAPDomConv@CheckEncodingStyle$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%
@Optosoapdomconv@TSOAPDomConv@ChildNodesAreNull$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%
@Optosoapdomconv@TSOAPDomConv@ConvertEnumToSoap$qqrp17Typinfo@TTypeInfopvi
@Optosoapdomconv@TSOAPDomConv@ConvertNativeArrayToSoap$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringp17Typinfo@TTypeInfopvio
@Optosoapdomconv@TSOAPDomConv@ConvertNativeDataToSoap$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringp17Typinfo@TTypeInfopvi
@Optosoapdomconv@TSOAPDomConv@ConvertObjectToSOAP$qqr17System@WideStringpv44System@%DelphiInterface$t16Xmlintf@IXMLNode%t3i
@Optosoapdomconv@TSOAPDomConv@ConvertSOAPToObject$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17System@TMetaClass17System@WideStringt4pvi
@Optosoapdomconv@TSOAPDomConv@ConvertSoapToEnum$qqrp17Typinfo@TTypeInfo17System@WideStringo
@Optosoapdomconv@TSOAPDomConv@ConvertSoapToNativeArray$qqrpvp17Typinfo@TTypeInfo44System@%DelphiInterface$t16Xmlintf@IXMLNode%t3
@Optosoapdomconv@TSOAPDomConv@ConvertSoapToNativeArrayElem$qqrp17Typinfo@TTypeInfot144System@%DelphiInterface$t16Xmlintf@IXMLNode%t359System@%DynamicArray$t34Optosoapdomconv@TSOAPArrayElemDesc%iipv
@Optosoapdomconv@TSOAPDomConv@ConvertSoapToNativeData$qqrpvp17Typinfo@TTypeInfop27Invokeregistry@TDataContext44System@%DelphiInterface$t16Xmlintf@IXMLNode%t4ooi
@Optosoapdomconv@TSOAPDomConv@ConvertSoapToVariant$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%pv
@Optosoapdomconv@TSOAPDomConv@ConvertVariantToSoap$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringp17Typinfo@TTypeInfop8TVarDatairx14System@Varianto
@Optosoapdomconv@TSOAPDomConv@CreateMultiRefNode$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%17System@WideStringt2
@Optosoapdomconv@TSOAPDomConv@CreateNULLNode$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringo
@Optosoapdomconv@TSOAPDomConv@CreateObjectNode$qqrp14System@TObject44System@%DelphiInterface$t16Xmlintf@IXMLNode%t217System@WideStringt4o
@Optosoapdomconv@TSOAPDomConv@CreateScalarNodeXS$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringt3t3t3o
@Optosoapdomconv@TSOAPDomConv@CreateTypedNode$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringt3t3o
@Optosoapdomconv@TSOAPDomConv@FinalizeMultiRefNodes$qqrv
@Optosoapdomconv@TSOAPDomConv@FindMultiRefNodeByID$qqr17System@AnsiString
@Optosoapdomconv@TSOAPDomConv@FindMultiRefNodeByInstance$qqrpv
@Optosoapdomconv@TSOAPDomConv@FindNodeByHREF$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%17System@WideString
@Optosoapdomconv@TSOAPDomConv@FindPrefixForURI$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringo
@Optosoapdomconv@TSOAPDomConv@GetDataNode$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1r17System@WideString
@Optosoapdomconv@TSOAPDomConv@GetElementType$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%r17System@WideStringt2
@Optosoapdomconv@TSOAPDomConv@GetNewID$qqrv
@Optosoapdomconv@TSOAPDomConv@GetNodeAsText$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%
@Optosoapdomconv@TSOAPDomConv@GetObjectPropAsText$qqrp14System@TObjectp17Typinfo@TPropInfo
@Optosoapdomconv@TSOAPDomConv@GetOptions$qqrv
@Optosoapdomconv@TSOAPDomConv@GetTypeBySchemaNS$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%17System@WideString
@Optosoapdomconv@TSOAPDomConv@IsNodeAVarArray$qqrx44System@%DelphiInterface$t16Xmlintf@IXMLNode%rus
@Optosoapdomconv@TSOAPDomConv@IsObjectWriting$qqrp14System@TObject
@Optosoapdomconv@TSOAPDomConv@LoadObject$qqrp14System@TObject44System@%DelphiInterface$t16Xmlintf@IXMLNode%t2
@Optosoapdomconv@TSOAPDomConv@MakeArrayNode$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringt3t3pxixi
@Optosoapdomconv@TSOAPDomConv@MultiRefObject$qqrp17System@TMetaClass
@Optosoapdomconv@TSOAPDomConv@NodeIsNULL$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%
@Optosoapdomconv@TSOAPDomConv@ReadRectDynArray$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17Typinfo@TTypeInfoipvi
@Optosoapdomconv@TSOAPDomConv@ReadRectDynArrayElem$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17Typinfo@TTypeInfoiipvri
@Optosoapdomconv@TSOAPDomConv@ReadRow$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1riipvp17Typinfo@TTypeInfo
@Optosoapdomconv@TSOAPDomConv@ReadVarArrayDim$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%ous
@Optosoapdomconv@TSOAPDomConv@ReadVariant$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%pv
@Optosoapdomconv@TSOAPDomConv@RemoveObjectAsWriting$qqrp14System@TObject
@Optosoapdomconv@TSOAPDomConv@ResetMultiRef$qqrv
@Optosoapdomconv@TSOAPDomConv@SetAttributeNS$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringt3t3
@Optosoapdomconv@TSOAPDomConv@SetNodeType$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1x17System@WideStringt3
@Optosoapdomconv@TSOAPDomConv@SetObjectPropFromText$qqrp14System@TObjectp17Typinfo@TPropInfo17System@WideString
@Optosoapdomconv@TSOAPDomConv@SetOptions$qqr56System@%Set$t28Opconvert@TSOAPConvertOption$iuc$0$iuc$8%
@Optosoapdomconv@TSOAPDomConv@WriteNonRectDynArray$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringp17Typinfo@TTypeInfot3t3pvi
@Optosoapdomconv@TSOAPDomConv@WriteNonRectDynArrayElem$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17Typinfo@TTypeInfo17System@WideStringt4pvi
@Optosoapdomconv@TSOAPDomConv@WriteRectDynArray$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17Typinfo@TTypeInfoipv17System@WideString
@Optosoapdomconv@TSOAPDomConv@WriteRectDynArrayElem$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t1p17Typinfo@TTypeInfoiipv17System@WideString
@Optosoapdomconv@TSOAPDomConv@WriteVarArray$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringrx14System@Variant
@Optosoapdomconv@TSOAPDomConv@WriteVarArrayAsB64$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringrx14System@Variant
@Optosoapdomconv@TSOAPDomConv@WriteVariant$qqr44System@%DelphiInterface$t16Xmlintf@IXMLNode%t117System@WideStringrx14System@Variant
@Optosoapdomconv@initialization$qqrv
@Optosoapdomcustom@ConverterRegistry
@Optosoapdomcustom@Finalization$qqrv
@Optosoapdomcustom@TOPToSoapDomCustomRegistry@
@Optosoapdomcustom@TOPToSoapDomCustomRegistry@GetConverter$qqrp17System@TMetaClass
@Optosoapdomcustom@TOPToSoapDomCustomRegistry@RegisterCustomConverter$qqrp17System@TMetaClass17System@AnsiStringt260System@%DelphiInterface$t32Optosoapdomcustom@ICustomConvert%
@Optosoapdomcustom@initialization$qqrv
@Rio@Finalization$qqrv
@Rio@TRIO@
@Rio@TRIO@$bctr$qqrp18Classes@TComponent
@Rio@TRIO@$bdtr$qqrv
@Rio@TRIO@AfterConstruction$qqrv

Sections

.text
Size: 1004KB - Virtual size: 1004KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 753KB - Virtual size: 756KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ekasrv.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:98:41:5e:ac:f6:d7:cd:5a:37:56:29:55:b1:89:f1:2a:cd:9d:d7:9e:3c:e2:62:5b:3d:69:67:f5:68:86:88
Signer

Actual PE Digest

bd:98:41:5e:ac:f6:d7:cd:5a:37:56:29:55:b1:89:f1:2a:cd:9d:d7:9e:3c:e2:62:5b:3d:69:67:f5:68:86:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\Ekasrv\obj\Debug\Ekasrv.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ekc3220.dll
.dll windows:1 windows x86 arch:x86

4f33cb3a1fabc8b5d96b2e9afb8acab4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualFree
VirtualAlloc
WritePrivateProfileStringA
WaitForSingleObject
FreeLibrary
CloseHandle
CreateEventA
GetStartupInfoA
WriteFile
LeaveCriticalSection
GetStdHandle
LockResource
ExitProcess
FindClose
FindFirstFileA
FindResourceA
GetCurrentDirectoryA
GetEnvironmentStrings
GlobalMemoryStatus
GlobalAddAtomA
GetCurrentProcessId
GlobalDeleteAtom
GetTickCount
GetComputerNameA
GetTempPathA
GetSystemDirectoryA
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
CreateFileA
LoadResource
GetEnvironmentVariableA
RaiseException
CreateMutexA
LoadLibraryA
InitializeCriticalSection
GetCurrentThreadId
CreateProcessA
GlobalGetAtomNameA
GlobalFindAtomA
GetCurrentProcess
DeleteFileA
GetVersionExA
GetDriveTypeA
GetVersion
EnterCriticalSection
ReadFile
GetCommandLineA
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetHandleCount
SizeofResource
Sleep
UnhandledExceptionFilter

advapi32

RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
GetUserNameA

user32

WaitForInputIdle
ShowWindow
SetWindowPos
SetDlgItemTextA
SendMessageCallbackA
SendDlgItemMessageA
PostMessageA
PeekMessageA
MessageBoxA
GetWindowRect
GetDlgItemTextA
GetDlgItem
FindWindowA
EnumThreadWindows
EndDialog
EnableWindow
DialogBoxParamA
DestroyWindow
DdeUninitialize
DdeUnaccessData
DdeInitializeA
DdeGetData
GetDesktopWindow
DdeFreeStringHandle
DdeFreeDataHandle
DdeEnableCallback
DdeDisconnect
DdeCreateStringHandleA
DdeCreateDataHandle
DdeConnect
SendMessageA
DdeClientTransaction
DdeAccessData
CreateDialogParamA
SetWindowTextA

shell32

ShellExecuteA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

Exports

Exports

@NetKeyLoginEx$qqsuslusususpct6usus
@__lockDebuggerData$qv
@__unlockDebuggerData$qv
CmdLn
CmdLnEx
DllEntryPoint
H01
H03
H04
H11
H28
H29
H2C
H32
H33
H34
H35
H36
H37
H38
H39
H3A
H3B
H3C
H3D
H3E
H3F
H42
H43
H44
H45
H46
H47
H48
H49
H4C
H4D
H4E
H4F
H55
H5A
H5B
H5C
H5D
H5E
H5F
H60
H61
H62
H63
H64
H65
H66
H67
H6A
H6B
H6D
H77
H78
H79
H80
H81
H82
H83
H84
H85
H86
H8C
H96
H97
H98
H99
H9A
H9B
H9C
H9D
H9F
HA0
HA1
HA2
HA3
HA4
HA5
HA6
HA7
HA9
HAA
HAB
HAC
HAD
HAE
HAF
HB0
HB3
HB4
HB5
HC8
HC9
HCA
HCB
HCC
HFA
HFB
HFC
HFD
HFE
HFF
InstallKey_Status
RemoveKey_Status
_1810
_1910
_2010
__DebuggerHookData
ck3220

Sections

CODE
Size: 122KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 19KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ekc6420.dll
.dll windows:4 windows x64 arch:x64

a99b73bc89f630c54631425c1ab2e758

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAddAtomA
CloseHandle
CreateProcessA
GlobalFindAtomA
SetEvent
GetProcAddress
GetModuleHandleA
GetTickCount
WritePrivateProfileStringA
ExitProcess
GetPrivateProfileStringA
LoadLibraryA
FreeLibrary
DeleteFileA
GetEnvironmentVariableA
SetFilePointer
ReadFile
CreateFileA
GetModuleFileNameA
LockResource
SizeofResource
LoadResource
FindResourceA
WaitForSingleObject
ResetEvent
GetSystemDirectoryA
GetTempPathA
GetCommandLineA
GetVersionExA
CreateEventA
GetComputerNameA
GetLastError
CreateMutexA
SetErrorMode
GetCurrentProcess
GetCurrentProcessId
SetEndOfFile
HeapReAlloc
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
GlobalDeleteAtom
FindClose
GlobalGetAtomNameA
Sleep
GetLocalTime
FindFirstFileA
WideCharToMultiByte
LeaveCriticalSection
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
EnterCriticalSection

user32

DestroyWindow
DdeUninitialize
DdeEnableCallback
DdeDisconnect
DialogBoxParamA
CreateDialogParamA
SendDlgItemMessageA
EnableWindow
GetDlgItem
ShowWindow
SendMessageCallbackA
PeekMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
EndDialog
DdeFreeStringHandle
MessageBoxA
GetDlgItemTextA
SetDlgItemTextA
SetWindowTextA
DdeAccessData
DdeUnaccessData
DdeConnect
WaitForInputIdle
PostMessageA
SendMessageA
FindWindowA
DdeGetData
DdeClientTransaction
DdeInitializeA
DdeCreateStringHandleA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegQueryValueExA
GetUserNameA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegCloseKey

shell32

ShellExecuteA

Exports

Exports

?NetKeyLoginEx@@YAGGJGGGPEAD0GG@Z
CmdLn
CmdLnEx
H01
H03
H04
H11
H28
H29
H2C
H32
H33
H34
H35
H36
H37
H38
H39
H3A
H3B
H3C
H3D
H3E
H3F
H42
H43
H44
H45
H46
H47
H48
H49
H4C
H4D
H4E
H4F
H55
H5A
H5B
H5C
H5D
H5E
H5F
H60
H61
H62
H63
H64
H65
H66
H67
H6A
H6B
H6D
H77
H78
H79
H80
H81
H82
H83
H84
H85
H86
H8C
H96
H97
H98
H99
H9A
H9B
H9C
H9D
H9F
HA0
HA1
HA2
HA3
HA4
HA5
HA6
HA7
HA9
HAA
HAB
HAC
HAD
HAE
HAF
HB0
HB3
HB4
HB5
HC8
HC9
HCA
HCB
HCC
HFA
HFB
HFC
HFD
HFE
HFF
InstallKey_Status
RemoveKey_Status
_1810
_1910
_2010
ck3220

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EntityFramework.SqlServer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:62:41:2f:c7:4d:8a:ae:13:26:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/02/2015, 18:33

Not After

10/05/2016, 18:33

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:e2:7a:f4:b4:55:45:46:ab:e3:3e:ab:35:b9:fd:cb:6d:1f:21:d0
Signer

Actual PE Digest

58:e2:7a:f4:b4:55:45:46:ab:e3:3e:ab:35:b9:fd:cb:6d:1f:21:d0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamCity\buildAgent\work\f78081dbe19c7310\EFBuild\obj\ReleaseNet40\EntityFramework.SqlServer\EntityFramework.SqlServer.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 578KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EntityFramework.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:62:41:2f:c7:4d:8a:ae:13:26:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/02/2015, 18:33

Not After

10/05/2016, 18:33

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:73:59:a3:49:91:d8:4d:34:11:e3:21:a6:e3:60:97:5e:f1:22:95
Signer

Actual PE Digest

f5:73:59:a3:49:91:d8:4d:34:11:e3:21:a6:e3:60:97:5e:f1:22:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\TeamCity\buildAgent\work\f78081dbe19c7310\EFBuild\obj\ReleaseNet40\EntityFramework\EntityFramework.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FireFox_Profile_Itt.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ptech\Desktop\Code\iolo_Elite\FireFox_Profile_Itt\FireFox_Profile_Itt\obj\Debug\FireFox_Profile_Itt.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Hardcodet.Wpf.TaskbarNotification.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:40:84:d1:e4:e7:2b:97:30:fb:cb:05:ef:3a:6a:58:35:85:92:b0:3e:e6:63:60:d9:c4:b3:c9:3f:d6:09:e6
Signer

Actual PE Digest

1c:40:84:d1:e4:e7:2b:97:30:fb:cb:05:ef:3a:6a:58:35:85:92:b0:3e:e6:63:60:d9:c4:b3:c9:3f:d6:09:e6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\NotifyIconWpf\obj\Debug\Hardcodet.Wpf.TaskbarNotification.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.Expression.Drawing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\Microsoft.Expression.Drawing\Win32\Release\Microsoft.Expression.Drawing.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MyLibrary.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:4e:92:65:67:4b:82:ab:2b:6b:f8:fc:28:76:10:30:2b:8a:42:b7:d7:f9:ad:8c:4f:45:99:b1:8b:68:19:4a
Signer

Actual PE Digest

b0:4e:92:65:67:4b:82:ab:2b:6b:f8:fc:28:76:10:30:2b:8a:42:b7:d7:f9:ad:8c:4f:45:99:b1:8b:68:19:4a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\MyLibrary\obj\Debug\MyLibrary.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/AvastAntiTrackPremiumFilter.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:3f:de:73:5f:60:14:fb:8b:b8:95:5d:5c:6b:9a:73:2f:e1:b9:bf:0c:a0:85:6b:a6:28:02:de:5a:c4:53:1d
Signer

Actual PE Digest

ef:3f:de:73:5f:60:14:fb:8b:b8:95:5d:5c:6b:9a:73:2f:e1:b9:bf:0c:a0:85:6b:a6:28:02:de:5a:c4:53:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\Netfilter_Updated\PFNetFilterCS\obj\Win32\Debug\AvastAntiTrackPremiumFilter.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/AvastAntiTrackPremiumSupport.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:e7:07:f4:60:c5:a9:15:3a:96:4e:44:f5:1c:27:13:9a:40:a2:3d:5c:f8:b3:eb:70:1e:e7:19:5e:e4:06:bf
Signer

Actual PE Digest

85:e7:07:f4:60:c5:a9:15:3a:96:4e:44:f5:1c:27:13:9a:40:a2:3d:5c:f8:b3:eb:70:1e:e7:19:5e:e4:06:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\TrackOffSupport\TrackOffSupport\obj\Debug\AvastAntiTrackPremiumSupport.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/InstallAvastAntiTrackPremiumSupportDrivers_x64.exe
.exe windows:4 windows x64 arch:x64

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:06:5f:94:da:a9:3a:e4:0a:c8:8e:2b:10:86:42:e7:11:fe:b3:a7:96:60:67:29:88:2e:76:0b:72:1f:d5:b8
Signer

Actual PE Digest

4d:06:5f:94:da:a9:3a:e4:0a:c8:8e:2b:10:86:42:e7:11:fe:b3:a7:96:60:67:29:88:2e:76:0b:72:1f:d5:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\raf\Desktop\Code\InstallTrackOFFDrivers\InstallTrackOffSupportDrivers\InstallTrackOffSupportDrivers\obj\x64\Debug\InstallTrackOffSupportDrivers.pdb

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/InstallAvastAntiTrackPremiumSupportDrivers_x86.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:f6:00:89:ab:0d:d4:2a:58:6f:30:4d:cc:a7:a8:87:4d:b4:27:0f:cd:10:66:30:05:55:45:0d:33:ae:06:bc
Signer

Actual PE Digest

89:f6:00:89:ab:0d:d4:2a:58:6f:30:4d:cc:a7:a8:87:4d:b4:27:0f:cd:10:66:30:05:55:45:0d:33:ae:06:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\raf\Desktop\Code\InstallTrackOFFDrivers\InstallTrackOffSupportDrivers\InstallTrackOffSupportDrivers\obj\x86\Debug\InstallTrackOffSupportDrivers.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/tdi/std/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

b8582f4c4845d71fef26e5e45b77d15a

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:3a:34:2a:01:02:61:d5:5c:06:08:85:63:0b:8a:16:22:01:6f:3f:e9:84:8c:dc:a9:d3:fe:12:63:22:8b:f8
Signer

Actual PE Digest

b8:3a:34:2a:01:02:61:d5:5c:06:08:85:63:0b:8a:16:22:01:6f:3f:e9:84:8c:dc:a9:d3:fe:12:63:22:8b:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\projects\netfilter3\driver_tdi\demo\objfre_wnet_amd64\amd64\netfilter2.pdb

