crypt32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crypt32.dll
Size

1014KB
MD5

87f02c4583fdebee4261c4ebfb71766b
SHA1

4656b1a4ad97ab048ca8f01fb0b49ac82cd35c90
SHA256

986f2ad6c43cd57c5285f4fe6230921aa1c628a9c58b39cc57c64092eb100c1a
SHA512

82da55fde11034c74f45c37de9743ab7accac84239794441d89233eadb2d869048fd67bb09f61ab68e555408e15cc9eb16287e791bd4371e947e21a22e8be1fe
SSDEEP

24576:rtEsHxOezSTaY15nfoYsfXPb2ocO5udtWLN/s:resIlxznuItWLi

Score

1^/10

Malware Config

Signatures

Files

crypt32.dll
.dll windows:10 windows x86 arch:x86

b89d6fd53f81e7b557114fdcc8e326c6

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:6c:43:d9:2d:ae:29:c2:07:70:1f:6c:43:13:af:79:c5:f6:b0:ea:e3:00:23:af:bd:15:25:7d:39:95:2d:9e
Signer

Actual PE Digest

be:6c:43:d9:2d:ae:29:c2:07:70:1f:6c:43:13:af:79:c5:f6:b0:ea:e3:00:23:af:bd:15:25:7d:39:95:2d:9e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

crypt32.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__itoa_s
_o__itow
_o__ltoa
_o__ltow
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__swab
_o__ultoa_s
_o__ultow_s
memmove
_o__wcsicmp
_o_atol
_o_bsearch
_o_free
_o_isdigit
_o_isupper
_o_iswalnum
_o_iswalpha
_o_iswspace
_o_isxdigit
_o_memcpy_s
_o_qsort
_o_qsort_s
_o_strtoul
_o_toupper
_o_towlower
_o_wcstoul
_except_handler4_common
_o__execute_onexit_table
_o__crt_atexit
_o__configure_narrow_argv
_o___std_type_info_destroy_list
_o__cexit
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-registry-l1-1-0

RegEnumKeyExA
RegLoadMUIStringW
RegGetKeySecurity
RegCreateKeyExW
RegSetValueExW
RegSetKeySecurity
RegOpenKeyExA
RegOpenKeyExW
RegDeleteValueW
RegGetValueW
RegCreateKeyExA
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExA
RegDeleteKeyExW
RegEnumKeyExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseSemaphore
WaitForSingleObjectEx
EnterCriticalSection
CreateEventA
WaitForMultipleObjectsEx
ReleaseMutex
SetEvent
InitializeCriticalSectionEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
InitializeSRWLock
InitializeCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA
ExpandEnvironmentStringsW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalReAlloc
LocalFree

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
OpenThreadToken
GetCurrentThread
SetThreadToken
GetCurrentThreadId
GetCurrentProcessId
ExitThread
TlsAlloc
TlsGetValue
SetThreadStackGuarantee
TlsSetValue
TlsFree
TerminateProcess
GetCurrentProcess
CreateThread

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetWindowsDirectoryW
GetVersionExA
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
FreeLibraryAndExitThread
LoadStringW
GetModuleHandleExW
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleW
FreeResource
LoadResource
SizeofResource
LockResource
GetModuleFileNameW

api-ms-win-core-file-l1-1-0

FindNextFileW
FindClose
FindNextChangeNotification
DeleteFileW
FindCloseChangeNotification
FindFirstChangeNotificationW
ReadFile
FindFirstFileW
GetFileSizeEx
GetFileAttributesW
CreateDirectoryW
CreateFileW
SetEndOfFile
SetFilePointer
GetFileSize
SetFileAttributesW
WriteFile
GetTempFileNameW
FileTimeToLocalFileTime
GetFileAttributesExW
CompareFileTime

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetACP
IdnToUnicode
IdnToAscii

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
FreeLibraryWhenCallbackReturns
TrySubmitThreadpoolCallback
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatA
GetDateFormatW
GetTimeFormatW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
VirtualQuery
UnmapViewOfFile
VirtualProtect
VirtualAlloc