Imports

ntoskrnl.exe

KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
IofCompleteRequest
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ObOpenObjectByPointer
IoDeleteSymbolicLink
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
ZwClose
IoDetachDevice
IofCallDriver
PsGetCurrentProcessId
IoAllocateMdl
IoBuildDeviceIoControlRequest
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInsertQueueDpc
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
IoReleaseCancelSpinLock
MmMapLockedPagesSpecifyCache
RtlAppendUnicodeToString
KeInitializeDpc
KeInitializeTimer
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
KeInitializeEvent
MmAllocatePagesForMdl
KeWaitForSingleObject
KeSetTimer
ObfReferenceObject
MmFreePagesFromMdl
MmUnmapLockedPages
KeBugCheckEx
IoFreeMdl
ExAllocatePoolWithTag
__C_specific_handler

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/tdi/std/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

b15d5ed2172ec6393933cdc9dfc2dedd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:e4:8c:a8:60:21:4c:dc:69:61:4a:b4:21:84:04:ae:a5:7d:9b:69:84:32:d1:78:98:8e:6a:9f:35:7d:ea:b1
Signer

Actual PE Digest

1e:e4:8c:a8:60:21:4c:dc:69:61:4a:b4:21:84:04:ae:a5:7d:9b:69:84:32:d1:78:98:8e:6a:9f:35:7d:ea:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\projects\netfilter3\driver_tdi\demo\objfre_wxp_x86\i386\netfilter2.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ZwClose
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoDetachDevice
IofCallDriver
IoFreeMdl
memcpy
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
PsGetCurrentProcessId
KeInsertQueueDpc
IoDeleteDevice
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
ObfReferenceObject
KeWaitForSingleObject
KeInitializeEvent
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
IoReleaseCancelSpinLock
ExAllocatePoolWithTag
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/tdi/wpp/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

b8582f4c4845d71fef26e5e45b77d15a

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:3a:34:2a:01:02:61:d5:5c:06:08:85:63:0b:8a:16:22:01:6f:3f:e9:84:8c:dc:a9:d3:fe:12:63:22:8b:f8
Signer

Actual PE Digest

b8:3a:34:2a:01:02:61:d5:5c:06:08:85:63:0b:8a:16:22:01:6f:3f:e9:84:8c:dc:a9:d3:fe:12:63:22:8b:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\projects\netfilter3\driver_tdi\demo\objfre_wnet_amd64\amd64\netfilter2.pdb

Imports

ntoskrnl.exe

KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
IofCompleteRequest
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ObOpenObjectByPointer
IoDeleteSymbolicLink
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
ZwClose
IoDetachDevice
IofCallDriver
PsGetCurrentProcessId
IoAllocateMdl
IoBuildDeviceIoControlRequest
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
KeInsertQueueDpc
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
IoReleaseCancelSpinLock
MmMapLockedPagesSpecifyCache
RtlAppendUnicodeToString
KeInitializeDpc
KeInitializeTimer
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
KeInitializeEvent
MmAllocatePagesForMdl
KeWaitForSingleObject
KeSetTimer
ObfReferenceObject
MmFreePagesFromMdl
MmUnmapLockedPages
KeBugCheckEx
IoFreeMdl
ExAllocatePoolWithTag
__C_specific_handler

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/tdi/wpp/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

b15d5ed2172ec6393933cdc9dfc2dedd

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:e4:8c:a8:60:21:4c:dc:69:61:4a:b4:21:84:04:ae:a5:7d:9b:69:84:32:d1:78:98:8e:6a:9f:35:7d:ea:b1
Signer

Actual PE Digest

1e:e4:8c:a8:60:21:4c:dc:69:61:4a:b4:21:84:04:ae:a5:7d:9b:69:84:32:d1:78:98:8e:6a:9f:35:7d:ea:b1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\projects\netfilter3\driver_tdi\demo\objfre_wxp_x86\i386\netfilter2.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ZwClose
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoDetachDevice
IofCallDriver
IoFreeMdl
memcpy
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
PsGetCurrentProcessId
KeInsertQueueDpc
IoDeleteDevice
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
ObfReferenceObject
KeWaitForSingleObject
KeInitializeEvent
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
IoReleaseCancelSpinLock
ExAllocatePoolWithTag
RtlUnwind

hal

KfAcquireSpinLock
KfReleaseSpinLock

tdi.sys

TdiMapUserRequest

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows10/std/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

7d50ba4bd7a462086494e682f4f57a29

Code Sign

33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/02/2017, 20:47

Not After

09/05/2018, 20:47

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:e7:be:b0:2f:01:8f:ea:0f:3b:e9:6e:f7:ca:af:3c:b2:d3:0f:e6:e2:cb:62:ef:7d:34:d1:b1:a4:37:93:46
Signer

Actual PE Digest

d9:e7:be:b0:2f:01:8f:ea:0f:3b:e9:6e:f7:ca:af:3c:b2:d3:0f:e6:e2:cb:62:ef:7d:34:d1:b1:a4:37:93:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\projects\projectsJ\nfsdk2_1.5.4\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsPendClassify0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsFreeCloneNetBufferList0

ndis.sys

NdisGetDataBuffer
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
PsGetCurrentProcessId
ZwSetInformationThread
PsLookupProcessByProcessId
ObOpenObjectByPointer
__C_specific_handler
ZwOpenKey

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 618B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows10/std/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

7833c9e8e79fbea680c766df3c296449

Code Sign

33:00:00:00:18:a7:c6:4e:da:38:3a:9f:79:00:00:00:00:00:18
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/02/2017, 20:47

Not After

09/05/2018, 20:47

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:80:a4:75:f7:72:f4:48:a8:7e:ff:38:67:47:7f:e3:0e:17:24:de:76:6d:8a:b6:46:0c:9a:b7:e3:34:ee:9f
Signer

Actual PE Digest

ef:80:a4:75:f7:72:f4:48:a8:7e:ff:38:67:47:7f:e3:0e:17:24:de:76:6d:8a:b6:46:0c:9a:b7:e3:34:ee:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\projects\projectsJ\nfsdk2_1.5.4\driver_wfp\Win8\Win8Release\Win32\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsAcquireClassifyHandle0
FwpsCalloutRegister1
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsPendClassify0

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

memcpy
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
PsGetCurrentProcessId
ZwSetInformationThread
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwOpenKey
KeQuerySystemTime
_allmul
_aulldiv
_aullrem
RtlUnwind
swprintf_s
ExUuidCreate
ExAllocatePoolWithTag
memset

hal

KeGetCurrentIrql
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows7/std/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

d2087a1743bcf553d7151143dbcac169

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:8c:ec:12:a9:65:4e:29:59:75:7e:13:52:b5:da:e7:6f:4f:f5:57:71:85:e6:43:88:48:90:e8:72:27:88:a4
Signer

Actual PE Digest

3e:8c:ec:12:a9:65:4e:29:59:75:7e:13:52:b5:da:e7:6f:4f:f5:57:71:85:e6:43:88:48:90:e8:72:27:88:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\projects\netfilter3\driver_wfp\demo\objfre_win7_amd64\amd64\netfilter2.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
ZwOpenKey
ExUuidCreate
IoAllocateMdl
ObOpenObjectByPointer
IoReleaseCancelSpinLock
IoCreateDevice
MmFreePagesFromMdl
ObfDereferenceObject
PsGetCurrentProcessId
IoCreateSymbolicLink
IofCompleteRequest
ZwClose
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
MmAllocatePagesForMdl
KeInitializeDpc
RtlAppendUnicodeToString
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
PsLookupProcessByProcessId
KeRemoveQueueDpc
IoDeleteSymbolicLink
MmUnmapLockedPages
KeAcquireSpinLockRaiseToDpc
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPopEntrySList
KeReleaseSpinLock
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExFreePoolWithTag
ExAllocatePoolWithTag
__C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpmSubLayerAdd0
FwpsQueryPacketInjectionState0
FwpmSubLayerEnum0
FwpmTransactionCommit0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpsAcquireClassifyHandle0
FwpmFilterAdd0
FwpsPendClassify0
FwpsCalloutRegister1
FwpmTransactionBegin0
FwpmEngineClose0
FwpmFreeMemory0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleDestroy0
FwpsConstructIpHeaderForTransportPacket0
FwpsAllocateNetBufferAndNetBufferList0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsDiscardClonedStreamData0
FwpsReleaseClassifyHandle0
FwpsStreamInjectAsync0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsInjectionHandleCreate0
FwpsFreeCloneNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectTransportSendAsync0
FwpsCopyStreamDataToBuffer0
FwpsInjectTransportReceiveAsync0
FwpsFlowRemoveContext0

ndis.sys

NdisAllocateGenericObject
NdisGetDataBuffer
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisInitializeEvent
NdisRetreatNetBufferDataStart
NdisFreeGenericObject
NdisAdvanceNetBufferDataStart
NdisFreeNetBufferListPool

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows7/std/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

fa4cfa22a7074e6a9e1db957db9c78f3

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:52:21:51:15:df:36:b3:6f:bd:0a:f0:bf:de:e6:13:14:82:da:2b:89:7e:f6:bf:d5:22:c4:bb:48:bc:fc:93
Signer

Actual PE Digest

d8:52:21:51:15:df:36:b3:6f:bd:0a:f0:bf:de:e6:13:14:82:da:2b:89:7e:f6:bf:d5:22:c4:bb:48:bc:fc:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\projects\netfilter3\driver_wfp\demo\objfre_win7_x86\i386\netfilter2.pdb

Imports

ntoskrnl.exe

RtlUnwind
KeBugCheckEx
KeTickCount
ExUuidCreate
ZwOpenKey
KeInitializeDpc
RtlAppendUnicodeToString
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
ObOpenObjectByPointer
ObfDereferenceObject
ZwClose
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoReleaseCancelSpinLock
memcpy
PsGetCurrentProcessId
IofCompleteRequest
IoDeleteSymbolicLink
IoDeleteDevice
KeRemoveQueueDpc
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
IoFreeMdl
MmUnmapLockedPages
KeInsertQueueDpc
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
InterlockedPushEntrySList
InterlockedPopEntrySList
_aullrem
ExFreePoolWithTag
memset
ExAllocatePoolWithTag

hal

KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

fwpkclnt.sys

FwpmEngineClose0
FwpsAcquireClassifyHandle0
FwpsPendClassify0
FwpsAllocateCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFlowAssociateContext0
FwpmTransactionBegin0
FwpmProviderContextDeleteByKey0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmSubLayerCreateEnumHandle0
FwpmFreeMemory0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsInjectionHandleCreate0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectTransportSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportReceiveAsync0
FwpsAllocateNetBufferAndNetBufferList0
FwpmProviderAdd0
FwpmEngineOpen0
FwpmSubLayerAdd0
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateGet0
FwpsStreamInjectAsync0
FwpsDiscardClonedStreamData0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsFlowRemoveContext0
FwpsFreeCloneNetBufferList0
FwpsInjectionHandleDestroy0
FwpsCopyStreamDataToBuffer0
FwpsFreeNetBufferList0

ndis.sys

NdisWaitEvent
NdisRetreatNetBufferDataStart
NdisInitializeEvent
NdisAdvanceNetBufferDataStart
NdisFreeNetBufferListPool
NdisFreeGenericObject
NdisAllocateNetBufferListPool
NdisAllocateGenericObject
NdisGetDataBuffer

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows7/wpp/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

d2087a1743bcf553d7151143dbcac169

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:8c:ec:12:a9:65:4e:29:59:75:7e:13:52:b5:da:e7:6f:4f:f5:57:71:85:e6:43:88:48:90:e8:72:27:88:a4
Signer

Actual PE Digest

3e:8c:ec:12:a9:65:4e:29:59:75:7e:13:52:b5:da:e7:6f:4f:f5:57:71:85:e6:43:88:48:90:e8:72:27:88:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

j:\projects\netfilter3\driver_wfp\demo\objfre_win7_amd64\amd64\netfilter2.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
ZwOpenKey
ExUuidCreate
IoAllocateMdl
ObOpenObjectByPointer
IoReleaseCancelSpinLock
IoCreateDevice
MmFreePagesFromMdl
ObfDereferenceObject
PsGetCurrentProcessId
IoCreateSymbolicLink
IofCompleteRequest
ZwClose
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
MmAllocatePagesForMdl
KeInitializeDpc
RtlAppendUnicodeToString
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
PsLookupProcessByProcessId
KeRemoveQueueDpc
IoDeleteSymbolicLink
MmUnmapLockedPages
KeAcquireSpinLockRaiseToDpc
ExDeleteNPagedLookasideList
ExQueryDepthSList
ExpInterlockedPopEntrySList
KeReleaseSpinLock
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExFreePoolWithTag
ExAllocatePoolWithTag
__C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpmSubLayerAdd0
FwpsQueryPacketInjectionState0
FwpmSubLayerEnum0
FwpmTransactionCommit0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpsAcquireClassifyHandle0
FwpmFilterAdd0
FwpsPendClassify0
FwpsCalloutRegister1
FwpmTransactionBegin0
FwpmEngineClose0
FwpmFreeMemory0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleDestroy0
FwpsConstructIpHeaderForTransportPacket0
FwpsAllocateNetBufferAndNetBufferList0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsDiscardClonedStreamData0
FwpsReleaseClassifyHandle0
FwpsStreamInjectAsync0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsInjectionHandleCreate0
FwpsFreeCloneNetBufferList0
FwpsFreeNetBufferList0
FwpsInjectTransportSendAsync0
FwpsCopyStreamDataToBuffer0
FwpsInjectTransportReceiveAsync0
FwpsFlowRemoveContext0

ndis.sys

NdisAllocateGenericObject
NdisGetDataBuffer
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisInitializeEvent
NdisRetreatNetBufferDataStart
NdisFreeGenericObject
NdisAdvanceNetBufferDataStart
NdisFreeNetBufferListPool

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows7/wpp/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

fa4cfa22a7074e6a9e1db957db9c78f3

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:52:21:51:15:df:36:b3:6f:bd:0a:f0:bf:de:e6:13:14:82:da:2b:89:7e:f6:bf:d5:22:c4:bb:48:bc:fc:93
Signer

Actual PE Digest

d8:52:21:51:15:df:36:b3:6f:bd:0a:f0:bf:de:e6:13:14:82:da:2b:89:7e:f6:bf:d5:22:c4:bb:48:bc:fc:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

j:\projects\netfilter3\driver_wfp\demo\objfre_win7_x86\i386\netfilter2.pdb

Imports

ntoskrnl.exe

RtlUnwind
KeBugCheckEx
KeTickCount
ExUuidCreate
ZwOpenKey
KeInitializeDpc
RtlAppendUnicodeToString
IoCreateDevice
IoCreateSymbolicLink
RtlInitUnicodeString
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
ObOpenObjectByPointer
ObfDereferenceObject
ZwClose
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoReleaseCancelSpinLock
memcpy
PsGetCurrentProcessId
IofCompleteRequest
IoDeleteSymbolicLink
IoDeleteDevice
KeRemoveQueueDpc
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
IoFreeMdl
MmUnmapLockedPages
KeInsertQueueDpc
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
InterlockedPushEntrySList
InterlockedPopEntrySList
_aullrem
ExFreePoolWithTag
memset
ExAllocatePoolWithTag

hal

KfAcquireSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

fwpkclnt.sys

FwpmEngineClose0
FwpsAcquireClassifyHandle0
FwpsPendClassify0
FwpsAllocateCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFlowAssociateContext0
FwpmTransactionBegin0
FwpmProviderContextDeleteByKey0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmSubLayerCreateEnumHandle0
FwpmFreeMemory0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsInjectionHandleCreate0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectTransportSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportReceiveAsync0
FwpsAllocateNetBufferAndNetBufferList0
FwpmProviderAdd0
FwpmEngineOpen0
FwpmSubLayerAdd0
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateGet0
FwpsStreamInjectAsync0
FwpsDiscardClonedStreamData0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsCloneStreamData0
FwpsFlowRemoveContext0
FwpsFreeCloneNetBufferList0
FwpsInjectionHandleDestroy0
FwpsCopyStreamDataToBuffer0
FwpsFreeNetBufferList0

ndis.sys

NdisWaitEvent
NdisRetreatNetBufferDataStart
NdisInitializeEvent
NdisAdvanceNetBufferDataStart
NdisFreeNetBufferListPool
NdisFreeGenericObject
NdisAllocateNetBufferListPool
NdisAllocateGenericObject
NdisGetDataBuffer

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows8/std/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

328ef0ccb8f673dff8a90203b07ec607

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ba:44:1f:f7:43:f3:65:45:8d:05:8b:16:b2:a7:5a:b4:4d:6b:1e:14:e8:f0:86:f9:a8:9c:c5:6b:39:01:11
Signer

Actual PE Digest

59:ba:44:1f:f7:43:f3:65:45:8d:05:8b:16:b2:a7:5a:b4:4d:6b:1e:14:e8:f0:86:f9:a8:9c:c5:6b:39:01:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

J:\projects\netfilter3\driver_wfp\Win8\Win8ReleaseDemo\x64\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowRemoveContext0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpmEngineOpen0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsCalloutRegister2
FwpsQueryPacketInjectionState0
FwpsAllocateCloneNetBufferList0
FwpsPendClassify0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

RtlInitUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePoolWithTag
ZwClose
ZwOpenKey
ExUuidCreate
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeDpc
KeInsertQueueDpc
KeRemoveQueueDpc
KeInitializeSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObfDereferenceObject
PsGetCurrentProcessId
PsLookupProcessByProcessId
ObOpenObjectByPointer
__C_specific_handler

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows8/std/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

abd4debfe9dea533b38caf32bba978a9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:6e:62:e7:d6:09:4c:23:db:3e:2c:30:6b:61:c1:7e:a7:33:e7:02:43:1f:27:48:71:21:3b:e4:fd:10:69:c0
Signer

Actual PE Digest

5e:6e:62:e7:d6:09:4c:23:db:3e:2c:30:6b:61:c1:7e:a7:33:e7:02:43:1f:27:48:71:21:3b:e4:fd:10:69:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\projects\netfilter3\driver_wfp\Win8\Win8ReleaseDemo\Win32\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowRemoveContext0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsAllocateCloneNetBufferList0
FwpsPendClassify0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister2
FwpsFlowAssociateContext0
FwpsAcquireClassifyHandle0

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

ExUuidCreate
memcpy
memset
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeDpc
KeInsertQueueDpc
KeRemoveQueueDpc
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObfDereferenceObject
PsGetCurrentProcessId
PsLookupProcessByProcessId
ObOpenObjectByPointer
memcmp
_aullrem
RtlUnwind
ZwOpenKey
ZwClose
RtlInitUnicodeString
ExAllocatePoolWithTag

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows8/wpp/amd64/netfilter2.sys
.sys windows:6 windows x64 arch:x64

328ef0ccb8f673dff8a90203b07ec607

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ba:44:1f:f7:43:f3:65:45:8d:05:8b:16:b2:a7:5a:b4:4d:6b:1e:14:e8:f0:86:f9:a8:9c:c5:6b:39:01:11
Signer

Actual PE Digest

59:ba:44:1f:f7:43:f3:65:45:8d:05:8b:16:b2:a7:5a:b4:4d:6b:1e:14:e8:f0:86:f9:a8:9c:c5:6b:39:01:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

J:\projects\netfilter3\driver_wfp\Win8\Win8ReleaseDemo\x64\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowRemoveContext0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpmEngineOpen0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsCalloutRegister2
FwpsQueryPacketInjectionState0
FwpsAllocateCloneNetBufferList0
FwpsPendClassify0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

RtlInitUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePoolWithTag
ZwClose
ZwOpenKey
ExUuidCreate
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeDpc
KeInsertQueueDpc
KeRemoveQueueDpc
KeInitializeSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObfDereferenceObject
PsGetCurrentProcessId
PsLookupProcessByProcessId
ObOpenObjectByPointer
__C_specific_handler

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/driver/wfp/windows8/wpp/i386/netfilter2.sys
.sys windows:6 windows x86 arch:x86

abd4debfe9dea533b38caf32bba978a9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:6e:62:e7:d6:09:4c:23:db:3e:2c:30:6b:61:c1:7e:a7:33:e7:02:43:1f:27:48:71:21:3b:e4:fd:10:69:c0
Signer

Actual PE Digest

5e:6e:62:e7:d6:09:4c:23:db:3e:2c:30:6b:61:c1:7e:a7:33:e7:02:43:1f:27:48:71:21:3b:e4:fd:10:69:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\projects\netfilter3\driver_wfp\Win8\Win8ReleaseDemo\Win32\netfilter2.pdb

Imports

fwpkclnt.sys

FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowRemoveContext0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsReleaseClassifyHandle0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsAllocateCloneNetBufferList0
FwpsPendClassify0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister2
FwpsFlowAssociateContext0
FwpsAcquireClassifyHandle0

ndis.sys

NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisWaitEvent
NdisInitializeEvent

ntoskrnl.exe

ExUuidCreate
memcpy
memset
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeDpc
KeInsertQueueDpc
KeRemoveQueueDpc
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObfDereferenceObject
PsGetCurrentProcessId
PsLookupProcessByProcessId
ObOpenObjectByPointer
memcmp
_aullrem
RtlUnwind
ZwOpenKey
ZwClose
RtlInitUnicodeString
ExAllocatePoolWithTag

hal

KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/install_tdi_driver.bat
NetFilter/BatchFiles/install_tdi_driver_x64.bat
NetFilter/BatchFiles/install_wfp_driver_windows10.bat
NetFilter/BatchFiles/install_wfp_driver_windows10_x64.bat
NetFilter/BatchFiles/install_wfp_driver_windows7.bat
NetFilter/BatchFiles/install_wfp_driver_windows7_x64.bat
NetFilter/BatchFiles/install_wfp_driver_windows8.bat
NetFilter/BatchFiles/install_wfp_driver_windows8_x64.bat
NetFilter/BatchFiles/release/win32/ProtocolFilters.dll
.dll windows:4 windows x86 arch:x86

bfcbb3d40bebdaf638a31b9223fef378

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8
Signer

Actual PE Digest

c1:d5:e8:a3:af:72:52:d3:89:82:3a:00:4b:e3:1c:82:24:b7:cf:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

j:\projects\netfilter3\bin\Release\Win32\ProtocolFilters.pdb

Imports

kernel32

WriteFile
GetFileSize
SetEndOfFile
CreateFileW
SetFilePointer
ReadFile
GetTempPathW
GetTempFileNameW
OpenProcess
DeleteFileW
InterlockedDecrement
CreateDirectoryW
LoadLibraryA
GetProcAddress
FreeLibrary
ProcessIdToSessionId
GetTickCount
CreateEventA
CreateMutexA
WaitForMultipleObjects
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
GetLastError
DeleteCriticalSection
lstrlenA
SetEvent
InitializeCriticalSection
ResetEvent
ExpandEnvironmentStringsW
CloseHandle
WaitForSingleObject
CreateProcessW
FindClose
FindNextFileW
InterlockedIncrement
FindFirstFileW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
LCMapStringW
LCMapStringA
HeapSize
Sleep
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
TlsFree
GetProcessHeap
GetVersionExA
GetCommandLineA
HeapReAlloc
GetSystemTimeAsFileTime
CreateThread
GetCurrentThreadId
ExitThread
MultiByteToWideChar
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
HeapAlloc
SetLastError
RaiseException
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA

advapi32

OpenProcessToken
LookupAccountSidA
LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

oleaut32

SysAllocString
VariantClear
SysFreeString

crypt32

CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFindCertificateInStore
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
PFXExportCertStoreEx

ssleay32

ord48
ord86
ord116
ord110
ord82
ord83
ord75
ord6
ord112
ord12
ord22
ord28
ord8
ord60
ord43
ord78
ord58
ord35
ord166
ord61
ord96
ord84
ord284
ord370
ord391
ord108
ord359
ord265
ord155
ord94
ord74
ord183
ord385

libeay32

ord1912
ord1804
ord672
ord669
ord668
ord197
ord181
ord658
ord667
ord674
ord246
ord3315
ord2604
ord281
ord224
ord857
ord254
ord851
ord298
ord639
ord333
ord2639
ord364
ord2684
ord2746
ord909
ord1299
ord444
ord1318
ord2734
ord1317
ord2672
ord109
ord1308
ord1291
ord170
ord581
ord653
ord2291
ord3205
ord58
ord188
ord573
ord656
ord670
ord673
ord279
ord3106
ord485
ord3171
ord283
ord3024
ord2186
ord664
ord1653
ord1654
ord1958
ord2442
ord566
ord578
ord579
ord657
ord648
ord129
ord2239
ord150
ord649
ord541
ord633
ord1177
ord1508
ord641
ord66
ord89
ord52
ord421
ord95
ord78
ord754
ord164

ws2_32

WSAStartup
WSACleanup
ntohl
htons
ntohs
WSAAddressToStringA

Exports

Exports

?PFObject_create@ProtocolFilters@@YAPAVPFObject@1@HH@Z
?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z
?pf_canDisableFiltering@ProtocolFilters@@YAH_K@Z
?pf_deleteFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_free@ProtocolFilters@@YAXXZ
?pf_getFilterCount@ProtocolFilters@@YAH_K@Z
?pf_getNFEventHandler@ProtocolFilters@@YAPAVNF_EventHandler@nfapi@@XZ
?pf_getProcessOwnerA@ProtocolFilters@@YAHKPADH@Z
?pf_getProcessOwnerW@ProtocolFilters@@YAHKPA_WH@Z
?pf_init@ProtocolFilters@@YAHPAVPFEvents@1@PB_W@Z
?pf_isFilterActive@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_postObject@ProtocolFilters@@YAH_KPAVPFObject@1@@Z
?pf_setRootSSLCertImportFlags@ProtocolFilters@@YAXK@Z
?pf_setRootSSLCertSubject@ProtocolFilters@@YAXPBD@Z
?pf_unzipStream@ProtocolFilters@@YAHPAVPFStream@1@@Z

Sections

.text
Size: 272KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/release/win32/libeay32.dll
.dll windows:4 windows x86 arch:x86

59055464072385904fb3242fc02b064d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\projects\netfilter3\ProtocolFilters\openssl\out32dll\libeay32.pdb

Imports

ws2_32

sendto
recvfrom
bind
listen
accept
ntohl
ioctlsocket
WSACleanup
WSAStartup
gethostbyname
getsockopt
getservbyname
ntohs
htons
htonl
socket
setsockopt
connect
send
WSASetLastError
recv
WSAGetLastError
shutdown
closesocket

gdi32

DeleteObject
GetDIBits
GetObjectA
CreateCompatibleBitmap
GetDeviceCaps

advapi32

CryptSignHashA
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA
CryptDecrypt
CryptCreateHash
CryptSetHashParam
DeregisterEventSource
CryptDestroyHash
CryptExportKey
CryptGetUserKey

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

user32

GetDC
ReleaseDC
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

kernel32

RtlUnwind
GetFullPathNameA
GetCurrentDirectoryA
SetEndOfFile
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileW
FlushConsoleInputBuffer
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
GetTimeZoneInformation
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetLastError
GetVersion
WriteFile
GetFileType
GetStdHandle
FindNextFileA
FindFirstFileA
FindClose
FreeLibrary
LoadLibraryA
CloseHandle
SetLastError
MultiByteToWideChar
SystemTimeToFileTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
WideCharToMultiByte
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
ReadFile
GetConsoleCP
GetConsoleMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetFileAttributesA
GetFileAttributesA
CreateFileA
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
DeleteCriticalSection
GetModuleFileNameA
InitializeCriticalSection
Sleep
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapSize

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_ctr128_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_to_BN
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_to_generalizedtime
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_bn_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_pack_string
ASN1_parse
ASN1_parse_dump
ASN1_primitive_free
ASN1_primitive_new
ASN1_put_eoc
ASN1_put_object
ASN1_seq_pack
ASN1_seq_unpack
ASN1_sign
ASN1_tag2bit
ASN1_tag2str
ASN1_template_d2i
ASN1_template_free
ASN1_template_i2d
ASN1_template_new
ASN1_unpack_string
ASN1_verify
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_accept
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_ex_data
BIO_get_ex_new_index
BIO_get_host_ip
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_mem
BIO_s_null
BIO_s_socket
BIO_set
BIO_set_callback
BIO_set_callback_arg
BIO_set_cipher
BIO_set_ex_data
BIO_set_flags
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_cleanup
BIO_sock_error
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_get_thread_id
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_new
BN_BLINDING_set_flags
BN_BLINDING_set_thread_id
BN_BLINDING_thread_id
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_init
BN_CTX_new
BN_CTX_start
BN_GENCB_call
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_init
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_init
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2dec
BN_bn2hex
BN_bn2mpi
BN_bntest_rand
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_recp
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_prime
BN_generate_prime_ex
BN_get0_nist_prime_192
BN_get0_nist_prime_224
BN_get0_nist_prime_256
BN_get0_nist_prime_384
BN_get0_nist_prime_521
BN_get_params
BN_get_word
BN_hex2bn
BN_init
BN_is_bit_set
BN_is_prime
BN_is_prime_ex
BN_is_prime_fasttest
BN_is_prime_fasttest_ex
BN_kronecker
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_recp
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_mul_reciprocal
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nist_mod_192
BN_nist_mod_224
BN_nist_mod_256
BN_nist_mod_384
BN_nist_mod_521
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_options
BN_print
BN_print_fp
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_reciprocal
BN_rshift
BN_rshift1
BN_set_bit
BN_set_negative
BN_set_params
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_uadd
BN_ucmp
BN_usub
BN_value_one
BUF_MEM_free

Sections

.text
Size: 1000KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/release/win32/nfapi.dll
.dll windows:4 windows x86 arch:x86

201c5ffd42dee8c2ed4f04107fa127db

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:d1:18:9a:21:c6:fa:91:8b:15:fa:96:d2:24:d2:63:56:de:3b:35
Signer

Actual PE Digest

7e:d1:18:9a:21:c6:fa:91:8b:15:fa:96:d2:24:d2:63:56:de:3b:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

j:\projects\netfilter3\bin\Release\Win32\nfapi.pdb

Imports

kernel32

ResetEvent
GetSystemInfo
CloseHandle
SetEvent
DeviceIoControl
CreateEventA
ReadFile
WaitForMultipleObjects
GetProcAddress
GetModuleHandleA
OpenProcess
GetCurrentProcessId
CreateFileA
GetOverlappedResult
CancelIo
SetLastError
GetLastError
WriteFile
GetDriveTypeW
QueryDosDeviceW
GetLogicalDriveStringsW
GetTickCount
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
FlushFileBuffers
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
DeleteService
OpenServiceA
CloseServiceHandle
StartServiceA
CreateServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

psapi

GetModuleFileNameExA
GetModuleFileNameExW

Exports

Exports

?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_RULE@1@H@Z
?nf_adjustProcessPriviledges@nfapi@@YAXXZ
?nf_completeTCPConnectRequest@nfapi@@YA?AW4_NF_STATUS@@_KPAU_NF_TCP_CONN_INFO@1@@Z
?nf_completeUDPConnectRequest@nfapi@@YA?AW4_NF_STATUS@@_KPAU_NF_UDP_CONN_REQUEST@1@@Z
?nf_deleteRules@nfapi@@YA?AW4_NF_STATUS@@XZ
?nf_free@nfapi@@YAXXZ
?nf_getConnCount@nfapi@@YAKXZ
?nf_getProcessNameA@nfapi@@YAHKPADK@Z
?nf_getProcessNameFromKernel@nfapi@@YAHKPA_WK@Z
?nf_getProcessNameW@nfapi@@YAHKPA_WK@Z
?nf_getTCPConnInfo@nfapi@@YA?AW4_NF_STATUS@@_KPAU_NF_TCP_CONN_INFO@1@@Z
?nf_getUDPConnInfo@nfapi@@YA?AW4_NF_STATUS@@_KPAU_NF_UDP_CONN_INFO@1@@Z
?nf_init@nfapi@@YA?AW4_NF_STATUS@@PBDPAVNF_EventHandler@1@@Z
?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_setOptions@nfapi@@YAXKK@Z
?nf_setTCPTimeout@nfapi@@YAKK@Z
?nf_tcpClose@nfapi@@YA?AW4_NF_STATUS@@_K@Z
?nf_tcpDisableFiltering@nfapi@@YA?AW4_NF_STATUS@@_K@Z
?nf_tcpIsProxy@nfapi@@YAHK@Z
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z
?nf_tcpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_tcpSetSockOpt@nfapi@@YA?AW4_NF_STATUS@@_KHPBDH@Z
?nf_udpDisableFiltering@nfapi@@YA?AW4_NF_STATUS@@_K@Z
?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPBEPBDHPAU_NF_UDP_OPTIONS@1@@Z
?nf_udpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z
?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/release/win32/nfregdrv.exe
.exe windows:4 windows x86 arch:x86

1608300345f2399f6ab2c40f09b7edbb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb

Imports

nfapi

?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z
?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z

user32

MessageBoxA
CharNextA

kernel32

HeapDestroy
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/release/win32/ssleay32.dll
.dll windows:4 windows x86 arch:x86

bd8a3f8d32f6d60b7b11b687d7804002

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\projects\netfilter3\ProtocolFilters\openssl\out32dll\ssleay32.pdb

Imports

libeay32

ord3010
ord2924
ord3459
ord3512
ord3663
ord202
ord123
ord201
ord118
ord2128
ord967
ord66
ord4369
ord4474
ord3666
ord219
ord498
ord635
ord912
ord909
ord2784
ord965
ord964
ord256
ord274
ord276
ord3899
ord2572
ord3315
ord2927
ord2747
ord3837
ord282
ord572
ord3165
ord3489
ord1071
ord2925
ord268
ord316
ord363
ord2712
ord4164
ord4262
ord3719
ord216
ord333
ord4125
ord4470
ord206
ord497
ord4046
ord3682
ord2877
ord3711
ord205
ord486
ord484
ord763
ord577
ord907
ord87
ord3450
ord2107
ord2063
ord283
ord3418
ord481
ord2915
ord1096
ord1097
ord3816
ord3888
ord2589
ord78
ord95
ord3891
ord1145
ord1144
ord1081
ord2292
ord3823
ord3846
ord187
ord3857
ord267
ord3675
ord3737
ord3633
ord3631
ord3664
ord3479
ord1011
ord341
ord1012
ord503
ord359
ord365
ord4684
ord3192
ord3388
ord3528
ord2568
ord3312
ord3922
ord2898
ord264
ord266
ord3313
ord3314
ord4210
ord4701
ord653
ord4692
ord3124
ord3925
ord541
ord2702
ord4372
ord4144
ord4174
ord2400
ord3782
ord193
ord3866
ord3704
ord3758
ord3767
ord3647
ord3766
ord3365
ord4114
ord3460
ord3783
ord3454
ord3754
ord3394
ord897
ord3414
ord3495
ord3610
ord67
ord2578
ord53
ord98
ord3826
ord3559
ord3399
ord636
ord2257
ord914
ord2478
ord626
ord890
ord1004
ord3527
ord4513
ord364
ord1010
ord2051
ord58
ord630
ord628
ord1041
ord1007
ord1005
ord4331
ord1027
ord3437
ord629
ord892
ord74
ord248
ord3378
ord1655
ord575
ord1025
ord246
ord1100
ord4693
ord2135
ord622
ord679
ord2524
ord3505
ord3595
ord1023
ord2451
ord623
ord657
ord401
ord93
ord3396
ord3657
ord908
ord680
ord1016
ord2204
ord3205
ord624
ord4045
ord2475
ord368
ord367
ord370
ord369
ord887
ord889
ord891
ord4320
ord4383
ord315
ord1671
ord1147
ord189
ord314
ord956
ord280
ord2181
ord399
ord748
ord279
ord400
ord751
ord750
ord394
ord774
ord1959
ord37
ord35
ord824
ord822
ord8
ord1091
ord3700
ord3513
ord3623
ord718
ord7
ord716
ord703
ord2426
ord86
ord88
ord3724
ord313
ord1101
ord293
ord3914
ord3807
ord3795
ord4740
ord4731
ord4656
ord4637
ord4615
ord4601
ord2996
ord3155
ord959
ord325
ord329
ord318
ord304
ord292
ord299
ord395
ord955
ord2252
ord91
ord247
ord225
ord129
ord4578
ord4572
ord4576
ord125
ord4570
ord4573
ord4582
ord4575
ord4577
ord4584
ord4580
ord4581
ord3644
ord2929
ord3422
ord170
ord165
ord4119
ord4245
ord4488
ord32
ord1070
ord4233
ord4430
ord866
ord2760
ord4540
ord128
ord203
ord3353
ord3729
ord3480
ord3608
ord3550
ord3575
ord3570
ord3695
ord3178
ord111
ord110
ord151
ord285
ord3239
ord120
ord3883
ord495
ord3896
ord3879
ord109
ord89
ord1202
ord3841
ord3874
ord961
ord2894
ord3067
ord323
ord3844
ord3244
ord2936
ord3245
ord3836
ord464
ord911
ord493
ord3906
ord289
ord2201
ord167
ord52
ord85
ord169
ord168
ord3873
ord222
ord490
ord754
ord2411
ord910
ord2630
ord3109
ord269
ord188
ord181
ord654
ord290
ord281
ord2821
ord641
ord176
ord857
ord2206
ord252
ord903
ord1654
ord1653
ord904
ord901
ord65
ord905

kernel32

CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
HeapSize
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryA
RtlUnwind
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
WriteFile
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
Sleep
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapAlloc
GetVersionExA
GetCommandLineA
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetLastError
GetSystemTime
SystemTimeToFileTime
SetLastError

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_method
DTLS_server_method
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SRP_generate_client_master_secret
SRP_generate_server_master_secret
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_bits
SSL_CIPHER_get_id
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_COMP_add_compression_method
SSL_COMP_free_compression_methods
SSL_COMP_get_compression_methods
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_certificate
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get_cert_store
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_ex_data
SSL_CTX_get_ex_new_index
SSL_CTX_get_info_callback
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set1_param
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_session_id_context
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_tmp_ecdh_callback
SSL_CTX_set_tmp_rsa_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_file
SSL_SESSION_free
SSL_SESSION_get0_peer
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_ex_new_index
SSL_SESSION_get_id
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_set1_id_context
SSL_SESSION_set_ex_data
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_cache_hit
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_connect
SSL_copy_session_id
SSL_ctrl
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_export_keying_material
SSL_extension_supported
SSL_free
SSL_get0_alpn_selected
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get1_session
SSL_get_SSL_CTX
SSL_get_certificate
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_timeout
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_ex_new_index
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_rfd
SSL_get_selected_srtp_profile
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_is_server
SSL_library_init
SSL_load_client_CA_file
SSL_load_error_strings
SSL_new
SSL_peek
SSL_pending
SSL_read
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_alpn_protos
SSL_set_bio
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_debug
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_info_callback
SSL_set_msg_callback
SSL_set_psk_client_callback
SSL_set_psk_server_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_rfd
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_state
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_tmp_ecdh_callback
SSL_set_tmp_rsa_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state
SSL_state_string
SSL_state_string_long
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_version
SSL_want
SSL_write
SSLv23_client_method
SSLv23_method
SSLv23_server_method
SSLv2_client_method
SSLv2_method
SSLv2_server_method
SSLv3_client_method
SSLv3_method
SSLv3_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION
ssl2_ciphers
ssl3_ciphers

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/BatchFiles/uninstall_driver.bat
NetFilter/Be.Windows.Forms.HexBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ptech\Desktop\Code\avast_Elite\Netfilter_Updated\PFNetFilterCS\Be.HexEditor.130\sources\Be.Windows.Forms.HexBox\obj\x86\Debug\Be.Windows.Forms.HexBox.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/ProtocolFilters.dll
.dll windows:4 windows x86 arch:x86

5b32cdbf5c2fc9c01a67a90f9e53f507

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:e3:2d:ff:6f:06:bb:83:50:28:7a:3a:de:6a:2e:90:1b:c1:bd:b1:a8:7e:72:77:57:ea:74:de:29:e1:24:d3
Signer