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-security-grouppolicy-l1-1-0

RegisterGPNotificationInternal
UnregisterGPNotificationInternal

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
CreateFileMappingA
FindResourceExA

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW
lstrlenA
lstrcmpA

ntdll

MD5Final
A_SHAInit
A_SHAUpdate
A_SHAFinal
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
wcsstr
memmove_s
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
wcsncmp
RtlNtStatusToDosError
NtQuerySystemInformation
EvtIntReportEventAndSourceAsync
RtlPublishWnfStateData
RtlQueryWnfStateData
wcsrchr
MD5Init
strchr
EtwTraceMessage
WinSqmIncrementDWORD
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
_vsnwprintf
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
ShipAssert
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
MD5Update
RtlPrefixUnicodeString
NtQueryObject
RtlInitUnicodeString
RtlIsStateSeparationEnabled
wcschr
NtQueryInformationFile
EtwEventUnregister
EtwEventWriteFull
strncmp
RtlUnsubscribeWnfNotificationWaitForCompletion
EtwEventRegister
RtlSubscribeWnfStateChangeNotification
_vsnprintf

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CertAddCRLContextToStore
CertAddCRLLinkToStore
CertAddCTLContextToStore
CertAddCTLLinkToStore
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertAddEncodedCRLToStore
CertAddEncodedCTLToStore
CertAddEncodedCertificateToStore
CertAddEncodedCertificateToSystemStoreA
CertAddEncodedCertificateToSystemStoreW
CertAddEnhancedKeyUsageIdentifier
CertAddRefServerOcspResponse
CertAddRefServerOcspResponseContext
CertAddSerializedElementToStore
CertAddStoreToCollection
CertAlgIdToOID
CertCloseServerOcspResponse
CertCloseStore
CertCompareCertificate
CertCompareCertificateName
CertCompareIntegerBlob
CertComparePublicKeyInfo
CertControlStore
CertCreateCRLContext
CertCreateCTLContext
CertCreateCTLEntryFromCertificateContextProperties
CertCreateCertificateChainEngine
CertCreateCertificateContext
CertCreateContext
CertCreateSelfSignCertificate
CertDeleteCRLFromStore
CertDeleteCTLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CertDuplicateCTLContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCRLContextProperties
CertEnumCRLsInStore
CertEnumCTLContextProperties
CertEnumCTLsInStore
CertEnumCertificateContextProperties
CertEnumCertificatesInStore
CertEnumPhysicalStore
CertEnumSubjectInSortedCTL
CertEnumSystemStore
CertEnumSystemStoreLocation
CertFindAttribute
CertFindCRLInStore
CertFindCTLInStore
CertFindCertificateInCRL
CertFindCertificateInStore
CertFindChainInStore
CertFindExtension
CertFindRDNAttr
CertFindSubjectInCTL
CertFindSubjectInSortedCTL
CertFreeCRLContext
CertFreeCTLContext
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChainList
CertFreeCertificateContext
CertFreeServerOcspResponseContext
CertGetCRLContextProperty
CertGetCRLFromStore
CertGetCTLContextProperty
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetIssuerCertificateFromStore
CertGetNameStringA
CertGetNameStringW
CertGetPublicKeyLength
CertGetServerOcspResponseContext
CertGetStoreProperty
CertGetSubjectCertificateFromStore
CertGetValidUsages
CertIsRDNAttrsInCertificateName
CertIsStrongHashToSign