Actual PE Digest

da:e3:2d:ff:6f:06:bb:83:50:28:7a:3a:de:6a:2e:90:1b:c1:bd:b1:a8:7e:72:77:57:ea:74:de:29:e1:24:d3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
WriteFile
GetFileSize
SetEndOfFile
CreateFileW
GetTempPathW
GetTempFileNameW
OpenProcess
InterlockedIncrement
SetFilePointer
CreateDirectoryW
LoadLibraryA
GetProcAddress
FreeLibrary
ProcessIdToSessionId
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
DeleteFileW
SetEvent
ResetEvent
CreateEventA
LeaveCriticalSection
CreateMutexA
lstrlenA
EnterCriticalSection
ReleaseMutex
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
CloseHandle
WaitForSingleObject
CreateProcessW
InterlockedDecrement
GetLastError
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CreateFileA
GetCurrentProcessId
FlushFileBuffers
LCMapStringW
LCMapStringA
HeapSize
RtlUnwind
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetProcessHeap
SetHandleCount
GetVersionExA
GetCommandLineA
HeapReAlloc
CreateThread
GetCurrentThreadId
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
HeapAlloc
HeapFree
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RaiseException
Sleep

advapi32

OpenProcessToken
LookupAccountSidA
LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

oleaut32

SysAllocString
VariantClear
SysFreeString

crypt32

CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFindCertificateInStore
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
PFXExportCertStoreEx

ssleay32

ord86
ord110
ord116
ord170
ord350
ord82
ord83
ord75
ord112
ord12
ord22
ord48
ord8
ord265
ord155
ord94
ord60
ord61
ord96
ord84
ord284
ord108
ord43
ord78
ord58
ord35
ord166
ord74
ord183
ord28

libeay32

ord1958
ord1654
ord1653
ord664
ord2186
ord283
ord485
ord279
ord673
ord670
ord3024
ord656
ord3171
ord573
ord3106
ord1912
ord672
ord669
ord2291
ord3205
ord2639
ord364
ord2684
ord2746
ord909
ord1299
ord444
ord1318
ord2734
ord1317
ord2672
ord83
ord1308
ord1291
ord109
ord170
ord581
ord653
ord58
ord2442
ord566
ord578
ord579
ord657
ord648
ord129
ord164
ord2239
ord150
ord649
ord541
ord633
ord1177
ord1508
ord333
ord639
ord298
ord254
ord224
ord246
ord851
ord857
ord181
ord281
ord3315
ord197
ord674
ord667
ord658
ord1804
ord188
ord668
ord641
ord66
ord89
ord52
ord421
ord95
ord78
ord754
ord2604

ws2_32

WSAStartup
WSACleanup
htons
ntohs
ntohl
WSAAddressToStringA

Exports

Exports

PFHeaderField_getName
PFHeaderField_getUnfoldedValue
PFHeaderField_getValue
PFHeader_addField
PFHeader_clear
PFHeader_create
PFHeader_findFirstField
PFHeader_free
PFHeader_getField
PFHeader_parse
PFHeader_removeFields
PFHeader_size
PFObject_clear
PFObject_clone
PFObject_create
PFObject_detach
PFObject_free
PFObject_getStream
PFObject_getStreamCount
PFObject_getType
PFObject_isReadOnly
PFObject_setReadOnly
PFObject_setType
PFStream_copyTo
PFStream_read
PFStream_reset
PFStream_seek
PFStream_setEndOfStream
PFStream_size
PFStream_write
pfc_addFilter
pfc_canDisableFiltering
pfc_deleteFilter
pfc_free
pfc_getFilterCount
pfc_getNFEventHandler
pfc_getProcessOwnerA
pfc_getProcessOwnerW
pfc_init
pfc_isFilterActive
pfc_postObject
pfc_readHeader
pfc_setRootSSLCertImportFlags
pfc_setRootSSLCertSubject
pfc_unzipStream
pfc_writeHeader

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/System.Data.SqlServerCe.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:4b:27:35:8c:39:b8:01:76:ac:ce:60:e5:87:3e:98:2d:34:7e:77
Signer

Actual PE Digest

47:4b:27:35:8c:39:b8:01:76:ac:ce:60:e5:87:3e:98:2d:34:7e:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\bt\941\private\code\managed\dev\core\local\provider\win32\central\obj\i386\System.Data.SqlServerCe.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/libeay32.dll
.dll windows:4 windows x86 arch:x86

59055464072385904fb3242fc02b064d

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:02:3f:ee:7f:6c:48:de:cb:8f:5d:99:db:91:a2:74:d7:c9:e6:6b:fe:06:f0:13:b3:92:28:44:01:a4:04:37
Signer

Actual PE Digest

77:02:3f:ee:7f:6c:48:de:cb:8f:5d:99:db:91:a2:74:d7:c9:e6:6b:fe:06:f0:13:b3:92:28:44:01:a4:04:37

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\projects\netfilter3\ProtocolFilters\openssl\out32dll\libeay32.pdb

Imports

ws2_32

sendto
recvfrom
bind
listen
accept
ntohl
ioctlsocket
WSACleanup
WSAStartup
gethostbyname
getsockopt
getservbyname
ntohs
htons
htonl
socket
setsockopt
connect
send
WSASetLastError
recv
WSAGetLastError
shutdown
closesocket

gdi32

DeleteObject
GetDIBits
GetObjectA
CreateCompatibleBitmap
GetDeviceCaps

advapi32

CryptSignHashA
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA
CryptDecrypt
CryptCreateHash
CryptSetHashParam
DeregisterEventSource
CryptDestroyHash
CryptExportKey
CryptGetUserKey

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

user32

GetDC
ReleaseDC
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

kernel32

RtlUnwind
GetFullPathNameA
GetCurrentDirectoryA
SetEndOfFile
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileW
FlushConsoleInputBuffer
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
GetTimeZoneInformation
ExitProcess
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
GetLastError
GetVersion
WriteFile
GetFileType
GetStdHandle
FindNextFileA
FindFirstFileA
FindClose
FreeLibrary
LoadLibraryA
CloseHandle
SetLastError
MultiByteToWideChar
SystemTimeToFileTime
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
WideCharToMultiByte
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
ReadFile
GetConsoleCP
GetConsoleMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetFileAttributesA
GetFileAttributesA
CreateFileA
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
DeleteCriticalSection
GetModuleFileNameA
InitializeCriticalSection
Sleep
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapSize

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_ctr128_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_to_BN
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_to_generalizedtime
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_bn_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_pack_string
ASN1_parse
ASN1_parse_dump
ASN1_primitive_free
ASN1_primitive_new
ASN1_put_eoc
ASN1_put_object
ASN1_seq_pack
ASN1_seq_unpack
ASN1_sign
ASN1_tag2bit
ASN1_tag2str
ASN1_template_d2i
ASN1_template_free
ASN1_template_i2d
ASN1_template_new
ASN1_unpack_string
ASN1_verify
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_accept
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_ex_data
BIO_get_ex_new_index
BIO_get_host_ip
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_mem
BIO_s_null
BIO_s_socket
BIO_set
BIO_set_callback
BIO_set_callback_arg
BIO_set_cipher
BIO_set_ex_data
BIO_set_flags
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_cleanup
BIO_sock_error
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_get_thread_id
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_new
BN_BLINDING_set_flags
BN_BLINDING_set_thread_id
BN_BLINDING_thread_id
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_init
BN_CTX_new
BN_CTX_start
BN_GENCB_call
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_init
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_init
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2dec
BN_bn2hex
BN_bn2mpi
BN_bntest_rand
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_recp
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_prime
BN_generate_prime_ex
BN_get0_nist_prime_192
BN_get0_nist_prime_224
BN_get0_nist_prime_256
BN_get0_nist_prime_384
BN_get0_nist_prime_521
BN_get_params
BN_get_word
BN_hex2bn
BN_init
BN_is_bit_set
BN_is_prime
BN_is_prime_ex
BN_is_prime_fasttest
BN_is_prime_fasttest_ex
BN_kronecker
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_recp
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_mul_reciprocal
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nist_mod_192
BN_nist_mod_224
BN_nist_mod_256
BN_nist_mod_384
BN_nist_mod_521
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_options
BN_print
BN_print_fp
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_reciprocal
BN_rshift
BN_rshift1
BN_set_bit
BN_set_negative
BN_set_params
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_uadd
BN_ucmp
BN_usub
BN_value_one
BUF_MEM_free

Sections

.text
Size: 1000KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nfapi.dll
.dll windows:4 windows x86 arch:x86

bf4f0533d2f227fd7b8cbb862021108e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:a4:7b:9e:9d:2e:3a:44:76:6a:17:c3:e3:34:1d:06:c6:7a:05:ac:46:f6:3a:2a:ec:bf:4b:90:de:9a:87:11
Signer

Actual PE Digest

15:a4:7b:9e:9d:2e:3a:44:76:6a:17:c3:e3:34:1d:06:c6:7a:05:ac:46:f6:3a:2a:ec:bf:4b:90:de:9a:87:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

j:\projects\netfilter3\bin\Release_c_api\Win32\nfapi.pdb

Imports

kernel32

GetModuleHandleA
OpenProcess
GetCurrentProcessId
GetTickCount
GetLogicalDriveStringsW
QueryDosDeviceW
GetProcAddress
WriteFile
GetLastError
CancelIo
GetOverlappedResult
CreateFileA
DeviceIoControl
WaitForMultipleObjects
WaitForSingleObject
CreateEventA
SetEvent
CloseHandle
GetSystemInfo
ResetEvent
ReadFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetDriveTypeW
DeleteCriticalSection
FlushFileBuffers
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

OpenSCManagerA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
DeleteService
OpenServiceA
CloseServiceHandle
StartServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CreateServiceA

psapi

GetModuleFileNameExA
GetModuleFileNameExW

Exports

Exports

nf_addRule
nf_adjustProcessPriviledges
nf_completeTCPConnectRequest
nf_completeUDPConnectRequest
nf_deleteRules
nf_free
nf_getConnCount
nf_getProcessNameA
nf_getProcessNameFromKernel
nf_getProcessNameW
nf_getTCPConnInfo
nf_getUDPConnInfo
nf_init
nf_registerDriver
nf_setOptions
nf_setTCPTimeout
nf_tcpClose
nf_tcpDisableFiltering
nf_tcpIsProxy
nf_tcpPostReceive
nf_tcpPostSend
nf_tcpSetConnectionState
nf_tcpSetSockOpt
nf_udpDisableFiltering
nf_udpPostReceive
nf_udpPostSend
nf_udpSetConnectionState
nf_unRegisterDriver

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nfapinet.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ptech\Desktop\Code\avast_Elite\Netfilter_Updated\nfapinet\obj\x86\Debug\nfapinet.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nfregdrv.exe
.exe windows:4 windows x64 arch:x64

6668d1d2ccfd2a7b444f62c559f6bcd0

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:cd:f3:ad:72:59:19:d6:0b:1c:b9:ad:9f:bb:2d:17:88:63:81:2c:6c:96:56:1e:38:5f:37:62:f7:b8:df:88
Signer

Actual PE Digest

53:cd:f3:ad:72:59:19:d6:0b:1c:b9:ad:9f:bb:2d:17:88:63:81:2c:6c:96:56:1e:38:5f:37:62:f7:b8:df:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

h:\projects\netfilter3\bin\Release_c_api\x64\nfregdrv.pdb

Imports

nfapi

nf_unRegisterDriver
nf_registerDriver

user32

CharNextA
MessageBoxA

kernel32

GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapReAlloc

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetFilter/nss/certutil.exe
.exe windows:4 windows x86 arch:x86

4bfff94eb6c93e4a6872b3beda65ae7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

smime3

CERT_DecodeCertFromPackage

nss3

CERT_AddExtension
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
PORT_ArenaZAlloc
SECOID_FindOIDByTag
PORT_ArenaAlloc
CERT_EncodeBasicConstraintValue
CERT_EncodeAuthKeyID
PORT_ArenaRelease
CERT_DestroyName
CERT_CopyName
PORT_ArenaMark
CERT_EncodeCRLDistributionPoints
PORT_ArenaGrow
CERT_CopyRDN
CERT_DestroyCertificateRequest
CERT_MergeExtensions
CERT_GetCertificateRequestExtensions
SECOID_FindOIDTag
CERT_StartCertExtensions
CERT_VerifySignedDataWithPublicKeyInfo
SEC_ASN1DecodeItem
NSS_Get_CERT_SignedDataTemplate
CERT_DestroyValidity
CERT_CreateCertificate
CERT_CreateValidity
NSS_Get_CERT_CertificateTemplate
SECOID_SetAlgorithmID
PK11_FindKeyByAnyCert
PK11_GenerateKeyPair
PK11_RandomUpdate
SEC_ASN1Decode
ATOB_AsciiToData
PK11_ProtectedAuthenticationPath
PK11_ChangePW
PK11_CheckUserPassword
PK11_InitPin
PK11_NeedUserInit
SECITEM_FreeItem
CERT_StartCertificateRequestAttributes
ATOB_ConvertAsciiToItem
DER_GetInteger
DER_UTCTimeToTime
PK11_GetSlotName
CERT_GetOidString
SECOID_FindOID
CERT_GenTime2FormattedAscii
NSS_Get_SEC_GeneralizedTimeTemplate
CERT_DestroyOidSequence
CERT_DecodeOidSequence
CERT_DecodeBasicConstraintValue
CERT_DecodeAuthKeyID
CERT_GetNextGeneralName
CERT_DecodeAltNameExtension
CERT_DecodeCRLDistributionPoints
CERT_DecodeNameConstraintsExtension
CERT_GetNextNameConstraint
CERT_DecodeAuthInfoAccessExtension
CERT_NameToAscii
SEC_QuickDERDecodeItem
SECKEY_ExtractPublicKey
CERT_Hexify
PK11_HashBuf
SECOID_AddEntry
CERT_DestroyCertificatePoliciesExtension
SECITEM_CopyItem
CERT_DestroyUserNotice
CERT_DecodeUserNotice
CERT_DecodePrivKeyUsagePeriodExtension
PORT_FreeArena
CERT_FinishExtensions
CERT_FinishCertificateRequestAttributes
NSS_Get_CERT_CertificateRequestTemplate
SEC_ASN1EncodeItem
SEC_GetSignatureAlgorithmOidTag
PK11_GetTokenName
PK11_FreeSlotList
PK11_DeleteTokenCertAndKey
PK11_GetPrivateKeyNickname
PK11_ListPrivateKeysInSlot
SECKEY_DestroyPrivateKeyList
PK11_GetAllTokens
DER_AsciiToTime
CERT_VerifyCertificate
PORT_GetError
PORT_SetError
SEC_DeletePermCertificate
CERT_CreateSubjectCertList
BTOA_DataToAscii
PK11_ListCertsInSlot
PK11_ListCerts
CERT_DestroyCertList
PK11_FindCertFromNickname
CERT_CertChainFromCert
CERT_FindCertByDERCert
CERT_DestroyCertificateList
CERT_FindCertByNicknameOrEmailAddr
SECKEY_CreateSubjectPublicKeyInfo
CERT_CreateCertificateRequest
DER_GeneralizedTimeToTime
PORT_NewArena
SEC_DerSignData
BTOA_ConvertItemToAscii
CERT_GetCommonName
CERT_GetCertEmailAddress
CERT_GetOrgName
CERT_GetStateName
CERT_GetCountryName
PORT_ZAlloc
CERT_DecodeTrustString
PK11_IsFriendly
PK11_ImportCert
CERT_ChangeCertTrust
CERT_SaveSMimeProfile
CERT_DestroyCertificate
CERT_AsciiToName
PK11_SetPasswordFunc
NSS_Initialize
CERT_GetDefaultCertDB
CERT_GetDBContentVersion
PK11_GetInternalKeySlot
PK11_FindSlotByName
PK11_ResetToken
PK11_NeedLogin
PK11_Authenticate
PK11_FreeSlot
SECKEY_DestroyPrivateKey
SECKEY_DestroyPublicKey
PORT_Strdup
PORT_Alloc
PORT_Realloc
PORT_Free
NSS_Shutdown
NSS_Get_SEC_ObjectIDTemplate
SECITEM_AllocItem

plc4

PL_CreateOptState
PL_GetNextOpt
PL_strlen
PL_strcmp
PL_strdup

nspr4

PR_GetErrorText
PR_IsNetAddrType
PR_NetAddrToString
PR_snprintf
PR_smprintf
PR_smprintf_free
PR_FormatTime
PR_GetEnv
PR_GetOpenFileInfo
PR_GMTParameters
PR_ExplodeTime
PR_ImplodeTime
PR_Sync
PR_Read
PR_Write
PR_GetSpecialFD
PR_fprintf
PR_Now
PR_Open
PR_GetOSError
PR_GetError
PR_Init
PR_Close
PR_Delete
PR_GetErrorTextLength

msvcrt

_fileno
_getch
_strdup
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
malloc
strstr
_errno
strerror
vfprintf
sprintf
free
getc
scanf
fflush
gets
puts
_iob
fprintf
strrchr
atoi
printf
fopen
fgets
strpbrk
__mb_cur_max
_isctype
_pctype
strchr
fclose
exit
__p__fmode
__set_app_type
_except_handler3
_controlfp
__p__commode

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NetFilter/nss/mozcrt19.dll
.dll windows:4 windows x86 arch:x86

7cea1bcca1ff18e164507fda5b70c620

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

d9:6d:c7:8e:a6:fa:0a:7b:10:3b:1a:05:51:cf:8f:d6:d7:18:c7:39
Signer

Actual PE Digest

d9:6d:c7:8e:a6:fa:0a:7b:10:3b:1a:05:51:cf:8f:d6:d7:18:c7:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\build\intel\MOZCRT19.pdb

Imports

msvcrt

_getdrives

kernel32

GetCurrentProcessId
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
Sleep
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
SetLocalTime
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetLocaleInfoW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
RtlUnwind
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
FlushFileBuffers
CompareStringA
CompareStringW
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
CreateProcessW
VirtualProtect
VirtualQuery
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetEndOfFile
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreatePipe
ReadFile
CreateFileW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
@_calloc_crt@8
@_malloc_crt@4
@_realloc_crt@8
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osplatform
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_invalid_parameter_handler
_get_osfhandle
_get_osplatform
_get_osver
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_winmajor
_get_winminor
_get_winver
_get_wpgmptr
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2

Sections

.text
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/nspr4.dll
.dll windows:4 windows x86 arch:x86

2f18ebeca6261a49374a46ce4247a667

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

83:66:8e:34:d2:cb:0f:40:cd:0b:e1:e4:c6:0c:08:61:4c:d7:08:9b
Signer

Actual PE Digest

83:66:8e:34:d2:cb:0f:40:cd:0b:e1:e4:c6:0c:08:61:4c:d7:08:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\pr\src\nspr4.pdb

Imports

advapi32

AllocateAndInitializeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor

wsock32

recvfrom
sendto
send
recv
connect
accept
select
__WSAFDIsSet
setsockopt
getpeername
getsockname
shutdown
listen
bind
inet_ntoa
closesocket
WSAStartup
WSACleanup
gethostname
getsockopt
WSAGetLastError
ioctlsocket
ntohl
ntohs
htons
getprotobynumber
getprotobyname
gethostbyaddr
gethostbyname
htonl
socket

winmm

timeGetTime

mozcrt19

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_time64
_stat64i32
_access
_mbspbrk
_mbsdec
_mbsinc
_beginthreadex
_exit
_environ
qsort
_stricmp
strpbrk
strftime
_mktime64
_localtime64
strncmp
_errno
strerror
realloc
calloc
malloc
strrchr
strstr
getenv
memset
strchr
isdigit
strtoul
strtol
isspace
tolower
memchr
sprintf
abort
free
fwrite
fflush
fopen
setvbuf
__iob_func
fclose
sscanf
memcpy
atoi
_strdup
isalpha
_putenv

kernel32

ResumeThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
LoadLibraryW
LeaveCriticalSection
UnlockFile
LockFile
RemoveDirectoryA
CreateDirectoryA
MoveFileA
GetHandleInformation
SetHandleInformation
GetFileInformationByHandle
SetLastError
FindFirstFileA
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindNextFileA
FindClose
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
SuspendThread
SetThreadPriority
GetCurrentThread
DuplicateHandle
TlsFree
TlsAlloc
GetThreadContext
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FormatMessageA
CreateFileMappingA
GetVersionExA
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTime
SystemTimeToFileTime
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
Sleep
GetStdHandle
CreatePipe
CreateFileA
CloseHandle
GlobalMemoryStatus
InterlockedExchange
GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryExW
GetModuleHandleA
DebugBreak
EnterCriticalSection
OutputDebugStringA

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_MD_FREE_CV
_PR_MD_NEW_CV
_PR_MD_NOTIFYALL_CV
_PR_MD_NOTIFY_CV
_PR_MD_UNLOCK
_PR_MD_WAIT_CV
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/nss3.dll
.dll windows:4 windows x86 arch:x86

704ea4cc802242fb4a5a244486fbb13f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

softokn3

FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

plc4

PL_strncasecmp
PL_strlen
libVersionPoint
PL_strcasecmp

plds4

PL_FreeArenaPool
PL_FinishArenaPool
PL_ArenaAllocate
PL_InitArenaPool
PL_HashTableLookupConst
PL_ArenaGrow
PL_CompareValues
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_NewHashTable
PL_HashTableDestroy
PL_ArenaRelease
PL_HashString
PL_CompareStrings
PL_HashTableEnumerateEntries

nspr4

PR_VersionCheck
PR_Close
PR_Write
PR_InitializeNetAddr
PR_Connect
PR_EnumerateHostEnt
PR_GetHostByName
PR_StringToNetAddr
PR_SecondsToInterval
PR_NewTCPSocket
PR_Recv
PR_Now
PR_NewLock
PR_IntervalNow
PR_CallOnceWithArg
PR_smprintf
PR_Unlock
PR_DestroyLock
PR_UnloadLibrary
PR_FindSymbol
PR_LoadLibrary
PR_AtomicDecrement
PR_AtomicIncrement
LL_Zero
PR_Sleep
PR_SetErrorText
PR_AtomicSet
PR_htonl
PR_ConvertIPv4AddrToIPv6
LL_MinInt
PR_ExplodeTime
PR_GMTParameters
PR_ImplodeTime
PR_SetError
PR_Calloc
PR_Malloc
PR_Realloc
PR_Free
PR_NewCondVar
PR_DestroyCondVar
PR_WaitCondVar
PR_GetCurrentThread
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_FormatTime
PR_LocalTimeParameters
PR_GetError
PR_GetEnv
PR_CallOnce
PR_FindSymbolAndLibrary
PR_NewThreadPrivateIndex
PR_dtoa
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_smprintf_free
PR_Lock

msvcrt

_putenv
_adjust_fdiv
malloc
_initterm
free
printf
toupper
sprintf
qsort
tolower
strncmp
strncpy
strstr
strchr
memmove
atoi
_isctype
__mb_cur_max
_pctype
_mktemp
strrchr

kernel32

DisableThreadLibraryCalls
SetEnvironmentVariableA

Exports

Exports

ATOB_AsciiToData
ATOB_ConvertAsciiToItem
BTOA_ConvertItemToAscii
BTOA_DataToAscii
CERT_AddCertToListTail
CERT_AddExtension
CERT_AddOCSPAcceptableResponses
CERT_AddOKDomainName
CERT_AddRDN
CERT_AsciiToName
CERT_CRLCacheRefreshIssuer
CERT_CacheCRL
CERT_CertChainFromCert
CERT_CertListFromCert
CERT_CertTimesValid
CERT_ChangeCertTrust
CERT_CheckCertUsage
CERT_CheckCertValidTimes
CERT_CompareName
CERT_CompleteCRLDecodeEntries
CERT_CopyName
CERT_CopyRDN
CERT_CreateAVA
CERT_CreateCertificate
CERT_CreateCertificateRequest
CERT_CreateName
CERT_CreateOCSPCertID
CERT_CreateOCSPRequest
CERT_CreateRDN
CERT_CreateSubjectCertList
CERT_CreateValidity
CERT_DecodeAVAValue
CERT_DecodeAltNameExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeAuthKeyID
CERT_DecodeBasicConstraintValue
CERT_DecodeCRLDistributionPoints
CERT_DecodeCertificatePoliciesExtension
CERT_DecodeDERCrl
CERT_DecodeDERCrlWithFlags
CERT_DecodeGeneralName
CERT_DecodeNameConstraintsExtension
CERT_DecodeOCSPResponse
CERT_DecodeOidSequence
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DecodeTrustString
CERT_DecodeUserNotice
CERT_DerNameToAscii
CERT_DestroyCertArray
CERT_DestroyCertList
CERT_DestroyCertificate
CERT_DestroyCertificateList
CERT_DestroyCertificatePoliciesExtension
CERT_DestroyCertificateRequest
CERT_DestroyName
CERT_DestroyOCSPCertID
CERT_DestroyOCSPRequest
CERT_DestroyOCSPResponse
CERT_DestroyOidSequence
CERT_DestroyUserNotice
CERT_DestroyValidity
CERT_DisableOCSPChecking
CERT_DisableOCSPDefaultResponder
CERT_DupCertList
CERT_DupCertificate
CERT_EnableOCSPChecking
CERT_EnableOCSPDefaultResponder
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeCRLDistributionPoints
CERT_EncodeGeneralName
CERT_EncodeOCSPRequest
CERT_ExtractPublicKey
CERT_FilterCertListByCANames
CERT_FilterCertListByUsage
CERT_FilterCertListForUserCerts
CERT_FindCertByDERCert
CERT_FindCertByIssuerAndSN
CERT_FindCertByName
CERT_FindCertByNickname
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertBySubjectKeyID
CERT_FindCertExtension
CERT_FindCertIssuer
CERT_FindKeyUsageExtension
CERT_FindSMimeProfile
CERT_FindSubjectKeyIDExtension
CERT_FindUserCertByUsage
CERT_FindUserCertsByUsage
CERT_FinishCertificateRequestAttributes
CERT_FinishExtensions
CERT_FormatName
CERT_FreeDistNames
CERT_FreeNicknames
CERT_GenTime2FormattedAscii
CERT_GetAVATag
CERT_GetCertChainFromCert
CERT_GetCertEmailAddress
CERT_GetCertIssuerAndSN
CERT_GetCertNicknames
CERT_GetCertTimes
CERT_GetCertTrust
CERT_GetCertUid
CERT_GetCertificateNames
CERT_GetCertificateRequestExtensions
CERT_GetCommonName
CERT_GetCountryName
CERT_GetDBContentVersion
CERT_GetDefaultCertDB
CERT_GetDomainComponentName
CERT_GetFirstEmailAddress
CERT_GetLocalityName
CERT_GetNextEmailAddress
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
CERT_GetOCSPAuthorityInfoAccessLocation
CERT_GetOCSPResponseStatus
CERT_GetOCSPStatusForCertID
CERT_GetOidString
CERT_GetOrgName
CERT_GetOrgUnitName
CERT_GetPrevGeneralName
CERT_GetPrevNameConstraint
CERT_GetSSLCACerts
CERT_GetSlopTime
CERT_GetStateName
CERT_Hexify
CERT_ImportCAChain
CERT_ImportCAChainTrusted
CERT_ImportCRL
CERT_ImportCerts
CERT_IsCACert
CERT_IsCADERCert
CERT_IsRootDERCert
CERT_IsUserCert
CERT_KeyFromDERCrl
CERT_MakeCANickname
CERT_MergeExtensions
CERT_NameToAscii
CERT_NewCertList
CERT_NicknameStringsFromCertList
CERT_OpenCertDBFilename
CERT_RFC1485_EscapeAndQuote
CERT_RemoveCertListNode
CERT_SaveSMimeProfile
CERT_SetOCSPDefaultResponder
CERT_SetSlopTime
CERT_StartCRLEntryExtensions
CERT_StartCRLExtensions
CERT_StartCertExtensions
CERT_StartCertificateRequestAttributes
CERT_UncacheCRL
CERT_VerifyCACertForUsage
CERT_VerifyCert
CERT_VerifyCertName
CERT_VerifyCertNow
CERT_VerifyCertificate
CERT_VerifyCertificateNow
CERT_VerifyOCSPResponseSignature
CERT_VerifySignedData
CERT_VerifySignedDataWithPublicKey
CERT_VerifySignedDataWithPublicKeyInfo
DER_AsciiToTime
DER_DecodeTimeChoice
DER_Encode
DER_EncodeTimeChoice
DER_GeneralizedTimeToTime
DER_GetInteger
DER_Lengths
DER_TimeToUTCTime
DER_UTCDayToAscii
DER_UTCTimeToAscii
DER_UTCTimeToTime
DSAU_DecodeDerSig
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSig
DSAU_EncodeDerSigWithLen
HASH_Begin
HASH_Clone
HASH_Create
HASH_Destroy
HASH_End
HASH_GetHashObject
HASH_GetHashObjectByOidTag
HASH_GetHashTypeByOidTag
HASH_HashBuf
HASH_ResultLen
HASH_ResultLenByOidTag
HASH_ResultLenContext
HASH_Update
NSSAlgorithmAndParameters_CreateMD5Digest
NSSAlgorithmAndParameters_CreateSHA1Digest
NSSArena_Create
NSSArena_Destroy
NSSBase64Decoder_Create
NSSBase64Decoder_Destroy
NSSBase64Decoder_Update
NSSBase64Encoder_Create
NSSBase64Encoder_Destroy
NSSBase64Encoder_Update
NSSBase64_DecodeBuffer
NSSBase64_EncodeItem
NSSCertificateArray_Destroy
NSSCertificate_BuildChain
NSSCertificate_CreateCryptoContext
NSSCertificate_DeleteStoredObject
NSSCertificate_Destroy
NSSCertificate_Encode
NSSCertificate_Encrypt
NSSCertificate_FindPrivateKey
NSSCertificate_GetModule
NSSCertificate_GetPublicKey
NSSCertificate_GetSlot
NSSCertificate_GetToken
NSSCertificate_GetTrustDomain
NSSCertificate_IsPrivateKeyAvailable
NSSCertificate_Validate
NSSCertificate_ValidateAndDiscoverUsagesAndPolicies
NSSCertificate_ValidateCompletely
NSSCertificate_Verify
NSSCertificate_VerifyRecover
NSSCertificate_WrapSymmetricKey
NSSCryptoContext_BeginDecrypt
NSSCryptoContext_BeginDigest
NSSCryptoContext_BeginEncrypt
NSSCryptoContext_BeginSign
NSSCryptoContext_BeginSignRecover
NSSCryptoContext_BeginVerify
NSSCryptoContext_BeginVerifyRecover
NSSCryptoContext_Clone
NSSCryptoContext_ContinueDecrypt
NSSCryptoContext_ContinueDigest
NSSCryptoContext_ContinueEncrypt
NSSCryptoContext_ContinueSign
NSSCryptoContext_ContinueSignRecover
NSSCryptoContext_ContinueVerify
NSSCryptoContext_ContinueVerifyRecover
NSSCryptoContext_Decrypt
NSSCryptoContext_DeriveSymmetricKey
NSSCryptoContext_Destroy
NSSCryptoContext_Digest
NSSCryptoContext_Encrypt
NSSCryptoContext_FindBestCertificateByEmail
NSSCryptoContext_FindBestCertificateByNameComponents
NSSCryptoContext_FindBestCertificateByNickname
NSSCryptoContext_FindBestCertificateBySubject
NSSCryptoContext_FindBestUserCertificate
NSSCryptoContext_FindBestUserCertificateForEmailSigning
NSSCryptoContext_FindBestUserCertificateForSSLClientAuth
NSSCryptoContext_FindCertificateByEncodedCertificate
NSSCryptoContext_FindCertificateByIssuerAndSerialNumber
NSSCryptoContext_FindCertificateByOCSPHash
NSSCryptoContext_FindCertificatesByEmail
NSSCryptoContext_FindCertificatesByNameComponents
NSSCryptoContext_FindCertificatesByNickname
NSSCryptoContext_FindCertificatesBySubject
NSSCryptoContext_FindSymmetricKeyByAlgorithmAndKeyID
NSSCryptoContext_FindUserCertificates
NSSCryptoContext_FindUserCertificatesForEmailSigning
NSSCryptoContext_FindUserCertificatesForSSLClientAuth
NSSCryptoContext_FinishDecrypt
NSSCryptoContext_FinishDigest
NSSCryptoContext_FinishEncrypt
NSSCryptoContext_FinishSign
NSSCryptoContext_FinishSignRecover
NSSCryptoContext_FinishVerify
NSSCryptoContext_FinishVerifyRecover
NSSCryptoContext_GenerateKeyPair
NSSCryptoContext_GenerateSymmetricKey
NSSCryptoContext_GenerateSymmetricKeyFromPassword
NSSCryptoContext_GetDefaultCallback
NSSCryptoContext_GetTrustDomain
NSSCryptoContext_ImportCertificate
NSSCryptoContext_ImportEncodedCertificate
NSSCryptoContext_ImportEncodedPKIXCertificateChain
NSSCryptoContext_ImportPKIXCertificate
NSSCryptoContext_SetDefaultCallback
NSSCryptoContext_Sign
NSSCryptoContext_SignRecover
NSSCryptoContext_UnwrapSymmetricKey
NSSCryptoContext_Verify
NSSCryptoContext_VerifyRecover
NSSCryptoContext_WrapSymmetricKey
NSSPrivateKey_CreateCryptoContext
NSSPrivateKey_Decrypt
NSSPrivateKey_DeleteStoredObject
NSSPrivateKey_DeriveSymmetricKey
NSSPrivateKey_Destroy
NSSPrivateKey_Encode
NSSPrivateKey_FindBestCertificate
NSSPrivateKey_FindCertificates
NSSPrivateKey_FindPublicKey
NSSPrivateKey_GetModule
NSSPrivateKey_GetPrivateModulusLength
NSSPrivateKey_GetSignatureLength
NSSPrivateKey_GetSlot
NSSPrivateKey_GetToken
NSSPrivateKey_GetTrustDomain
NSSPrivateKey_IsStillPresent
NSSPrivateKey_Sign
NSSPrivateKey_SignRecover
NSSPrivateKey_UnwrapSymmetricKey
NSSPublicKey_CreateCryptoContext
NSSPublicKey_DeleteStoredObject
NSSPublicKey_Destroy
NSSPublicKey_Encode
NSSPublicKey_Encrypt
NSSPublicKey_FindBestCertificate
NSSPublicKey_FindCertificates
NSSPublicKey_FindPrivateKey
NSSPublicKey_GetModule
NSSPublicKey_GetSlot
NSSPublicKey_GetToken
NSSPublicKey_GetTrustDomain
NSSPublicKey_Verify
NSSPublicKey_VerifyRecover
NSSPublicKey_WrapSymmetricKey
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
NSSSlotArray_Destroy
NSSSlot_Destroy
NSSSymmetricKey_CreateCryptoContext
NSSSymmetricKey_Decrypt
NSSSymmetricKey_DeleteStoredObject
NSSSymmetricKey_DeriveSymmetricKey
NSSSymmetricKey_Destroy
NSSSymmetricKey_Encrypt
NSSSymmetricKey_GetKeyLength
NSSSymmetricKey_GetKeyStrength
NSSSymmetricKey_GetModule
NSSSymmetricKey_GetSlot
NSSSymmetricKey_GetToken
NSSSymmetricKey_GetTrustDomain
NSSSymmetricKey_IsStillPresent
NSSSymmetricKey_Sign
NSSSymmetricKey_SignRecover
NSSSymmetricKey_UnwrapPrivateKey
NSSSymmetricKey_UnwrapSymmetricKey
NSSSymmetricKey_Verify
NSSSymmetricKey_VerifyRecover
NSSSymmetricKey_WrapPrivateKey
NSSSymmetricKey_WrapSymmetricKey
NSSTime_GetPRTime
NSSTime_Now
NSSTime_SetPRTime
NSSTokenArray_Destroy
NSSToken_Destroy
NSSToken_GetName
NSSTrustDomain_Create
NSSTrustDomain_CreateCryptoContext
NSSTrustDomain_CreateCryptoContextForAlgorithm
NSSTrustDomain_CreateCryptoContextForAlgorithmAndParameters
NSSTrustDomain_Destroy
NSSTrustDomain_DisableToken
NSSTrustDomain_EnableToken
NSSTrustDomain_FindBestCertificateByEmail
NSSTrustDomain_FindBestCertificateByNameComponents
NSSTrustDomain_FindBestCertificateByNickname
NSSTrustDomain_FindBestCertificateBySubject
NSSTrustDomain_FindBestTokenForAlgorithms
NSSTrustDomain_FindBestUserCertificate
NSSTrustDomain_FindBestUserCertificateForEmailSigning
NSSTrustDomain_FindBestUserCertificateForSSLClientAuth
NSSTrustDomain_FindCertificateByEncodedCertificate
NSSTrustDomain_FindCertificateByIssuerAndSerialNumber
NSSTrustDomain_FindCertificateByOCSPHash
NSSTrustDomain_FindCertificatesByEmail
NSSTrustDomain_FindCertificatesByNameComponents
NSSTrustDomain_FindCertificatesByNickname
NSSTrustDomain_FindCertificatesBySubject
NSSTrustDomain_FindSlotByName
NSSTrustDomain_FindSymmetricKeyByAlgorithmAndKeyID
NSSTrustDomain_FindTokenByName
NSSTrustDomain_FindTokenBySlotName
NSSTrustDomain_FindTokenForAlgorithm
NSSTrustDomain_FindUserCertificates
NSSTrustDomain_FindUserCertificatesForEmailSigning
NSSTrustDomain_FindUserCertificatesForSSLClientAuth
NSSTrustDomain_GenerateKeyPair
NSSTrustDomain_GenerateSymmetricKey
NSSTrustDomain_GenerateSymmetricKeyFromPassword
NSSTrustDomain_GetDefaultCallback
NSSTrustDomain_ImportCertificate
NSSTrustDomain_ImportEncodedCertificate
NSSTrustDomain_ImportEncodedCertificateChain
NSSTrustDomain_ImportEncodedPrivateKey
NSSTrustDomain_ImportEncodedPublicKey
NSSTrustDomain_ImportPKIXCertificate
NSSTrustDomain_IsTokenEnabled
NSSTrustDomain_LoadModule
NSSTrustDomain_Login
NSSTrustDomain_Logout
NSSTrustDomain_SetDefaultCallback
NSSTrustDomain_TraverseCertificates
NSSUserCertificate_Decrypt
NSSUserCertificate_DeriveSymmetricKey
NSSUserCertificate_IsStillPresent
NSSUserCertificate_Sign
NSSUserCertificate_SignRecover
NSSUserCertificate_UnwrapSymmetricKey
NSS_GetError
NSS_GetErrorStack
NSS_Get_CERT_CertificateRequestTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CrlTemplate
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_NameTemplate
NSS_Get_CERT_SequenceOfCertExtensionTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_CERT_SignedCrlTemplate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SECKEY_DSAPublicKeyTemplate
NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_AnyTemplate
NSS_Get_SEC_BMPStringTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_BooleanTemplate
NSS_Get_SEC_GeneralizedTimeTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_IntegerTemplate
NSS_Get_SEC_NullTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToAnyTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
NSS_Get_SEC_SignedCertificateTemplate
NSS_Get_SEC_UTCTimeTemplate
NSS_Get_SEC_UTF8StringTemplate
NSS_Get_sgn_DigestInfoTemplate
NSS_Init
NSS_InitReadWrite
NSS_Initialize
NSS_IsInitialized
NSS_NoDB_Init
NSS_PutEnv
NSS_Shutdown
NSS_VersionCheck
PBE_CreateContext
PBE_DestroyContext
PBE_GenerateBits
PK11SDR_Decrypt
PK11SDR_Encrypt
PK11_AlgtagToMechanism
PK11_Authenticate
PK11_BlockData
PK11_ChangePW
PK11_CheckSSOPassword
PK11_CheckUserPassword
PK11_CipherOp
PK11_CloneContext
PK11_ConfigurePKCS11
PK11_ConvertSessionPrivKeyToTokenPrivKey
PK11_ConvertSessionSymKeyToTokenSymKey
PK11_CopySymKeyForSigning
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_CreatePBEAlgorithmID
PK11_CreatePBEParams
PK11_DEREncodePublicKey
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DeleteTokenPublicKey
PK11_DeleteTokenSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_DeriveWithFlagsPerm
PK11_DestroyContext
PK11_DestroyGenericObject
PK11_DestroyGenericObjects
PK11_DestroyObject
PK11_DestroyPBEParams
PK11_DestroyTokenObject
PK11_DigestBegin
PK11_DigestFinal
PK11_DigestKey
PK11_DigestOp
PK11_DoesMechanism
PK11_ExportEncryptedPrivKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportPrivateKeyInfo
PK11_ExtractKeyValue
PK11_Finalize
PK11_FindBestKEAMatch
PK11_FindCertAndKeyByRecipientList
PK11_FindCertAndKeyByRecipientListNew

Sections

.text
Size: 256KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/plc4.dll
.dll windows:4 windows x86 arch:x86

117580383d9705e2154f4772a3d7b5cb

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

cc:70:80:81:64:7c:aa:20:f6:e7:7c:79:78:8d:b5:cc:58:67:d6:7a
Signer

Actual PE Digest

cc:70:80:81:64:7c:aa:20:f6:e7:7c:79:78:8d:b5:cc:58:67:d6:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\lib\libc\src\plc4.pdb

Imports

nspr4

PR_SetError
PR_Calloc
PR_GetSpecialFD
PR_GetError
PR_GetOSError
PR_ErrorToName
PR_fprintf
PR_Free
PR_Malloc

mozcrt19

strrchr
strpbrk
strstr
_encode_pointer
_malloc_crt
strchr
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
strncmp
free
memcpy
malloc
_encoded_null