CertIsValidCRLForCertificate
CertIsWeakHash
CertNameToStrA
CertNameToStrW
CertOIDToAlgId
CertOpenServerOcspResponse
CertOpenStore
CertOpenSystemStoreA
CertOpenSystemStoreW
CertRDNValueToStrA
CertRDNValueToStrW
CertRegisterPhysicalStore
CertRegisterSystemStore
CertRemoveEnhancedKeyUsageIdentifier
CertRemoveStoreFromCollection
CertResyncCertificateChainEngine
CertRetrieveLogoOrBiometricInfo
CertSaveStore
CertSelectCertificateChains
CertSerializeCRLStoreElement
CertSerializeCTLStoreElement
CertSerializeCertificateStoreElement
CertSetCRLContextProperty
CertSetCTLContextProperty
CertSetCertificateContextPropertiesFromCTLEntry
CertSetCertificateContextProperty
CertSetEnhancedKeyUsage
CertSetStoreProperty
CertStrToNameA
CertStrToNameW
CertUnregisterPhysicalStore
CertUnregisterSystemStore
CertVerifyCRLRevocation
CertVerifyCRLTimeValidity
CertVerifyCTLUsage
CertVerifyCertificateChainPolicy
CertVerifyRevocation
CertVerifySubjectCertificateContext
CertVerifyTimeValidity
CertVerifyValidityNesting
CreateFileU
CryptAcquireCertificatePrivateKey
CryptAcquireContextU
CryptBinaryToStringA
CryptBinaryToStringW
CryptCloseAsyncHandle
CryptCreateAsyncHandle
CryptCreateKeyIdentifierFromCSP
CryptDecodeMessage
CryptDecodeObject
CryptDecodeObjectEx
CryptDecryptAndVerifyMessageSignature
CryptDecryptMessage
CryptEncodeObject
CryptEncodeObjectEx
CryptEncryptMessage
CryptEnumKeyIdentifierProperties
CryptEnumOIDFunction
CryptEnumOIDInfo
CryptEnumProvidersU
CryptExportPKCS8
CryptExportPublicKeyInfo
CryptExportPublicKeyInfoEx
CryptExportPublicKeyInfoFromBCryptKeyHandle
CryptFindCertificateKeyProvInfo
CryptFindLocalizedName
CryptFindOIDInfo
CryptFormatObject
CryptFreeOIDFunctionAddress
CryptGetAsyncParam
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptGetKeyIdentifierProperty
CryptGetMessageCertificates
CryptGetMessageSignerCount
CryptGetOIDFunctionAddress
CryptGetOIDFunctionValue
CryptHashCertificate
CryptHashCertificate2
CryptHashMessage
CryptHashPublicKeyInfo
CryptHashToBeSigned
CryptImportPKCS8
CryptImportPublicKeyInfo
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfoEx2
CryptInitOIDFunctionSet
CryptInstallDefaultContext
CryptInstallOIDFunctionAddress
CryptLoadSip
CryptMemAlloc
CryptMemFree
CryptMemRealloc
CryptMsgCalculateEncodedLength
CryptMsgClose
CryptMsgControl
CryptMsgCountersign
CryptMsgCountersignEncoded
CryptMsgDuplicate
CryptMsgEncodeAndSignCTL
CryptMsgGetAndVerifySigner
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgOpenToEncode
CryptMsgSignCTL
CryptMsgUpdate
CryptMsgVerifyCountersignatureEncoded
CryptMsgVerifyCountersignatureEncodedEx
CryptObjectLocatorFree
CryptObjectLocatorGet
CryptObjectLocatorGetContent
CryptObjectLocatorGetUpdated
CryptObjectLocatorInitialize
CryptObjectLocatorIsChanged
CryptObjectLocatorRelease
CryptProtectData
CryptProtectMemory
CryptQueryObject
CryptRegisterDefaultOIDFunction
CryptRegisterOIDFunction
CryptRegisterOIDInfo
CryptRetrieveTimeStamp
CryptSIPAddProvider
CryptSIPCreateIndirectData
CryptSIPGetCaps
CryptSIPGetSealedDigest
CryptSIPGetSignedDataMsg
CryptSIPLoad
CryptSIPPutSignedDataMsg
CryptSIPRemoveProvider
CryptSIPRemoveSignedDataMsg
CryptSIPRetrieveSubjectGuid
CryptSIPRetrieveSubjectGuidForCatalogFile