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/plds4.dll
.dll windows:4 windows x86 arch:x86

b39362cc8da8c2533578c138bce5d210

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

ff:5e:b7:34:6c:7a:5f:eb:d7:1b:94:2c:62:fd:b8:88:c0:01:4d:5d
Signer

Actual PE Digest

ff:5e:b7:34:6c:7a:5f:eb:d7:1b:94:2c:62:fd:b8:88:c0:01:4d:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\lib\ds\plds4.pdb

Imports

nspr4

PR_DestroyLock
PR_Free
PR_Malloc
PR_CeilingLog2
PR_Unlock
PR_CallOnce
PR_Lock
PR_NewLock

mozcrt19

_decode_pointer
_initterm
_encoded_null
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
free
_malloc_crt
_encode_pointer
memset
memcpy
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
libVersionPoint

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/smime3.dll
.dll windows:4 windows x86 arch:x86

63f1666a383df6c6d3edc57a30e32345

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

SECITEM_ArenaDupItem
SECITEM_CopyItem
SECOID_FindOIDByTag
PORT_ArenaMark
PORT_SetError
SECOID_FindOID
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_AnyTemplate
SEC_ASN1EncodeItem
PK11_FreeSymKey
SECITEM_AllocItem
SECOID_GetAlgorithmTag
SECOID_SetAlgorithmID
SECOID_CopyAlgorithmID
PK11_GetKeyStrength
PK11_ReferenceSymKey
PK11_DestroyContext
PK11_CipherOp
PORT_Free
PK11_CreateContextBySymKey
PK11_FreeSlot
PK11_IsHW
PK11_GetSlotFromKey
PK11_GetBlockSize
SECITEM_FreeItem
PORT_ZAlloc
SECITEM_ZfreeItem
PK11_MapPBEMechanismToCryptoMechanism
PK11_ParamFromAlgid
PK11_AlgtagToMechanism
SEC_PKCS5IsAlgorithmPBEAlg
PK11_ParamToAlgid
PK11_GenerateNewParam
SEC_ASN1DecoderSetNotifyProc
SEC_ASN1DecoderStart
PORT_GetError
SEC_ASN1DecoderClearFilterProc
SEC_ASN1DecoderSetFilterProc
SEC_ASN1DecoderFinish
PORT_Alloc
SEC_ASN1DecoderUpdate
SEC_ASN1EncodeInteger
PORT_FreeArena
PORT_NewArena
SECOID_DestroyAlgorithmID
PK11_CreatePBEAlgorithmID
SEC_ASN1EncoderUpdate
SEC_ASN1EncoderSetNotifyProc
SEC_ASN1EncoderSetStreaming
SEC_ASN1EncoderStart
SEC_ASN1EncoderSetTakeFromBuf
SEC_ASN1EncoderClearNotifyProc
SEC_ASN1EncoderFinish
SEC_ASN1EncoderClearStreaming
SEC_ASN1EncoderClearTakeFromBuf
PK11_KeyGen
PK11_GetBestSlot
PK11_FindCertAndKeyByRecipientListNew
PK11_SetPasswordFunc
SECKEY_DestroyPublicKey
CERT_ExtractPublicKey
PK11_PubWrapSymKey
SECKEY_PublicKeyStrength
SECKEY_GetPublicKeyType
PK11_PubUnwrapSymKey
PK11_GetKeyLength
PK11_WrapSymKey
SECKEY_DestroyPrivateKey
PK11_PubDerive
PK11_FindKeyByAnyCert
CERT_DestroyCertificate
PK11_FindBestKEAMatch
NSS_Get_SEC_IntegerTemplate
PK11_UnwrapSymKey
PK11_MakeKEAPubKey
SEC_ASN1DecodeItem
SECKEY_DestroySubjectPublicKeyInfo
SECKEY_CopyPublicKey
CERT_GetCertIssuerAndSN
CERT_DupCertificate
SECKEY_CreateSubjectPublicKeyInfo
SEC_QuickDERDecodeItem
CERT_FindSubjectKeyIDExtension
SEC_ASN1DecodeInteger
PK11_FindPrivateKeyFromCert
SECKEY_CopyPrivateKey
CERT_DestroyCertificateList
CERT_DestroyCertList
CERT_DestroyCertArray
NSS_Get_SEC_PointerToAnyTemplate
PORT_ArenaRelease
CERT_FilterCertListByUsage
CERT_AddCertToListTail
CERT_NewCertList
CERT_ImportCerts
CERT_FindCertByDERCert
SGN_Digest
SEC_SignData
PK11_FortezzaMapSig
VFY_VerifyDigest
VFY_VerifyData
DER_DecodeTimeChoice
CERT_FindCertByIssuerAndSN
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
PORT_Strdup
DER_EncodeTimeChoice
PK11_FortezzaHasKEA
CERT_SaveSMimeProfile
CERT_GetDefaultCertDB
CERT_CertListFromCert
SECOID_CompareAlgorithmID
SECITEM_ItemsAreEqual
HASH_GetHashObjectByOidTag
SECOID_FindOIDTag
CERT_FindSMimeProfile
NSS_VersionCheck
NSS_Get_sgn_DigestInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
PK11_DigestFinal
PK11_DigestOp
PK11_DigestBegin
SGN_CreateDigestInfo
PORT_UCS2_ASCIIConversion
SGN_DestroyDigestInfo
SECITEM_CompareItem
PORT_Realloc
PORT_UCS2_UTF8Conversion
SGN_CopyDigestInfo
DER_GetInteger
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SEC_BMPStringTemplate
PK11_GetInternalSlot
PK11_ReferenceSlot
PK11_PBEKeyGen
PK11_GetInternalKeySlot
PORT_ArenaStrdup
PK11_IsInternal
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
PK11_ExportPrivateKeyInfo
__CERT_NewTempCertificate
PK11_DestroyPBEParams
PK11_CreatePBEParams
SECITEM_DupItem
SEC_ASN1DecoderClearNotifyProc
PORT_ZFree
__CERT_DecodeDERCertificate
PK11_GetTokenName
PK11_TraverseCertsForSubjectInSlot
PK11_TraverseCertsForNicknameInSlot
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_ImportCertForKeyToSlot
CERT_IsRootDERCert
CERT_IsCADERCert
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
ATOB_ConvertAsciiToItem
ATOB_AsciiToData
PK11_RawPBEKeyGen
PK11_FindCertAndKeyByRecipientList
SEC_ASN1DecoderAbort
HASH_ResultLen
HASH_GetHashTypeByOidTag
SEC_ASN1EncoderAbort
SEC_ASN1Encode
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
CERT_VerifyCert
PORT_ArenaUnmark
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
PORT_ArenaAlloc
PORT_ArenaGrow
CERT_CertChainFromCert
PORT_ArenaZAlloc

plc4

PL_strncasecmp

nspr4

PR_Now

msvcrt

malloc
_initterm
memmove
strchr
free
_adjust_fdiv

kernel32

DisableThreadLibraryCalls

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSUtil_VerificationStatusToString
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifySignature

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/nss/softokn3.dll
.dll windows:4 windows x86 arch:x86

c8d7acb564d2040c70f541793dbd89e0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

plc4

PL_strncasecmp
libVersionPoint
PL_strcasecmp

plds4

PL_ArenaAllocate
PL_InitArenaPool
PL_HashTableLookup
PL_HashTableRemove
PL_FinishArenaPool
PL_HashTableDestroy
PL_HashTableAdd
PL_CompareValues
PL_NewHashTable
PL_HashTableLookupConst
PL_FreeArenaPool
PL_ArenaGrow
PL_ArenaRelease
PL_HashTableEnumerateEntries

nspr4

PR_GetLibraryFilePathname
PR_Malloc
PR_Realloc
PR_Calloc
PR_GetEnv
PR_Sleep
PR_NewCondVar
PR_DestroyCondVar
PR_WaitCondVar
PR_GetCurrentThread
PR_NotifyCondVar
PR_NotifyAllCondVar
PR_ImplodeTime
PR_Seek
PR_CallOnce
PR_ntohl
PR_AtomicDecrement
PR_AtomicIncrement
PR_NewLock
PR_htonl
PR_NewMonitor
PR_DestroyMonitor
PR_ExitMonitor
PR_EnterMonitor
PR_Now
PR_Lock
PR_Unlock
PR_DestroyLock
PR_Access
PR_MkDir
PR_Write
PR_Delete
PR_Read
PR_OpenFile
PR_CreateFileMap
PR_GetError
PR_MemMap
PR_Close
PR_SetError
PR_MemUnmap
PR_CloseFileMap
PR_LoadLibrary
PR_FindSymbol
PR_UnloadLibrary
PR_smprintf
PR_Free
PR_smprintf_free
PR_Open

msvcrt

_read
_open
_strdup
_unlink
_close
_lseek
_write
_stat
_adjust_fdiv
_initterm
getenv
memmove
_get_osfhandle
malloc
_errno
abort
rand
free
calloc
fopen
fread
fclose
_findfirst
_findnext
_findclose
time
sprintf
strncpy
__mb_cur_max
_isctype
_pctype
atoi
tolower
strncmp
_getpid

kernel32

GetVolumeInformationA
QueryPerformanceCounter
GetDiskFreeSpaceA
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetLogicalDrives
GlobalMemoryStatus
GetSystemDirectoryA
DisableThreadLibraryCalls
FlushFileBuffers
GetTickCount

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
dbopen
mktemp
nssRWLock_AtomicCreate
sec_port_ucs2_utf8_conversion_function
sec_port_ucs4_utf8_conversion_function

Sections

.text
Size: 268KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/pfapinet.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ptech\Desktop\Code\avast_Elite\Netfilter_Updated\pfapinet\obj\x86\Debug\pfapinet.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NetFilter/ssleay32.dll
.dll windows:4 windows x86 arch:x86

bd8a3f8d32f6d60b7b11b687d7804002

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:b8:9f:76:a8:e6:1d:a7:38:b8:0f:6b:af:80:ef:44
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/05/2016, 00:00

Not After

26/07/2018, 12:00

Subject

CN=Praetorian Technologies\, LLC,O=Praetorian Technologies\, LLC,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:0a:13:ba:25:cc:4b:ab:f8:72:5a:c4:38:ec:dc:42:ba:7b:6f:bf:eb:5e:04:5a:7c:8b:3c:dd:ce:7c:45:10
Signer

Actual PE Digest

a4:0a:13:ba:25:cc:4b:ab:f8:72:5a:c4:38:ec:dc:42:ba:7b:6f:bf:eb:5e:04:5a:7c:8b:3c:dd:ce:7c:45:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\projects\netfilter3\ProtocolFilters\openssl\out32dll\ssleay32.pdb

Imports

libeay32

ord3010
ord2924
ord3459
ord3512
ord3663
ord202
ord123
ord201
ord118
ord2128
ord967
ord66
ord4369
ord4474
ord3666
ord219
ord498
ord635
ord912
ord909
ord2784
ord965
ord964
ord256
ord274
ord276
ord3899
ord2572
ord3315
ord2927
ord2747
ord3837
ord282
ord572
ord3165
ord3489
ord1071
ord2925
ord268
ord316
ord363
ord2712
ord4164
ord4262
ord3719
ord216
ord333
ord4125
ord4470
ord206
ord497
ord4046
ord3682
ord2877
ord3711
ord205
ord486
ord484
ord763
ord577
ord907
ord87
ord3450
ord2107
ord2063
ord283
ord3418
ord481
ord2915
ord1096
ord1097
ord3816
ord3888
ord2589
ord78
ord95
ord3891
ord1145
ord1144
ord1081
ord2292
ord3823
ord3846
ord187
ord3857
ord267
ord3675
ord3737
ord3633
ord3631
ord3664
ord3479
ord1011
ord341
ord1012
ord503
ord359
ord365
ord4684
ord3192
ord3388
ord3528
ord2568
ord3312
ord3922
ord2898
ord264
ord266
ord3313
ord3314
ord4210
ord4701
ord653
ord4692
ord3124
ord3925
ord541
ord2702
ord4372
ord4144
ord4174
ord2400
ord3782
ord193
ord3866
ord3704
ord3758
ord3767
ord3647
ord3766
ord3365
ord4114
ord3460
ord3783
ord3454
ord3754
ord3394
ord897
ord3414
ord3495
ord3610
ord67
ord2578
ord53
ord98
ord3826
ord3559
ord3399
ord636
ord2257
ord914
ord2478
ord626
ord890
ord1004
ord3527
ord4513
ord364
ord1010
ord2051
ord58
ord630
ord628
ord1041
ord1007
ord1005
ord4331
ord1027
ord3437
ord629
ord892
ord74
ord248
ord3378
ord1655
ord575
ord1025
ord246
ord1100
ord4693
ord2135
ord622
ord679
ord2524
ord3505
ord3595
ord1023
ord2451
ord623
ord657
ord401
ord93
ord3396
ord3657
ord908
ord680
ord1016
ord2204
ord3205
ord624
ord4045
ord2475
ord368
ord367
ord370
ord369
ord887
ord889
ord891
ord4320
ord4383
ord315
ord1671
ord1147
ord189
ord314
ord956
ord280
ord2181
ord399
ord748
ord279
ord400
ord751
ord750
ord394
ord774
ord1959
ord37
ord35
ord824
ord822
ord8
ord1091
ord3700
ord3513
ord3623
ord718
ord7
ord716
ord703
ord2426
ord86
ord88
ord3724
ord313
ord1101
ord293
ord3914
ord3807
ord3795
ord4740
ord4731
ord4656
ord4637
ord4615
ord4601
ord2996
ord3155
ord959
ord325
ord329
ord318
ord304
ord292
ord299
ord395
ord955
ord2252
ord91
ord247
ord225
ord129
ord4578
ord4572
ord4576
ord125
ord4570
ord4573
ord4582
ord4575
ord4577
ord4584
ord4580
ord4581
ord3644
ord2929
ord3422
ord170
ord165
ord4119
ord4245
ord4488
ord32
ord1070
ord4233
ord4430
ord866
ord2760
ord4540
ord128
ord203
ord3353
ord3729
ord3480
ord3608
ord3550
ord3575
ord3570
ord3695
ord3178
ord111
ord110
ord151
ord285
ord3239
ord120
ord3883
ord495
ord3896
ord3879
ord109
ord89
ord1202
ord3841
ord3874
ord961
ord2894
ord3067
ord323
ord3844
ord3244
ord2936
ord3245
ord3836
ord464
ord911
ord493
ord3906
ord289
ord2201
ord167
ord52
ord85
ord169
ord168
ord3873
ord222
ord490
ord754
ord2411
ord910
ord2630
ord3109
ord269
ord188
ord181
ord654
ord290
ord281
ord2821
ord641
ord176
ord857
ord2206
ord252
ord903
ord1654
ord1653
ord904
ord901
ord65
ord905

kernel32

CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
HeapSize
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryA
RtlUnwind
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
WriteFile
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
Sleep
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapAlloc
GetVersionExA
GetCommandLineA
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetLastError
GetSystemTime
SystemTimeToFileTime
SetLastError

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_method
DTLS_server_method
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SRP_generate_client_master_secret
SRP_generate_server_master_secret
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_bits
SSL_CIPHER_get_id
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_COMP_add_compression_method
SSL_COMP_free_compression_methods
SSL_COMP_get_compression_methods
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_certificate
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get_cert_store
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_ex_data
SSL_CTX_get_ex_new_index
SSL_CTX_get_info_callback
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set1_param
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_session_id_context
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_tmp_ecdh_callback
SSL_CTX_set_tmp_rsa_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_file
SSL_SESSION_free
SSL_SESSION_get0_peer
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_ex_new_index
SSL_SESSION_get_id
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_set1_id_context
SSL_SESSION_set_ex_data
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_cache_hit
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_connect
SSL_copy_session_id
SSL_ctrl
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_export_keying_material
SSL_extension_supported
SSL_free
SSL_get0_alpn_selected
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get1_session
SSL_get_SSL_CTX
SSL_get_certificate
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_timeout
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_ex_new_index
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_rfd
SSL_get_selected_srtp_profile
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_is_server
SSL_library_init
SSL_load_client_CA_file
SSL_load_error_strings
SSL_new
SSL_peek
SSL_pending
SSL_read
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_alpn_protos
SSL_set_bio
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_debug
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_info_callback
SSL_set_msg_callback
SSL_set_psk_client_callback
SSL_set_psk_server_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_rfd
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_state
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_tmp_ecdh_callback
SSL_set_tmp_rsa_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state
SSL_state_string
SSL_state_string_long
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_version
SSL_want
SSL_write
SSLv23_client_method
SSLv23_method
SSLv23_server_method
SSLv2_client_method
SSLv2_method
SSLv2_server_method
SSLv3_client_method
SSLv3_method
SSLv3_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION
ssl2_ciphers
ssl3_ciphers

Sections

.text
Size: 260KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PresentationCore.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

82:c5:d3:3d:45:b6:a9:01:ae:41:0b:d7:5b:e6:d1:d4:c4:87:36:8e
Signer

Actual PE Digest

82:c5:d3:3d:45:b6:a9:01:ae:41:0b:d7:5b:e6:d1:d4:c4:87:36:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PresentationFramework.Aero.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

fe:38:30:d0:db:46:5d:5b:cf:44:0d:e2:a1:2d:aa:f5:34:b5:12:b7
Signer

Actual PE Digest

fe:38:30:d0:db:46:5d:5b:cf:44:0d:e2:a1:2d:aa:f5:34:b5:12:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PresentationFramework.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

29:f9:fd:8e:9a:00:9f:ef:ee:aa:49:b6:a4:11:c1:63:08:2a:3a:6f
Signer

Actual PE Digest

29:f9:fd:8e:9a:00:9f:ef:ee:aa:49:b6:a4:11:c1:63:08:2a:3a:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Resources/Fonts/Artifika-Regular.ttf
Resources/Fonts/Bazaronite.ttf
Resources/Fonts/CHANTICL.ttf
Resources/Fonts/COMMI___.ttf
Resources/Fonts/CONFN___.TTF
Resources/Fonts/Cardo104s.ttf
Resources/Fonts/Ciao.ttf
Resources/Fonts/ComicRelief.ttf
Resources/Fonts/Courgette-Regular.ttf
Resources/Fonts/Coval.ttf
Resources/Fonts/CrimsonText-Bold.ttf
Resources/Fonts/DEVROYE_.ttf
Resources/Fonts/Dubiel.ttf
Resources/Fonts/Dustismo_Roman.ttf
Resources/Fonts/FreeMono.ttf
Resources/Fonts/FreeSans.ttf
Resources/Fonts/FreeSerif.ttf
Resources/Fonts/GOODDP__.TTF
Resources/Fonts/HOMOARAK.TTF
Resources/Fonts/Halo3.ttf
Resources/Fonts/Harting_plain.ttf
Resources/Fonts/MANIFESTO.ttf
Resources/Fonts/Mael.ttf
Resources/Fonts/Nervous.ttf
Resources/Fonts/Nobile-Regular.ttf
Resources/Fonts/OpenSans-Bold.ttf
Resources/Fonts/Quikhand.ttf
Resources/Fonts/REBECCA_.TTF
Resources/Fonts/Sanctuary.ttf
Resources/Fonts/TheGodfather-v2.ttf
Resources/Fonts/TheanoModern-Regular.ttf
Resources/Fonts/blzee.ttf
Resources/Fonts/contra.ttf
Resources/Fonts/fbsbltc.ttf
Resources/Fonts/garto16.ttf
Resources/Fonts/helsinki.ttf
Resources/Fonts/newscycle-regular.ttf
System.Data.SQLite.EF6.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\dev\sqlite\dotnet\obj\2010\System.Data.SQLite.EF6.2010\Release\System.Data.SQLite.EF6.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Data.SQLite.Linq.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\dev\sqlite\dotnet\obj\2010\System.Data.SQLite.Linq.2010\Release\System.Data.SQLite.Linq.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Data.SQLite.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\dev\sqlite\dotnet\obj\2010\System.Data.SQLite.2010\Release\System.Data.SQLite.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Data.SQLite.xml
.js .xml polyglot
System.Data.SqlServerCe.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:e2:1e:82:8b:6e:a4:52:14:eb:57:67:a9:ad:64:df:e5:9e:b1:ca
Signer

Actual PE Digest

2d:e2:1e:82:8b:6e:a4:52:14:eb:57:67:a9:ad:64:df:e5:9e:b1:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\bt\2730\private\code\managed\dev\core\local\provider\win32\central\obj\i386\System.Data.SqlServerCe.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Windows.Controls.Input.Toolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