CryptSIPVerifyIndirectData
CryptSetAsyncParam
CryptSetKeyIdentifierProperty
CryptSetOIDFunctionValue
CryptSetProviderU
CryptSignAndEncodeCertificate
CryptSignAndEncryptMessage
CryptSignCertificate
CryptSignHashU
CryptSignMessage
CryptSignMessageWithKey
CryptStringToBinaryA
CryptStringToBinaryW
CryptUninstallDefaultContext
CryptUnprotectData
CryptUnprotectMemory
CryptUnregisterDefaultOIDFunction
CryptUnregisterOIDFunction
CryptUnregisterOIDInfo
CryptUpdateProtectedState
CryptVerifyCertificateSignature
CryptVerifyCertificateSignatureEx
CryptVerifyDetachedMessageHash
CryptVerifyDetachedMessageSignature
CryptVerifyMessageHash
CryptVerifyMessageSignature
CryptVerifyMessageSignatureWithKey
CryptVerifySignatureU
CryptVerifyTimeStampSignature
I_CertChainEngineIsDisallowedCertificate
I_CertDiagControl
I_CertFinishSslHandshake
I_CertProcessSslHandshake
I_CertProtectFunction
I_CertSrvProtectFunction
I_CertSyncStore
I_CertUpdateStore
I_CertWnfEnableFlushCache
I_CryptAddRefLruEntry
I_CryptAddSmartCardCertToStore
I_CryptAllocTls
I_CryptAllocTlsEx
I_CryptCreateLruCache
I_CryptCreateLruEntry
I_CryptDetachTls
I_CryptDisableLruOfEntries
I_CryptEnableLruOfEntries
I_CryptEnumMatchingLruEntries
I_CryptFindLruEntry
I_CryptFindLruEntryData
I_CryptFindSmartCardCertInStore
I_CryptFlushLruCache
I_CryptFreeLruCache
I_CryptFreeTls
I_CryptGetAsn1Decoder
I_CryptGetAsn1Encoder
I_CryptGetDefaultCryptProv
I_CryptGetDefaultCryptProvForEncrypt
I_CryptGetFileVersion
I_CryptGetLruEntryData
I_CryptGetLruEntryIdentifier
I_CryptGetOssGlobal
I_CryptGetTls
I_CryptInsertLruEntry
I_CryptInstallAsn1Module
I_CryptInstallOssGlobal
I_CryptReadTrustedPublisherDWORDValueFromRegistry
I_CryptRegisterSmartCardStore
I_CryptReleaseLruEntry
I_CryptRemoveLruEntry
I_CryptSetTls
I_CryptTouchLruEntry
I_CryptUninstallAsn1Module
I_CryptUninstallOssGlobal
I_CryptUnregisterSmartCardStore
I_CryptWalkAllLruCacheEntries
I_PFXDecrypt
I_PFXHMAC
I_PFXImportCertStoreEx
PFXExportCertStore
PFXExportCertStore2
PFXExportCertStoreEx
PFXImportCertStore
PFXIsPFXBlob
PFXVerifyPassword
RegCreateHKCUKeyExU
RegCreateKeyExU
RegDeleteValueU
RegEnumValueU
RegOpenHKCUKeyExU
RegOpenKeyExU
RegQueryInfoKeyU
RegQueryValueExU
RegSetValueExU

Sections

.text
Size: 941KB - Virtual size: 941KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b89d6fd53f81e7b557114fdcc8e326c6

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

be:6c:43:d9:2d:ae:29:c2:07:70:1f:6c:43:13:af:79:c5:f6:b0:ea:e3:00:23:af:bd:15:25:7d:39:95:2d:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-security-grouppolicy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 941KB - Virtual size: 941KB

.data Size: 2KB - Virtual size: 15KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 1024B - Virtual size: 948B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 39KB - Virtual size: 39KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

be:6c:43:d9:2d:ae:29:c2:07:70:1f:6c:43:13:af:79:c5:f6:b0:ea:e3:00:23:af:bd:15:25:7d:39:95:2d:9e
Signer

.text
Size: 941KB - Virtual size: 941KB

.data
Size: 2KB - Virtual size: 15KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1024B - Virtual size: 948B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 39KB - Virtual size: 39KB