91:5f:cb:56:3f:c1:94:93:e3:68:28:08:50:22:df:13:4c:fb:40:ac
Signer

Actual PE Digest

91:5f:cb:56:3f:c1:94:93:e3:68:28:08:50:22:df:13:4c:fb:40:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\Input\obj\Release\System.Windows.Controls.Input.Toolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Windows.Controls.Layout.Toolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

49:51:92:99:bc:93:94:61:a7:21:e8:f0:92:23:14:f5:56:aa:29:79
Signer

Actual PE Digest

49:51:92:99:bc:93:94:61:a7:21:e8:f0:92:23:14:f5:56:aa:29:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\Layout\obj\Release\System.Windows.Controls.Layout.Toolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Windows.Interactivity.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UninstallExtension.UI.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/12/2017, 00:00

Not After

09/12/2020, 12:00

Subject

CN=Avast Software s.r.o.,OU=Release Engineering 301,O=Avast Software s.r.o.,L=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:cd:ad:00:99:39:fb:3c:3b:dd:0d:09:1b:dc:1d:6c:73:26:f4:a5:cf:c8:3f:90:49:d7:92:83:7d:4e:72:3a
Signer

Actual PE Digest

31:cd:ad:00:99:39:fb:3c:3b:dd:0d:09:1b:dc:1d:6c:73:26:f4:a5:cf:c8:3f:90:49:d7:92:83:7d:4e:72:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\raf\Desktop\Code\avast_Elite\Uninstall Extension\UninstallExtensions\UninstallExtension.UI\obj\Debug\UninstallExtension.UI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Updshl10.exe
.exe windows:4 windows x86 arch:x86

001d28e03eaba9e3f4901a419ca62c7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AddAccessAllowedAce
AddAce
CloseServiceHandle
EqualSid
GetAce
GetAclInformation
GetFileSecurityA
GetLengthSid
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetUserNameA
InitializeAcl
InitializeSecurityDescriptor
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetSecurityDescriptorDacl

kernel32

CloseHandle
CompareStringA
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetComputerNameA
GetCurrentDirectoryA
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetEnvironmentStrings
GetEnvironmentVariableA
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeW
GetSystemDefaultLangID
GetSystemInfo
GetTempPathA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalGetAtomNameA
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LockResource
MoveFileExA
MulDiv
MultiByteToWideChar
OpenEventA
OpenFile
RaiseException
ReadFile
RemoveDirectoryA
ResetEvent
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
SizeofResource
Sleep
SleepEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

WSAAsyncGetHostByName
WSAAsyncSelect
WSACleanup
WSAGetLastError
WSAStartup
accept
closesocket
connect
getsockname
htons
ioctlsocket
inet_addr
listen
recv
send
setsockopt
socket
bind

comctl32

ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_Write
ord17

gdi32

BitBlt
CombineRgn
CopyEnhMetaFileA
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreatePalette
CreatePenIndirect
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
EnumFontFamiliesExA
ExcludeClipRect
ExtTextOutA
GdiFlush
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetObjectA
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32A
GetTextExtentPointA
GetTextMetricsA
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
PlayEnhMetaFile
Polyline
RealizePalette
RectVisible
Rectangle
RestoreDC
RoundRect
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetEnhMetaFileBits
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWinMetaFileBits
SetWindowOrgEx
StretchBlt
UnrealizeObject

shell32

ShellExecuteA
Shell_NotifyIconA

user32

ActivateKeyboardLayout
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharLowerBuffA
CharNextA
CharUpperBuffA
CheckMenuItem
ChildWindowFromPoint
ClientToScreen
CloseClipboard
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DdeCreateDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
DdeGetData
DdeInitializeA
DdeNameService
DdePostAdvise
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeleteMenu
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndPaint
EnumThreadWindows
EnumWindows
EqualRect
FillRect
FindWindowA
FrameRect
GetActiveWindow
GetCapture
GetClassInfoA
GetClassNameA
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessagePos
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSystemMenu
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadKeyboardLayoutA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBeep
MessageBoxA
OemToCharA
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
SendMessageA
SetActiveWindow
SetCapture
SetClassLongA
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemInfoA
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WaitMessage
WinHelpA
WindowFromPoint
wsprintfA
GetSysColor

ole32

CLSIDFromString
CoCreateInstance
CoInitialize
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
IsEqualGUID
StringFromCLSID

oleaut32

CreateErrorInfo
GetErrorInfo
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData
SetErrorInfo
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantCopyInd
VariantInit

wininet

HttpAddRequestHeadersA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetAttemptConnect
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetErrorDlg
InternetOpenA
InternetQueryDataAvailable
InternetQueryOptionA
InternetReadFile
InternetSetOptionA

gdiplus

ord1
ord15
ord16
ord17
ord21
ord24
ord26
ord27
ord34
ord38
ord40
ord56
ord57
ord59
ord62
ord73
ord74
ord75
ord78
ord79
ord84
ord93
ord94
ord109
ord111
ord114
ord118
ord119
ord122
ord124
ord130
ord133
ord134
ord135
ord137
ord139
ord141
ord142
ord143
ord166
ord173
ord181
ord190
ord211
ord218
ord224
ord225
ord238
ord245
ord276
ord281
ord285
ord314
ord315
ord316
ord320
ord325
ord326
ord345
ord371
ord373
ord376
ord377
ord381
ord383
ord395
ord419
ord420
ord421
ord422
ord425
ord455
ord457
ord492
ord494
ord496
ord531
ord532
ord533
ord540
ord552
ord553
ord565
ord567
ord570
ord571
ord574
ord576
ord608
ord609

Exports

Exports

@$xp$13Advgdip@INT16
@$xp$13Advgdip@PARGB
@$xp$13Advgdip@Unit_
@$xp$14Advgdip@Status
@$xp$14Advgdip@TGPPen
@$xp$14Advgdip@UINT16
@$xp$14Advgdip@UINT32
@$xp$14Wsdlbind@IPart
@$xp$14Wsdlbind@IPort
@$xp$14Wsdlbind@TPart
@$xp$14Wsdlbind@TPort
@$xp$15Advgdip@PGPRect
@$xp$15Advgdip@PUINT16
@$xp$15Advgdip@TGPFont
@$xp$15Advgdip@TGPRect
@$xp$15Wsdlbind@IFault
@$xp$15Wsdlbind@IParam
@$xp$15Wsdlbind@IParts
@$xp$15Wsdlbind@IPorts
@$xp$15Wsdlbind@ITypes
@$xp$15Wsdlbind@TParam
@$xp$15Wsdlbind@TParts
@$xp$15Wsdlbind@TPorts
@$xp$15Wsdlbind@TTypes
@$xp$16Advgdip@FillMode
@$xp$16Advgdip@PGPColor
@$xp$16Advgdip@PGPPoint
@$xp$16Advgdip@PGPRectF
@$xp$16Advgdip@TGPBrush
@$xp$16Advgdip@TGPImage
@$xp$16Advgdip@TGPPoint
@$xp$16Advgdip@TGPRectF
@$xp$16Advgdip@WrapMode
@$xp$16Webnode@IWebNode
@$xp$16Wsdlbind@IFaults
@$xp$16Wsdlbind@IImport
@$xp$16Wsdlbind@TFaults
@$xp$16Wsdlbind@TImport
@$xp$17Advgdip@DashStyle
@$xp$17Advgdip@PGPPointF
@$xp$17Advgdip@TGPBitmap
@$xp$17Advgdip@TGPPointF
@$xp$17Advgdip@TGPRegion
@$xp$17Update@UpdateSoap
@$xp$17Wsdlbind@IBinding
@$xp$17Wsdlbind@IImports
@$xp$17Wsdlbind@IMessage
@$xp$17Wsdlbind@IService
@$xp$17Wsdlbind@TBinding
@$xp$17Wsdlbind@TImports
@$xp$17Wsdlbind@TMessage
@$xp$17Wsdlbind@TService
@$xp$17Wsdlintf@TWString
@$xp$18Advgdip@TAntiAlias
@$xp$18Intfinfo@TCallConv
@$xp$18Wsdlbind@IBindings
@$xp$18Wsdlbind@IMessages
@$xp$18Wsdlbind@IPortType
@$xp$18Wsdlbind@IServices
@$xp$18Wsdlbind@TBindings
@$xp$18Wsdlbind@TMessages
@$xp$18Wsdlbind@TPortType
@$xp$18Wsdlbind@TServices
@$xp$18Wsdlnode@TWSDLView
@$xp$18Xsbuiltins@TXSDate
@$xp$18Xsbuiltins@TXSTime
@$xp$19Advgdip@CombineMode
@$xp$19Advgdip@TGPGraphics
@$xp$19Update@GetUpdateRes
@$xp$19Wsdlbind@IOperation
@$xp$19Wsdlbind@IPortTypes
@$xp$19Wsdlbind@TOperation
@$xp$19Wsdlbind@TPortTypes
@$xp$20Advgdip@HotkeyPrefix
@$xp$20Advgdip@TGdiplusBase
@$xp$20Advstyleif@ITMSStyle
@$xp$20Advstyleif@TTMSStyle
@$xp$20Intfinfo@IntfInfo__2
@$xp$20Intfinfo@IntfInfo__3
@$xp$20Opconvert@IOPConvert
@$xp$20Update@AddPackageRes
@$xp$20Update@CreateUserRes
@$xp$20Wsdlbind@IDefinition
@$xp$20Wsdlbind@IDocumented
@$xp$20Wsdlbind@IOperations
@$xp$20Wsdlbind@TDefinition
@$xp$20Wsdlbind@TDocumented
@$xp$20Wsdlbind@TOperations
@$xp$20Wsdlintf@WSDLIntf__2
@$xp$20Wsdlintf@WSDLIntf__3
@$xp$20Wsdlintf@WSDLIntf__4
@$xp$20Wsdlintf@WSDLIntf__5
@$xp$20Wsdlintf@WSDLIntf__6
@$xp$20Wsdlitems@IWSDLItems
@$xp$20Wsdlitems@TWSDLItems
@$xp$20Xsbuiltins@TXSString
@$xp$21Advgdip@TGPFontFamily
@$xp$21Advgdip@TGPSolidBrush
@$xp$21Advgdip@TRectDynArray
@$xp$21Soapenv@TSoapEnvelope
@$xp$21Wsdlintf@TBindingType
@$xp$21Wsdlintf@TWSDLElement
@$xp$21Wsdlintf@TWideStrings
@$xp$21Xsbuiltins@TXSDecimal
@$xp$22Advgdip@DebugEventProc
@$xp$22Advgdip@FlushIntention
@$xp$22Advgdip@RotateFlipType
@$xp$22Advgdip@StringTrimming
@$xp$22Advgdip@TGPImageFormat
@$xp$22Advgdip@TPointDynArray
@$xp$22Advgdip@TRectFDynArray
@$xp$22Advglowbutton@TWinCtrl
@$xp$22Httputil@IStreamLoader
@$xp$22Intfinfo@PIntfMetaData
@$xp$22Intfinfo@TIntfMetaData
@$xp$22Rio@TAfterExecuteEvent
@$xp$22Soapconst@SOAPConst__1
@$xp$22Soapconst@SOAPConst__2
@$xp$22Wsdlbind@IBindingInput
@$xp$22Wsdlbind@IWSDLDocument
@$xp$22Wsdlbind@TWSDLDocument
@$xp$22Wsdlintf@TWSDLElements
@$xp$22Xsbuiltins@TXSDateTime
@$xp$22Xsbuiltins@TXSDuration
@$xp$23Advgdip@DebugEventLevel
@$xp$23Advgdip@StringAlignment
@$xp$23Advgdip@TGPGraphicsPath
@$xp$23Advgdip@TGPStringFormat
@$xp$23Advgdip@TPointFDynArray
@$xp$23Advgdip@TSingleDynArray
@$xp$23Gdipicture@TGDIPPicture
@$xp$23Intfinfo@PIntfMethEntry
@$xp$23Intfinfo@TIntfMethEntry
@$xp$23Rio@TBeforeExecuteEvent
@$xp$23Soaphttpclient@THTTPRIO
@$xp$23Wsdlbind@IBindingOutput
@$xp$23Wsdlbind@IDocumentation
@$xp$23Wsdlbind@IXMLSchemaDefs
@$xp$23Wsdlbind@TDocumentation
@$xp$23Wsdlbind@TXMLSchemaDefs
@$xp$23Xsbuiltins@TXSHexBinary
@$xp$24Advglowbutton@TFocusType
@$xp$24Advglowbutton@TGlowState
@$xp$24Advhintinfo@TAdvHintInfo
@$xp$24Intfinfo@TIntfParamEntry
@$xp$24Update@GetLastReleaseRes
@$xp$24Update@WriteUpdateLogRes
@$xp$24Wsdlitems@IQualifiedName
@$xp$24Wsdlnode@TWSDLClientNode
@$xp$25Advgdip@TGPFontCollection
@$xp$25Advgdip@TextRenderingHint
@$xp$25Httputil@IStringTokenizer
@$xp$25Invokeregistry@TRemotable
@$xp$25Typetrans@TTypeTranslator
@$xp$26Advgdip@LinearGradientMode
@$xp$26Invokeregistry@PTRemotable
@$xp$26Invokeregistry@TDynToClear
@$xp$26Invokeregistry@TInvContext
@$xp$26Soaphttptrans@IHTTPReqResp
@$xp$26Soaphttptrans@THTTPReqResp
@$xp$26Wsdlbind@IBindingOperation
@$xp$26Wsdlbind@TBindingOperation
@$xp$26Wsdlitems@TWSDLIterateProc
@$xp$27Advgdip@GdiplusStartupInput
@$xp$27Advglowbutton@TButtonLayout
@$xp$27Advglowbutton@TGDIPGradient
@$xp$27Invokeregistry@TDataContext
@$xp$27Invokeregistry@TRemRegEntry
@$xp$27Invokeregistry@TRemotableXS
@$xp$27Wsdlbind@IBindingOperations
@$xp$27Wsdlbind@TBindingOperations
@$xp$27Wsdlnode@EWSDLLoadException
@$xp$28Advgdip@GdiplusStartupOutput
@$xp$28Advgdip@NotificationHookProc
@$xp$28Advgdip@PGdiplusStartupInput
@$xp$28Advgdip@TGPPathGradientBrush
@$xp$28Advglowbutton@TAdvGlowButton
@$xp$28Intfinfo@TFillMethodArrayOpt
@$xp$28Intfinfo@TIntfMethEntryArray
@$xp$28Opconvert@TSOAPConvertOption
@$xp$28Optosoapdomconv@TSOAPDomConv
@$xp$28Xsbuiltins@TXSCustomDateTime
@$xp$29Advgdip@PGdiplusStartupOutput
@$xp$29Advglowbutton@TAdvButtonState
@$xp$29Advglowbutton@TAdvButtonStyle
@$xp$29Advglowbutton@TButtonPosition
@$xp$29Intfinfo@TIntfParamEntryArray
@$xp$29Intfinfo@TPIntfMethEntryArray
@$xp$29Invokeregistry@ExtNameMapItem
@$xp$29Opconvert@TSOAPConvertOptions
@$xp$29Optosoapdomconv@ConvNodeState
@$xp$29Optosoapdomconv@TXMLNodeArray
@$xp$29Soapdomconv@TSOAPDOMProcessor
@$xp$29Typetrans@ETypeTransException
@$xp$30Advgdip@NotificationUnhookProc
@$xp$30Advgdip@TGPLinearGradientBrush
@$xp$30Advglowbutton@TButtonSizeState
@$xp$30Advglowbutton@TDBAdvGlowButton
@$xp$30Advglowbutton@TGetConfirmEvent
@$xp$30Advglowbutton@TGetEnabledEvent
@$xp$30Advglowbutton@TGlowButtonState
@$xp$30Advglowbutton@TShortCutHintPos
@$xp$30Invokeregistry@InvRegIntfEntry
@$xp$30Invokeregistry@TInvokableClass
@$xp$30Invokeregistry@TRemotableClass
@$xp$30Optosoapdomconv@TMultiRefNodes
@$xp$30Optosoapdomconv@TSOAPArrayDesc
@$xp$30Wsdlitems@IterateImportOptions
@$xp$30Xsbuiltins@EXSDecimalException
@$xp$31Advglowbutton@TAfterActionEvent
@$xp$31Advglowbutton@TDBGlowButtonType
@$xp$31Advglowbutton@TDropDownPosition
@$xp$31Invokeregistry@InvRegClassEntry
@$xp$31Invokeregistry@TObjMultiOptions
@$xp$31Soapdomconv@IDOMHeaderProcessor
@$xp$31Soaphttptrans@SOAPInvokeOptions
@$xp$31Xsbuiltins@EXSDateTimeException
@$xp$32Advglowbutton@TBeforeActionEvent
@$xp$32Advglowbutton@TDBBDisableControl
@$xp$32Advglowbutton@TDropDownDirection
@$xp$32Intfinfo@EInterfaceRTTIException
@$xp$32Invokeregistry@InvokeRegistry__5
@$xp$32Invokeregistry@InvokeRegistry__6
@$xp$32Invokeregistry@InvokeRegistry__7
@$xp$32Invokeregistry@InvokeRegistry__9
@$xp$32Invokeregistry@TIntfInvokeOption
@$xp$32Invokeregistry@TRemotableXSClass
@$xp$32Optosoapdomconv@TMultiRefNodeMap
@$xp$32Optosoapdomcustom@ICustomConvert
@$xp$32Soaphttptrans@TSOAPInvokeOptions
@$xp$32Xsbuiltins@EXSHexBinaryException
@$xp$33Advglowbutton@TDBBDisableControls
@$xp$33Advglowbutton@TSetButtonSizeEvent
@$xp$33Advglowbutton@TShortCutHintWindow
@$xp$33Invokeregistry@InvokeRegistry__01
@$xp$33Invokeregistry@InvokeRegistry__02
@$xp$33Invokeregistry@InvokeRegistry__22
@$xp$33Invokeregistry@InvokeRegistry__31
@$xp$33Invokeregistry@InvokeRegistry__32
@$xp$33Invokeregistry@InvokeRegistry__42
@$xp$33Invokeregistry@InvokeRegistry__51
@$xp$33Invokeregistry@InvokeRegistry__61
@$xp$33Invokeregistry@InvokeRegistry__71
@$xp$33Invokeregistry@InvokeRegistry__81
@$xp$33Invokeregistry@InvokeRegistry__91
@$xp$33Invokeregistry@TIntfInvokeOptions
@$xp$33Optosoapdomconv@TMultiRefNodeElem
@$xp$33Optosoapdomcustom@TConverterEntry
@$xp$33Wsdlbind@IDocumentationCollection
@$xp$33Wsdlbind@TDocumentationCollection
@$xp$34Advglowbutton@TAdvCustomGlowButton
@$xp$34Advglowbutton@TGlowButtonDrawEvent
@$xp$34Invokeregistry@ERemotableException
@$xp$34Invokeregistry@TCreateInstanceProc
@$xp$34Optosoapdomconv@OPToSOAPDomConv__3
@$xp$34Optosoapdomconv@TSOAPArrayElemDesc
@$xp$35Advglowbutton@TDBGlowButtonDataLink
@$xp$35Advglowbutton@TGlowButtonAppearance
@$xp$35Invokeregistry@MethParamNameMapItem
@$xp$35Invokeregistry@SerializationOptions
@$xp$35Invokeregistry@TInvokableClassClass
@$xp$35Optosoapdomconv@TOPToSoapDomConvert
@$xp$36Invokeregistry@TInvRegIntfEntryArray
@$xp$36Invokeregistry@TSerializationOptions
@$xp$36Optosoapdomconv@ESOAPDomConvertError
@$xp$36Optosoapdomconv@TMultiRefNodeMapElem
@$xp$36Soapdomconv@TDOMHeaderProcessorArray
@$xp$36Soapdomconv@TDOMHeaderProcessorEntry
@$xp$37Invokeregistry@ETypeRegistryException
@$xp$37Invokeregistry@TRemotableTypeRegistry
@$xp$38Advglowbutton@TAdvGlowButtonActionLink
@$xp$38Invokeregistry@TInvokableClassRegistry
@$xp$38Optosoapdomcustom@OPToSOAPDomCustom__2
@$xp$39Invokeregistry@ERemotableExceptionClass
@$xp$44Optosoapdomcustom@TOPToSoapDomCustomRegistry
@$xp$8Rio@TRIO
@@Aupdu1@Finalize
@@Aupdu1@Initialize
@@Keycheck@Finalize
@@Keycheck@Initialize
@@Term@Finalize
@@Term@Initialize
@@Updatecheck@Finalize
@@Updatecheck@Initialize
@@Updshlu1@Finalize
@@Updshlu1@Initialize
@@Wizu1@Finalize
@@Wizu1@Initialize
@Advgdip@Finalization$qqrv
@Advgdip@GetAlpha$qqrui
@Advgdip@GetBlue$qqrui
@Advgdip@GetGreen$qqrui
@Advgdip@GetRed$qqrui
@Advgdip@GlowSpeed
@Advgdip@ImageFormatBMP
@Advgdip@ImageFormatEMF
@Advgdip@ImageFormatEXIF
@Advgdip@ImageFormatGIF
@Advgdip@ImageFormatIcon
@Advgdip@ImageFormatJPEG
@Advgdip@ImageFormatMemoryBMP
@Advgdip@ImageFormatPNG
@Advgdip@ImageFormatTIFF
@Advgdip@ImageFormatUndefined
@Advgdip@ImageFormatWMF
@Advgdip@MakeColor$qqrucucuc
@Advgdip@MakeColor$qqrucucucuc
@Advgdip@MakePoint$qqrff
@Advgdip@MakePoint$qqrii
@Advgdip@MakeRect$qqrffff
@Advgdip@StartupInput
@Advgdip@StartupOutput
@Advgdip@TGPBitmap@
@Advgdip@TGPBitmap@$bctr$qqr34System@%DelphiInterface$t7IStream%i
@Advgdip@TGPBitmap@$bctr$qqriii
@Advgdip@TGPBitmap@$bctr$qqrpv
@Advgdip@TGPBitmap@FromStream$qqr34System@%DelphiInterface$t7IStream%i
@Advgdip@TGPBitmap@GetPixel$qqriirui
@Advgdip@TGPBitmap@SetPixel$qqriiui
@Advgdip@TGPBrush@
@Advgdip@TGPBrush@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPBrush@$bctr$qqrv
@Advgdip@TGPBrush@$bdtr$qqrv
@Advgdip@TGPBrush@SetNativeBrush$qqrpv
@Advgdip@TGPBrush@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPFont@
@Advgdip@TGPFont@$bctr$qqrp21Advgdip@TGPFontFamilyfi13Advgdip@Unit_
@Advgdip@TGPFont@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPFont@$bdtr$qqrv
@Advgdip@TGPFont@SetNativeFont$qqrpv
@Advgdip@TGPFont@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPFontCollection@
@Advgdip@TGPFontCollection@$bctr$qqrv
@Advgdip@TGPFontCollection@$bdtr$qqrv
@Advgdip@TGPFontCollection@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPFontFamily@
@Advgdip@TGPFontFamily@$bctr$qqr17System@WideStringp25Advgdip@TGPFontCollection
@Advgdip@TGPFontFamily@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPFontFamily@$bdtr$qqrv
@Advgdip@TGPFontFamily@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPGraphics@
@Advgdip@TGPGraphics@$bctr$qqrui
@Advgdip@TGPGraphics@$bdtr$qqrv
@Advgdip@TGPGraphics@DrawImage$qqrp16Advgdip@TGPImageii
@Advgdip@TGPGraphics@DrawImageRect$qqrp16Advgdip@TGPImageiiii
@Advgdip@TGPGraphics@DrawPath$qqrp14Advgdip@TGPPenp23Advgdip@TGPGraphicsPath
@Advgdip@TGPGraphics@DrawString$qqr17System@WideStringip15Advgdip@TGPFontrx16Advgdip@TGPRectFp23Advgdip@TGPStringFormatp16Advgdip@TGPBrush
@Advgdip@TGPGraphics@ExcludeClip$qqrp17Advgdip@TGPRegion
@Advgdip@TGPGraphics@ExcludeClip$qqrrx16Advgdip@TGPRectF
@Advgdip@TGPGraphics@FillPath$qqrp16Advgdip@TGPBrushp23Advgdip@TGPGraphicsPath
@Advgdip@TGPGraphics@FillRectangle$qqrp16Advgdip@TGPBrushffff
@Advgdip@TGPGraphics@FillRectangle$qqrp16Advgdip@TGPBrushrx16Advgdip@TGPRectF
@Advgdip@TGPGraphics@Flush$qqr22Advgdip@FlushIntention
@Advgdip@TGPGraphics@GetCompositingQuality$qqrv
@Advgdip@TGPGraphics@GetHDC$qqrv
@Advgdip@TGPGraphics@GetLastStatus$qqrv
@Advgdip@TGPGraphics@GetNativeGraphics$qqrv
@Advgdip@TGPGraphics@GetSmoothingMode$qqrv
@Advgdip@TGPGraphics@GetTextRenderingHint$qqrv
@Advgdip@TGPGraphics@MeasureString$qqr17System@WideStringip15Advgdip@TGPFontrx16Advgdip@TGPRectFp23Advgdip@TGPStringFormatr16Advgdip@TGPRectFpit7
@Advgdip@TGPGraphics@ReleaseHDC$qqrui
@Advgdip@TGPGraphics@ResetClip$qqrv
@Advgdip@TGPGraphics@SetClip$qqrp17Advgdip@TGPRegion19Advgdip@CombineMode
@Advgdip@TGPGraphics@SetCompositingQuality$qqri
@Advgdip@TGPGraphics@SetNativeGraphics$qqrpv
@Advgdip@TGPGraphics@SetSmoothingMode$qqri
@Advgdip@TGPGraphics@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPGraphics@SetTextRenderingHint$qqr25Advgdip@TextRenderingHint
@Advgdip@TGPGraphicsPath@
@Advgdip@TGPGraphicsPath@$bctr$qqr16Advgdip@FillMode
@Advgdip@TGPGraphicsPath@$bctr$qqrpv
@Advgdip@TGPGraphicsPath@$bdtr$qqrv
@Advgdip@TGPGraphicsPath@AddArc$qqrffffff
@Advgdip@TGPGraphicsPath@AddArc$qqrrx16Advgdip@TGPRectFff
@Advgdip@TGPGraphicsPath@AddCurve$qqrp16Advgdip@TGPPointi
@Advgdip@TGPGraphicsPath@AddCurve$qqrp17Advgdip@TGPPointFi
@Advgdip@TGPGraphicsPath@AddEllipse$qqrffff
@Advgdip@TGPGraphicsPath@AddEllipse$qqrrx16Advgdip@TGPRectF
@Advgdip@TGPGraphicsPath@AddLine$qqrffff
@Advgdip@TGPGraphicsPath@AddLine$qqrrx17Advgdip@TGPPointFt1
@Advgdip@TGPGraphicsPath@AddPie$qqrffffff
@Advgdip@TGPGraphicsPath@AddPie$qqrrx16Advgdip@TGPRectFff
@Advgdip@TGPGraphicsPath@AddPolygon$qqrp16Advgdip@TGPPointi
@Advgdip@TGPGraphicsPath@AddPolygon$qqrp17Advgdip@TGPPointFi
@Advgdip@TGPGraphicsPath@CloseFigure$qqrv
@Advgdip@TGPGraphicsPath@SetNativePath$qqrpv
@Advgdip@TGPGraphicsPath@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPImage@
@Advgdip@TGPImage@$bctr$qqr17System@WideStringi
@Advgdip@TGPImage@$bctr$qqr34System@%DelphiInterface$t7IStream%i
@Advgdip@TGPImage@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPImage@$bdtr$qqrv
@Advgdip@TGPImage@GetFormat$qqrv
@Advgdip@TGPImage@GetHeight$qqrv
@Advgdip@TGPImage@GetWidth$qqrv
@Advgdip@TGPImage@RotateFlip$qqr22Advgdip@RotateFlipType
@Advgdip@TGPImage@SetNativeImage$qqrpv
@Advgdip@TGPImage@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPLinearGradientBrush@
@Advgdip@TGPLinearGradientBrush@$bctr$qqrrx15Advgdip@TGPRectuiui26Advgdip@LinearGradientMode
@Advgdip@TGPLinearGradientBrush@$bctr$qqrrx16Advgdip@TGPRectFuiui26Advgdip@LinearGradientMode
@Advgdip@TGPLinearGradientBrush@$bctr$qqrv
@Advgdip@TGPPathGradientBrush@
@Advgdip@TGPPathGradientBrush@$bctr$qqrp23Advgdip@TGPGraphicsPath
@Advgdip@TGPPathGradientBrush@GetCenterColor$qqrrui
@Advgdip@TGPPathGradientBrush@GetCenterPoint$qqrr16Advgdip@TGPPoint
@Advgdip@TGPPathGradientBrush@GetCenterPoint$qqrr17Advgdip@TGPPointF
@Advgdip@TGPPathGradientBrush@GetPointCount$qqrv
@Advgdip@TGPPathGradientBrush@GetSurroundColors$qqrpuiri
@Advgdip@TGPPathGradientBrush@SetCenterColor$qqrui
@Advgdip@TGPPathGradientBrush@SetCenterPoint$qqrrx16Advgdip@TGPPoint
@Advgdip@TGPPathGradientBrush@SetCenterPoint$qqrrx17Advgdip@TGPPointF
@Advgdip@TGPPathGradientBrush@SetSurroundColors$qqrpuiri
@Advgdip@TGPPen@
@Advgdip@TGPPen@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPPen@$bctr$qqruif
@Advgdip@TGPPen@$bdtr$qqrv
@Advgdip@TGPPen@GetDashStyle$qqrv
@Advgdip@TGPPen@SetDashStyle$qqr17Advgdip@DashStyle
@Advgdip@TGPPen@SetEndCap$qqri
@Advgdip@TGPPen@SetNativePen$qqrpv
@Advgdip@TGPPen@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPRegion@
@Advgdip@TGPRegion@$bctr$qqrp23Advgdip@TGPGraphicsPath
@Advgdip@TGPRegion@$bctr$qqrrx16Advgdip@TGPRectF
@Advgdip@TGPRegion@$bdtr$qqrv
@Advgdip@TGPRegion@Exclude$qqrp23Advgdip@TGPGraphicsPath
@Advgdip@TGPRegion@SetNativeRegion$qqrpv
@Advgdip@TGPRegion@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPRegion@Union$qqrp17Advgdip@TGPRegion
@Advgdip@TGPSolidBrush@
@Advgdip@TGPSolidBrush@$bctr$qqrui
@Advgdip@TGPSolidBrush@$bctr$qqrv
@Advgdip@TGPStringFormat@
@Advgdip@TGPStringFormat@$bctr$qqrius
@Advgdip@TGPStringFormat@$bctr$qqrpv14Advgdip@Status
@Advgdip@TGPStringFormat@$bdtr$qqrv
@Advgdip@TGPStringFormat@Assign$qqrp23Advgdip@TGPStringFormat
@Advgdip@TGPStringFormat@GetAlignment$qqrv
@Advgdip@TGPStringFormat@GetHotkeyPrefix$qqrv
@Advgdip@TGPStringFormat@GetLineAlignment$qqrv
@Advgdip@TGPStringFormat@GetTrimming$qqrv
@Advgdip@TGPStringFormat@SetAlignment$qqr23Advgdip@StringAlignment
@Advgdip@TGPStringFormat@SetHotkeyPrefix$qqr20Advgdip@HotkeyPrefix
@Advgdip@TGPStringFormat@SetLineAlignment$qqr23Advgdip@StringAlignment
@Advgdip@TGPStringFormat@SetStatus$qqr14Advgdip@Status
@Advgdip@TGPStringFormat@SetTrimming$qqr22Advgdip@StringTrimming
@Advgdip@TGdiplusBase@
@Advgdip@TGdiplusBase@FreeInstance$qqrv
@Advgdip@TGdiplusBase@NewInstance$qqrp17System@TMetaClass
@Advgdip@gdiplusToken
@Advgdip@initialization$qqrv
@Advglowbutton@Finalization$qqrv
@Advglowbutton@TAdvCustomGlowButton@
@Advglowbutton@TAdvCustomGlowButton@$bctr$qqrp18Classes@TComponent
@Advglowbutton@TAdvCustomGlowButton@$bdtr$qqrv
@Advglowbutton@TAdvCustomGlowButton@ActionChange$qqrp14System@TObjecto
@Advglowbutton@TAdvCustomGlowButton@CMButtonPressed$qqrr17Messages@TMessage
@Advglowbutton@TAdvCustomGlowButton@CMDialogChar$qqrr15Messages@TWMKey
@Advglowbutton@TAdvCustomGlowButton@CMDialogKey$qqrr15Messages@TWMKey
@Advglowbutton@TAdvCustomGlowButton@CMEnabledChanged$qqrr17Messages@TMessage
@Advglowbutton@TAdvCustomGlowButton@CMFocusChanged$qqrr24Controls@TCMFocusChanged
@Advglowbutton@TAdvCustomGlowButton@CMMouseEnter$qqrr17Messages@TMessage
@Advglowbutton@TAdvCustomGlowButton@CMMouseLeave$qqrr17Messages@TMessage
@Advglowbutton@TAdvCustomGlowButton@CMTextChanged$qqrr17Messages@TMessage
@Advglowbutton@TAdvCustomGlowButton@CNCommand$qqrr19Messages@TWMCommand
@Advglowbutton@TAdvCustomGlowButton@Click$qqrv
@Advglowbutton@TAdvCustomGlowButton@CreateParams$qqrr22Controls@TCreateParams
@Advglowbutton@TAdvCustomGlowButton@CreateWnd$qqrv
@Advglowbutton@TAdvCustomGlowButton@DoDropDown$qqrv
@Advglowbutton@TAdvCustomGlowButton@DoEnter$qqrv
@Advglowbutton@TAdvCustomGlowButton@DoExit$qqrv
@Advglowbutton@TAdvCustomGlowButton@DrawGlyphCaption$qqrv
@Advglowbutton@TAdvCustomGlowButton@GetActionLinkClass$qqrv
@Advglowbutton@TAdvCustomGlowButton@GetButtonSize$qqr30Advglowbutton@TButtonSizeState
@Advglowbutton@TAdvCustomGlowButton@GetToolImage$qqrp16Graphics@TBitmap
@Advglowbutton@TAdvCustomGlowButton@GetVersion$qqrv
@Advglowbutton@TAdvCustomGlowButton@GetVersionNr$qqrv
@Advglowbutton@TAdvCustomGlowButton@HideShortCutHint$qqrv
@Advglowbutton@TAdvCustomGlowButton@InternalClick$qqrv
@Advglowbutton@TAdvCustomGlowButton@IsFontStored$qqrv
@Advglowbutton@TAdvCustomGlowButton@IsMenuButton$qqrv
@Advglowbutton@TAdvCustomGlowButton@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Advglowbutton@TAdvCustomGlowButton@KeyPress$qqrrc
@Advglowbutton@TAdvCustomGlowButton@KeyUp$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Advglowbutton@TAdvCustomGlowButton@Loaded$qqrv
@Advglowbutton@TAdvCustomGlowButton@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Advglowbutton@TAdvCustomGlowButton@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Advglowbutton@TAdvCustomGlowButton@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Advglowbutton@TAdvCustomGlowButton@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Advglowbutton@TAdvCustomGlowButton@OnAppearanceChanged$qqrp14System@TObject
@Advglowbutton@TAdvCustomGlowButton@Paint$qqrv
@Advglowbutton@TAdvCustomGlowButton@PerformResize$qqrv
@Advglowbutton@TAdvCustomGlowButton@PictureChanged$qqrp14System@TObject
@Advglowbutton@TAdvCustomGlowButton@PopupBtnDown$qqrv
@Advglowbutton@TAdvCustomGlowButton@SetAllowAllUp$qqrxo
@Advglowbutton@TAdvCustomGlowButton@SetAntiAlias$qqrx18Advgdip@TAntiAlias
@Advglowbutton@TAdvCustomGlowButton@SetAppearance$qqrpx35Advglowbutton@TGlowButtonAppearance
@Advglowbutton@TAdvCustomGlowButton@SetAutoSizeEx$qqrxo
@Advglowbutton@TAdvCustomGlowButton@SetBorderStyle$qqrx22Forms@TFormBorderStyle

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 83KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Updshlc.xml
WPFToolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8
Signer

Actual PE Digest

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\obj\Release\WPFToolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.AvalonDock.Themes.Aero.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.AvalonDock.Themes.Metro.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.AvalonDock.Themes.VS2010.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.AvalonDock.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.DataGrid.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.DataGrid\obj\Release\Xceed.Wpf.DataGrid.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xceed.Wpf.Toolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\ExtendedWPFToolkit\Release\3.3.0\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
avast.ico
x64/SQLite.Interop.dll
.dll windows:5 windows x64 arch:x64

6bfef2a67980f50a8007b5084169294b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet\bin\2010\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

kernel32

UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MapViewOfFile
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFileAttributesW
GetFullPathNameW
ExitThread
CreateThread
EncodePointer
DecodePointer
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
GetTimeZoneInformation
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
GetModuleHandleW
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
RaiseException

advapi32

CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData

Exports

Exports

interop_compileoption_get
interop_compileoption_used
interop_libversion
interop_sourceid
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_finish_interop
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_double_interop
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_int64_interop
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_parameter_name_interop
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_close_interop
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes_interop
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_interop
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_database_name16_interop
sqlite3_column_database_name_interop
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_decltype16_interop
sqlite3_column_decltype_interop
sqlite3_column_double
sqlite3_column_double_interop
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64_interop
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_name16_interop
sqlite3_column_name_interop
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_origin_name16_interop
sqlite3_column_origin_name_interop
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_table_name16_interop
sqlite3_column_table_name_interop
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_text16_interop
sqlite3_column_text_interop
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_collcompare_interop
sqlite3_context_collseq_interop
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_disposable_module_interop
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_interop
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_cursor_rowid_interop
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errmsg_interop
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_finalize_interop
sqlite3_free
sqlite3_free_table
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_index_column_info_interop
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_last_insert_rowid
sqlite3_last_insert_rowid_interop
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_malloc_size_interop
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_highwater_interop
sqlite3_memory_used
sqlite3_memory_used_interop
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open16_interop
sqlite3_open_interop
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_interop
sqlite3_prepare16_v2
sqlite3_prepare_interop
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_reset_interop
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_double_interop
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_int64_interop
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_table_column_metadata_interop
sqlite3_table_cursor_interop
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_double_interop
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_int64_interop
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16_interop
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_text_interop
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/SQLite.Interop.dll
.dll windows:5 windows x86 arch:x86

8055db0db8e173f114741eb1a0e6c492

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

kernel32

UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
MapViewOfFile
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
HeapValidate
GetFullPathNameW
ExitThread
CreateThread
InterlockedExchange
EncodePointer
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetModuleFileNameW
RtlUnwind
GetStringTypeW
CompareStringW
SetEnvironmentVariableA

advapi32

CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData

Exports

Exports

_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 891KB - Virtual size: 891KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

edb20cb9a820a54943b8a5a44cbd4e77

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9dCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4f:92:31:5d:60:7f:2c:d6:8b:40:67:e3:60:ea:1e:24:a6:d8:33:47:bb:13:05:4f:8f:81:ef:88:a6:fb:05:c0Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 6KB - Virtual size: 182KB

.ndata Size: - Virtual size: 232KB

.rsrc Size: 108KB - Virtual size: 108KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 333KB - Virtual size: 333KB

.rsrc Size: 321KB - Virtual size: 320KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 15KB - Virtual size: 15KB

.rsrc Size: 312KB - Virtual size: 311KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 511KB - Virtual size: 510KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

01:71:71:dc:5c:21:5a:3d:5a:7e:99:e3:fc:52:c5:9d
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4f:92:31:5d:60:7f:2c:d6:8b:40:67:e3:60:ea:1e:24:a6:d8:33:47:bb:13:05:4f:8f:81:ef:88:a6:fb:05:c0
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 6KB - Virtual size: 182KB

.ndata
Size: - Virtual size: 232KB

.rsrc
Size: 108KB - Virtual size: 108KB

.text
Size: 333KB - Virtual size: 333KB

.rsrc
Size: 321KB - Virtual size: 320KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 312KB - Virtual size: 311KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 511KB - Virtual size: 510KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 333KB - Virtual size: 333KB

.rsrc
Size: 321KB - Virtual size: 320KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 312KB - Virtual size: 311KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 511KB - Virtual size: 510KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 333KB - Virtual size: 333KB

.rsrc
Size: 321KB - Virtual size: 320KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 312KB - Virtual size: 311KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 511KB - Virtual size: 510KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2KB - Virtual size: 1KB